Update Renovatebot GHA Updates

[protocols-renovate]

This PR contains the following updates:

Package	Type	Update	Change
ConsenSys/github-actions (changelog)	action	digest	13686f2 → 31dbb91
actions/setup-java	action	minor	v5.2.0 → v5.5.0
gradle/actions	action	minor	v6.1.0 → v6.2.0

---

Release Notes

actions/setup-java (actions/setup-java)

v5.5.0

Compare Source

What's Changed

• chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by @​brunoborges in #​1061
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​1069
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1068
• Bump actions/setup-python from 5 to 6 by @​dependabot[bot] in #​1067
• Bump @​typescript-eslint/parser from 8.61.1 to 8.62.0 by @​dependabot[bot] in #​1062
• feat: Add verify-signature plumbing and Temurin+Microsoft verification support by @​johnoliver in #​1060
• Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by @​jmjaffe37 in #​1070
• Fix arm64 e2e workflow tests mislabeled as x64 by @​brunoborges with @​Copilot in #​1073
• feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by @​brunoborges in #​1053
• feat: Disable interactiveMode in generated Maven settings.xml by @​brunoborges with @​Copilot in #​1052
• Bump prettier from 3.6.2 to 3.9.1 by @​dependabot[bot] in #​1066
• chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by @​dependabot[bot] in #​1074
• fix: Maven Toolchains grows unexpectedly by @​Okeanos in #​534
• dist: Support Tencent Kona JDK by @​johnshajiang in #​672
• feat: Add set-default option by @​gsmet in #​1017
• docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by @​brunoborges in #​1075
• feat: Add distribution detection support to .sdkmanrc file by @​lukaszgyg in #​975

New Contributors

• @​jmjaffe37 made their first contribution in #​1070
• @​gsmet made their first contribution in #​1017
• @​lukaszgyg made their first contribution in #​975

Full Changelog: actions/setup-java@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

• Bump @​typescript-eslint/parser from 8.48.0 to 8.61.1 by @​dependabot[bot] in #​1021
• Fix codeql workflow permissions by @​jsoref in #​993
• fix CodeQL permissions by @​gdams in #​1025
• fix: reject non-semver candidate versions in isVersionSatisfies by @​sproctor in #​1009
• Bump @​actions/cache to 5.1.0, handle cache write denied by @​jasongin in #​1026
• Add Maven Wrapper cache feature by @​mahabaleshwars in #​1027
• Spelling by @​jsoref in #​713
• add link to advanced configuration for JetBrains by @​robstoll in #​850
• docs(action): fix missing required or default fields by @​kranthipoturaju in #​1007
• feat: add microsoft openjdk 17.0.18 by @​al-kau in #​1002
• Update README.md - use "alert syntax for Markdown" for notes by @​mhoffrog in #​924
• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​1033
• Update contributor guide with emoji for clarity by @​brunoborges in #​1028
• add javac problem matcher by @​Trass3r in #​562
• Clarify README version syntax and migration guidance by @​brunoborges with @​Copilot in #​1038
• Update undici artifacts to 6.27.0 (license cache + dist) by @​brunoborges in #​1040
• docs: enhance custom jdk file installation by @​stephanabel in #​996
• Templates for new Java distributions by @​panticmilos in #​429
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1032
• Bump @​types/node from 25.9.3 to 26.0.0 by @​dependabot[bot] in #​1031
• docs: replace non-existent HelloWorldApp references with java --version by @​brunoborges with @​Copilot in #​1043
• docs: add JavaFX Maven project configuration instructions by @​brunoborges with @​Copilot in #​1044
• docs: self-signed certificate / internal CA handling for GitHub Enterprise by @​brunoborges in #​1050
• docs: document importing an internal CA into the installed JDK (cacerts) by @​brunoborges in #​1051
• chore: Harden workflows: least-privilege permissions + zizmor integration by @​brunoborges in #​1039
• dist: Add GraalVM Community distribution support by @​brunoborges with @​Copilot in #​1042
• docs: note jdkfile approach for Early Access / unreleased JDK builds by @​brunoborges in #​1058
• dist: Apply Copilot review suggestions from PR #​1042 (GraalVM Community) by @​brunoborges in #​1059

New Contributors

• @​jsoref made their first contribution in #​993
• @​sproctor made their first contribution in #​1009
• @​jasongin made their first contribution in #​1026
• @​robstoll made their first contribution in #​850
• @​kranthipoturaju made their first contribution in #​1007
• @​al-kau made their first contribution in #​1002
• @​mhoffrog made their first contribution in #​924
• @​brunoborges made their first contribution in #​1028
• @​Trass3r made their first contribution in #​562
• @​stephanabel made their first contribution in #​996

