build(deps): bump the actions group across 1 directory with 4 updates

[dependabot]

Bumps the actions group with 4 updates in the / directory: gradle/actions, android-actions/setup-android, actions/download-artifact and actions/upload-artifact.

Updates gradle/actions from 5 to 6

Release notes

Sourced from gradle/actions's releases.

v6.0.0

[!IMPORTANT] The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post. TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

• Caching functionality of 'gradle-actions' has been extracted into a separate gradle-actions-caching library, and is no longer open-source. See this blog post for more context.
• Existing, rudimentary, configuration-cache support has been removed, pending a fully functional implementation in gradle-actions-caching.
• Dependencies updated to address security vulnerabilities

[!IMPORTANT]

Licensing notice

The caching functionality in `gradle-actions` has been extracted into `gradle-actions-caching`, a proprietary commercial component that is not covered by the MIT License. The bundled `gradle-actions-caching` component is licensed and governed by a separate license, available at https://gradle.com/legal/terms-of-use/.

The `gradle-actions-caching` component is used only when caching is enabled and is not loaded or used when caching is disabled.

Use of the `gradle-actions-caching` component is subject to a separate license, available at https://gradle.com/legal/terms-of-use/. If you do not agree to these license terms, do not use the `gradle-actions-caching` component.

What's Changed

• Bump the npm-dependencies group in /sources with 2 updates by @​dependabot[bot] in gradle/actions#866
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#868
• Dependency updates by @​bigdaz in gradle/actions#876
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#878
• Bump @​types/node from 25.3.3 to 25.3.5 in /sources in the npm-dependencies group across 1 directory by @​dependabot[bot] in gradle/actions#877
• Bump the github-actions group across 3 directories with 3 updates by @​dependabot[bot] in gradle/actions#867
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#881
• Bump the npm-dependencies group in /sources with 6 updates by @​dependabot[bot] in gradle/actions#879
• Bump the github-actions group across 3 directories with 5 updates by @​dependabot[bot] in gradle/actions#880
• Remove configuration-cache support by @​bigdaz in gradle/actions#884
• Extract caching logic into a separate gradle-actions-caching component by @​bigdaz in gradle/actions#885
• Update gradle-actions-caching library to v0.3.0 by @​bot-githubaction in gradle/actions#899
• Avoid windows shutdown bug by @​bigdaz in gradle/actions#900
• Dependency updates by @​bigdaz in gradle/actions#905
• Fix critical and high npm vulnerabilities by @​bigdaz in gradle/actions#904
• Fix rendering of job-disabled message by @​bigdaz in gradle/actions#909

Full Changelog: gradle/actions@v5.0.2...v6.0.0

v5.0.2

Summary

This release contains no functional changes. It updates dependencies and known Gradle wrapper checksums.

What's Changed

• Update dependencies by @​bigdaz in gradle/actions#851

... (truncated)

Commits

• 39e147c [bot] Update dist directory
• 14ac3d6 Bump com.fasterxml.jackson.dataformat:jackson-dataformat-smile from 2.21.1 to...
• 81fec7a Mention explicit license acceptance in notice (#912)
• 4ac5b01 [bot] Update dist directory
• f64284c Mute license warning when terms are accepted (#911)
• c2457a7 Update tagging instructions for release
• 8205114 Update Gradle version compatibility information
• 6710000 Add typing information for use by typesafegithub (#910)
• 3d0e2a8 Pin version for github actions
• f663ed9 Ignore internal action files for type validation
• Additional commits viewable in compare view

Updates android-actions/setup-android from 3 to 4

Release notes

Sourced from android-actions/setup-android's releases.

v4.0.0

Hello,

The long awaited update of setup-android.

• Migrate action to Node24 (by @​TWiStErRob)
• Add and default to cmdline-tools version 20.0 ( 14742923 )
• Update CI runners (by @​TWiStErRob)
• Update README.md (by @​vil02)
• Update npm dependencies to solve CVE's

Incrementing major version to safeguard incase node upgrade or default cmdline-tools upgrade breaks something downstream.

v3.2.2

Add support for cmdline-tools versions 12, 13, and 16 by @​warting in android-actions/setup-android#493 .

Updated npm dependencies

v3.2.1

Updated dependencies

v3.2.0

Implement 'packages' input argument, which allows choosing which packages to install from Android SDK

v3.1.0

Allow installing different Android SDK versions. Allow silent license agreement.

Commits

• 651bceb Migrate from ncc to esbuild
• 144235e Update actions steps. checkout to v5, node to v6, java to v5, codeql to v4
• 200c644 Add cmdline-tools version 20.0 ( 14742923 )
• 715acc5 Remove @​actions/cache dependency
• 125835f Update (not all) deps, migrate eslint to new format. compile to es2024
• c4c8fe5 Encourage users to use latest version of actions/setup-java
• 6a40db5 Migrate from Node 20 to Node 24
• 641d7f5 Maintain GHA runners
• See full diff in compare view

Updates actions/download-artifact from 7 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't attempt to un-zip non-zipped downloads by @​danwkennedy in actions/download-artifact#460
• Add a setting to specify what to do on hash mismatch and default it to error by @​danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits

• 3e5f45b Add regression tests for CJK characters (#471)
• e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
• 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
• f258da9 Add change docs
• ccc058e Fix linting issues
• bd7976b Add a setting to specify what to do on hash mismatch and default it to error
• ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
• 15999bf Add note about package bumps
• 974686e Bump the version to v8 and add release notes
• fbe48b1 Update test names to make it clearer what they do
• Additional commits viewable in compare view

Updates actions/upload-artifact from 6 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in actions/upload-artifact#754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in actions/upload-artifact#762
• Support direct file uploads by @​danwkennedy in actions/upload-artifact#764

New Contributors

• @​Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

• bbbca2d Support direct file uploads (#764)
• 589182c Upgrade the module to ESM and bump dependencies (#762)
• 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
• 02a8460 Add proxy integration test
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions