[deps]: Update gh minor

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	v6.0.2 → v6.0.3
actions/setup-java	action	minor	v5.2.0 → v5.3.0	v5.4.0
codecov/codecov-action	action	patch	v6.0.0 → v6.0.2
crowdin/github-action	action	patch	v2.16.2 → v2.16.3
gradle/actions	action	minor	v6.1.0 → v6.2.0
ruby/setup-ruby	action	minor	v1.307.0 → v1.314.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-java (actions/setup-java)

v5.3.0

Compare Source

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in #​969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in #​989
• chore: upgrade dependencies (@​actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @​Copilot in #​999
• Add Oracle JDK 17 licensing limitation note by @​mahabaleshwars in #​1001
• Update readme for ubuntu sudo java_home behavior by @​mahabaleshwars in #​1013
• temurin: add support for Alpine Linux by @​gdams in #​674
• fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @​gdams in #​1015
• Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @​dependabot[bot] in #​952
• Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot[bot] in #​881
• Bump picomatch, @​types/jest, jest, jest-circus and ts-jest by @​dependabot[bot] in #​1016
• Bump @​types/node from 24.1.0 to 25.9.3 by @​dependabot[bot] in #​950
• Implement pagination with link headers for Adoptium based apis by @​johnoliver in #​1014
• Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @​johnoliver in #​522
• Bump @​vercel/ncc from 0.38.1 to 0.44.0 by @​dependabot[bot] in #​1018

New Contributors

• @​alaahong made their first contribution in #​969
• @​Copilot made their first contribution in #​999
• @​johnoliver made their first contribution in #​1014

Full Changelog: actions/setup-java@v5...v5.3.0

codecov/codecov-action (codecov/codecov-action)

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

Compare Source

What's Changed

• fix: prevent template injection in run: steps (VULN-1652) by @​thomasrockhu-codecov in #​1947
• chore(release): 6.0.1 by @​thomasrockhu-codecov in #​1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

crowdin/github-action (crowdin/github-action)

v2.16.3

Compare Source

What's Changed

• CLI 4.14.3 by @​andrii-bodnar

Full Changelog: crowdin/github-action@v2.16.2...v2.16.3

gradle/actions (gradle/actions)

v6.2.0

Compare Source

Highlights

This release brings significant behaviour improvements to Enhanced caching, improvements to the generated Job Summary, and a number of correctness and security fixes.

1. Improved cache-cleanup mechanism. Cleanup of stale files from the Gradle User Home is now faster, and no longer depends on Gradle or a JVM. It works by inspecting the local file state directly, removing the Gradle invocation from the post-build step.
2. More granular, more stable caching. The local build cache is stored as a separate cache entry, so it can be restored and invalidated independently of the main Gradle User Home entry. Transient Gradle housekeeping files are excluded from the cache, reducing its size and improving stability.
3. Hide obsolete Job summaries in PR commments: When a new Job summary comment is added to a PR, previous outdated Job summaries are now hidden.
4. Improved caching report in the job summary. The cache report now uses a single, consistent layout across all cache states and providers. Provider information is integrated directly into the report, and per-entry details are available in an expandable section. (#​985)
5. Correctness and security fixes. A unique cache key is now used per run attempt, so re-runs no longer collide; the job summary shows the cache key string rather than an internal id; and bundled dependencies have been updated, including a ReDoS fix and a fast-xml CVE fix.

What's Changed

• Remove unnecessary dependency overrides by @​bigdaz in #​981
• Scope CI-integ-test concurrency groups per-branch by @​bigdaz in #​983
• Improve typings by @​Vampire in #​938
• Hide obsolete Job summaries by @​SimonMarquis in #​902
• CI: add requireable aggregate/no-op checks for branch protection by @​bigdaz in #​984
• Redesign the caching Job Summary by @​bigdaz in #​985

New Contributors

• @​Vampire made their first contribution in #​938

Full Changelog: gradle/actions@v6.1.1...v6.2.0

v6.1.1

Compare Source

This release updates various dependency versions, resolving several reported security vulnerabilities.
No functional changes are included

What's Changed

• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /sources/test/init-scripts by @​bot-githubaction in #​961
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/gradle-plugin by @​bot-githubaction in #​962
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/groovy-dsl by @​bot-githubaction in #​963
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/java-toolchain by @​bot-githubaction in #​964
• Bump Gradle Wrapper from 9.4.1 to 9.5.1 in /.github/workflow-samples/kotlin-dsl by @​bot-githubaction in #​965
• Update known wrapper checksums by @​github-actions[bot] in #​937
• Bump the github-actions group across 2 directories with 8 updates by @​dependabot[bot] in #​976
• Bump the npm-dependencies group across 1 directory with 14 updates by @​dependabot[bot] in #​970
• Bump references to Develocity Gradle plugin from 4.4.0 to 4.4.2 by @​bot-githubaction in #​973
• Bump the npm-dependencies group in /sources with 5 updates by @​dependabot[bot] in #​977
• Update @​actions/cache and @​actions/artifact, stop ignoring them in Dependabot by @​bigdaz in #​978
• Resolve npm security vulnerabilities via dependency overrides by @​bigdaz in #​980

Full Changelog: gradle/actions@v6.1.0...v6.1.1

ruby/setup-ruby (ruby/setup-ruby)

v1.314.0

Compare Source

What's Changed

• Add support for ubuntu-26.04 and ubuntu-26.04-arm by @​eregon in #​923

Full Changelog: ruby/setup-ruby@v1.313.0...v1.314.0

v1.313.0

Compare Source

What's Changed

• Add jruby-10.0.6.0 by @​ruby-builder-bot in #​921

Full Changelog: ruby/setup-ruby@v1.312.0...v1.313.0

v1.312.0

Compare Source

What's Changed

• Use BUNDLE_LOCKFILE when detecting the lockfile by @​Thomascountz in #​919

New Contributors

• @​Thomascountz made their first contribution in #​919

Full Changelog: ruby/setup-ruby@v1.311.0...v1.312.0

v1.311.0

Compare Source

What's Changed

• Add jruby-9.4.15.0 by @​ruby-builder-bot in #​920

Full Changelog: ruby/setup-ruby@v1.310.0...v1.311.0

v1.310.0

Compare Source

What's Changed

• Add ruby-4.0.5 by @​ruby-builder-bot in #​918

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​917

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​912

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 2nd week starting on the 2 week of the year before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-38039
• Link: https://bitwarden.atlassian.net/browse/PM-38039

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.97%. Comparing base (2022507) to head (ef33c31).
⚠️ Report is 52 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6973      +/-   ##
==========================================
- Coverage   86.33%   85.97%   -0.37%     
==========================================
  Files         918     1018     +100     
  Lines       65587    66864    +1277     
  Branches     9305     9408     +103     
==========================================
+ Hits        56626    57485     +859     
- Misses       5755     6138     +383     
- Partials     3206     3241      +35     

Flag	Coverage Δ
app-data	17.32% <ø> (+0.09%)	⬆️
app-ui-auth-tools	19.15% <ø> (-0.07%)	⬇️
app-ui-platform	17.10% <ø> (+0.35%)	⬆️
app-ui-vault	28.28% <ø> (-0.15%)	⬇️
authenticator	6.20% <ø> (-0.04%)	⬇️
lib-core-network-bridge	4.08% <ø> (-0.02%)	⬇️
lib-data-ui	1.14% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vvolkgang]

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.