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in #​969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in #​989
• chore: upgrade dependencies (@​actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @​Copilot in #​999
• Add Oracle JDK 17 licensing limitation note by @​mahabaleshwars in #​1001
• Update readme for ubuntu sudo java_home behavior by @​mahabaleshwars in #​1013
• temurin: add support for Alpine Linux by @​gdams in #​674
• fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @​gdams in #​1015
• Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @​dependabot[bot] in #​952
• Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot[bot] in #​881
• Bump picomatch, @​types/jest, jest, jest-circus and ts-jest by @​dependabot[bot] in #​1016
• Bump @​types/node from 24.1.0 to 25.9.3 by @​dependabot[bot] in #​950
• Implement pagination with link headers for Adoptium based apis by @​johnoliver in #​1014
• Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @​johnoliver in #​522
• Bump @​vercel/ncc from 0.38.1 to 0.44.0 by @​dependabot[bot] in #​1018

New Contributors

• @​alaahong made their first contribution in #​969
• @​Copilot made their first contribution in #​999
• @​johnoliver made their first contribution in #​1014

Full Changelog: actions/setup-java@v5...v5.3.0

gradle/actions (gradle/actions)

v6.2.0

Compare Source

Highlights

This release brings significant behaviour improvements to Enhanced caching, improvements to the generated Job Summary, and a number of correctness and security fixes.

1. Improved cache-cleanup mechanism. Cleanup of stale files from the Gradle User Home is now faster, and no longer depends on Gradle or a JVM. It works by inspecting the local file state directly, removing the Gradle invocation from the post-build step.
2. More granular, more stable caching. The local build cache is stored as a separate cache entry, so it can be restored and invalidated independently of the main Gradle User Home entry. Transient Gradle housekeeping files are excluded from the cache, reducing its size and improving stability.
3. Hide obsolete Job summaries in PR commments: When a new Job summary comment is added to a PR, previous outdated Job summaries are now hidden.
4. Improved caching report in the job summary. The cache report now uses a single, consistent layout across all cache states and providers. Provider information is integrated directly into the report, and per-entry details are available in an expandable section. (#​985)
5. Correctness and security fixes. A unique cache key is now used per run attempt, so re-runs no longer collide; the job summary shows the cache key string rather than an internal id; and bundled dependencies have been updated, including a ReDoS fix and a fast-xml CVE fix.

What's Changed

• Remove unnecessary dependency overrides by @​bigdaz in #​981
• Scope CI-integ-test concurrency groups per-branch by @​bigdaz in #​983
• Improve typings by @​Vampire in #​938
• Hide obsolete Job summaries by @​SimonMarquis in #​902
• CI: add requireable aggregate/no-op checks for branch protection by @​bigdaz in #​984
• Redesign the caching Job Summary by @​bigdaz in #​985

New Contributors

• @​Vampire made their first contribution in #​938

Full Changelog: gradle/actions@v6.1.1...v6.2.0

v6.1.1

Compare Source

This release updates various dependency versions, resolving several reported security vulnerabilities.
No functional changes are included

What's Changed

• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /sources/test/init-scripts by @​bot-githubaction in #​961
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/gradle-plugin by @​bot-githubaction in #​962
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/groovy-dsl by @​bot-githubaction in #​963
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/java-toolchain by @​bot-githubaction in #​964
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/kotlin-dsl by @​bot-githubaction in #​965
• Update known wrapper checksums by @​github-actions[bot] in #​937
• Bump the github-actions group across 2 directories with 8 updates by @​dependabot[bot] in #​976
• Bump the npm-dependencies group across 1 directory with 14 updates by @​dependabot[bot] in #​970
• Bump references to Develocity Gradle plugin from 4.4.0 to 4.4.2 by @​bot-githubaction in #​973
• Bump the npm-dependencies group in /sources with 5 updates by @​dependabot[bot] in #​977
• Update @​actions/cache and @​actions/artifact, stop ignoring them in Dependabot by @​bigdaz in #​978
• Resolve npm security vulnerabilities via dependency overrides by @​bigdaz in #​980

Full Changelog: gradle/actions@v6.1.0...v6.1.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

---

Note

Low Risk
Workflow-only dependency pin updates with unchanged build/publish steps; validate via a normal CI run after merge.

Overview
Bumps pinned third-party GitHub Actions in CI and Renovate workflows only; no changes to Java version, Gradle commands, or workflow triggers.

In ci.yml, both build and publish jobs now use actions/setup-java v5.5.0 (was v5.2.0) and gradle/actions/setup-gradle v6.2.0 (was v6.1.0), with updated commit SHAs in the uses lines.

In renovatebot.yml, the ConsenSys/github-actions/renovatebot composite action is repinned to digest 31dbb91 (from 13686f2).

^{Reviewed by Cursor Bugbot for commit 2a5b257. Bugbot is set up for automated code reviews on this repo. Configure here.}