build(deps): dependency updates 20260811

[russellwheatley]

Combines open Dependabot build(deps) PRs onto one branch.

Included

• actions/setup-java 5.6.0 → 5.7.0
• guidepup/setup-action 0.20.0 → 0.21.0
• reactivecircus/android-emulator-runner 2.37.0 → 2.38.0
• ruby/setup-ruby 1.313.0 → 1.321.0
• @expo/plist 0.5.2 → 0.8.1 (auth Expo config plugin)

Intentionally skipped

• build(deps): bump react and @types/react #9160 (react / @types/react) — cannot upgrade React in this tree right now

Note on #9187

#9171 only SHA-pinned android-emulator-runner within v2.37.0. This PR takes Dependabot's follow-up bump to v2.38.0 (build-tools 37). The red checks on #9187 were unrelated to that pin: conventional-commit title vs commit-subject mismatch, plus an iOS SPM flake on a GitHub TLS cert during checkout.

Obsoletes

• Obsoletes: build(deps): bump @expo/plist from 0.5.2 to 0.8.1 #9189
• Obsoletes: build(deps): bump ruby/setup-ruby from 1.313.0 to 1.321.0 #9188
• Obsoletes: build(deps): bump reactivecircus/android-emulator-runner from 2.37.0 to 2.38.0 #9187
• Obsoletes: build(deps): bump guidepup/setup-action from 0.20.0 to 0.21.0 #9186
• Obsoletes: build(deps): bump actions/setup-java from 5.6.0 to 5.7.0 #9172

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.17%. Comparing base (ad06531) to head (9625120).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #9190      +/-   ##
============================================
+ Coverage     68.13%   68.17%   +0.05%     
+ Complexity     1915     1914       -1     
============================================
  Files           511      511              
  Lines         37888    37904      +16     
  Branches       5197     5200       +3     
============================================
+ Hits          25810    25838      +28     
+ Misses        10250    10236      -14     
- Partials       1828     1830       +2     

Flag	Coverage Δ
android-native	63.75% <ø> (-<0.01%)	⬇️
e2e-ts-android	53.87% <ø> (-0.06%)	⬇️
e2e-ts-ios	56.49% <ø> (ø)
e2e-ts-macos	49.66% <ø> (ø)
ios-native	68.74% <ø> (+0.17%)	⬆️
ios-ruby	100.00% <ø> (ø)
jest	45.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mikehardy]

the expo plist one is specifically amusing to me because I wrote somewhere (I thought this okf-bundle for RNFB!) that if dependencies were updated they should always be the most up to date

I don't know why but apparently a new / modern "classic" is that agents never grab the most up to date version when they add or move dependencies. It is always some stale version

Also, dependabot itself is limited on how many things it proposes at once and was down on the repo for a while, now that it's back up they really are coming in seemingly unending waves but hopefully they all go through shortly and the queue is empty