build(deps): update actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1
actions/setup-java	action	minor	v5.6.0 → v5.7.0
github/codeql-action	action	patch	v4.37.3 → v4.37.5
gradle/actions	action	minor	v6.2.0 → v6.3.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

actions/setup-java (actions/setup-java)

v5.7.0

Compare Source

github/codeql-action (github/codeql-action)

v4.37.5

Compare Source

v4.37.4

Compare Source

gradle/actions (gradle/actions)

v6.3.0

Compare Source

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

• Cache entries failed to store at all on Windows.. Every entry failed
  with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so
  every downstream job ran against an empty Gradle User Home. The cause was a nested,
  unpatched copy of @actions/glob combined with a silently swallowed require() in
  the bundle, which left Windows path separators unnormalized.

• Cache cleanup deleted instrumented jars that were in use. A bug in key
  hashing for paths shorter than 64 characters made cleanup judge freshly created
  caches/jars-9 entries as unused and remove them, so the instrumented-jars entry
  was never saved and every job re-instrumented its classpaths.

  Also included: cache entry names are now consistent between the save and restore
  reports — restore previously fell back to showing the raw glob pattern (e.g.
  /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT]
Existing cache entries are invalidated by this release. The cache protocol
version was bumped to v2, so the first run after upgrading will be a cache miss
and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports
(Entry not saved: save failed) in the Job Summary when a cache save fails, rather
than reporting success (#​1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so
dependency graph generation works on builds that enable it (#​1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

• Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
• 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

• Render configuration-cache status in the caching Job Summary by @​bigdaz in #​989
• Update gradle-actions-caching library to v0.8.0 by @​bot-githubaction in #​993
• Support experimental project-entry caching (configuration-cache + build-logic) by @​bigdaz in #​994
• Update gradle-actions-caching library to v0.9.0 by @​bot-githubaction in #​996
• Disable Isolated Projects via promoted property in dependency-submission by @​reinsch82 in #​1025
• Add Windows coverage for caching via a new smoke-test suite by @​bigdaz in #​1027
• Fix basic caching smoke test on Windows, and warn on save failure by @​bigdaz in #​1028
• Move non-smoke restore-gradle-home tests back to the integ-test suite by @​bigdaz in #​1032
• Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and security fixes by @​bigdaz in #​1033
• Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5.0 by @​bigdaz in #​1034
• Update gradle-actions-caching library to v1.0.0 by @​bot-githubaction in #​1029
• Bump the npm-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in #​1037
• Bump the github-actions group across 2 directories with 9 updates by @​dependabot[bot] in #​1024

New Contributors

• @​reinsch82 made their first contribution in #​1025

Full Changelog: gradle/actions@v6.2.0...v6.3.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.