Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 3 updates#4919

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/minor-and-patch-c2a0cbac11
Open

build(deps): bump the minor-and-patch group across 1 directory with 3 updates#4919
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/minor-and-patch-c2a0cbac11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 3 updates in the / directory: actions/setup-java, reactivecircus/android-emulator-runner and gradle/actions/setup-gradle.

Updates actions/setup-java from 5.2.0 to 5.4.0

Release notes

Sourced from actions/setup-java's releases.

v5.4.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

What's Changed

... (truncated)

Commits
  • 1bcf9fb dist: Address Copilot review suggestions from PR #1042 (GraalVM Community) (#...
  • fa2c650 docs: note jdkfile approach for Early Access / unreleased JDK builds (#1058)
  • 1d56e31 dist: Add GraalVM Community distribution support (#1042)
  • 1d25252 chore: Harden workflows: least-privilege permissions + zizmor integration (#1...
  • 668c1ea docs: add post-install keytool import for the JDK cacerts trust store (#1051)
  • a9a46fb docs: document self-signed certificate / internal CA handling for GitHub Ente...
  • 5431e71 docs: add JavaFX Maven project configuration instructions (#1044)
  • 4baa9b4 docs: replace non-existent HelloWorldApp references with java --version (#1043)
  • eab4b08 Bump @​types/node from 25.9.3 to 26.0.0 (#1031)
  • bf0c0e6 Bump actions/checkout from 6 to 7 (#1032)
  • Additional commits viewable in compare view

Updates reactivecircus/android-emulator-runner from 2.37.0 to 2.38.0

Release notes

Sourced from reactivecircus/android-emulator-runner's releases.

v2.38.0

What's Changed

New Contributors

Full Changelog: ReactiveCircus/android-emulator-runner@v2.37.0...v2.38.0

Changelog

Sourced from reactivecircus/android-emulator-runner's changelog.

Change Log

Unreleased

v2.38.0

  • Update SDK build tools to 37.0.0. - #475

v2.37.0

  • Update SDK build tools to 36.0.0, update SDK command-line tools to 20.0. - #467
  • Run action on Node 24. - #466
  • Update Node and npm packages. - #466

v2.36.0

  • Remove --abi option to better support 16-KB-based system images (#456).

v2.35.0

  • Optimize config.ini updates and efficiency improvements report (#436).
  • Fix pre-emulator-launch-script (#439).
  • Allow google_apis_ps16k as a valid target (#440).

v2.34.0

  • Allow arbitrary value for api-level such as Baklava and 35-ext15. - 428
  • Add option to specify system-image-api-level to use a system image with a different API level than the platform. - 428
  • Support automotive and desktop targets: android-automotive, android-automotive-playstore, android-desktop. - 428

v2.33.0

  • Fix missing AVD directory in ubuntu-24.04 runner. - 415
  • Update SDK build tools to 35.0.0, update SDK command-line tools to 16.0. - #356
  • Stop changing owner of the SDK directory. - 406 #409
  • Upgrade to latest npm dependencies. - #401

v2.32.0

  • Add port parameter for customizing the emulator port to use. - #383

v2.31.0

  • Support setting VanillaIceCream as api-level. - #378
  • Install platforms for the specified api-level. - #384

v2.30.1

... (truncated)

Commits
  • a421e43 Merge branch 'main' into release/v2
  • cad3216 Prepare for release 2.38.0.
  • ed6254c Revert "Add minorApiLevel for compile SDK. Test with API 37.0."
  • 8acdc11 Add minorApiLevel for compile SDK. Test with API 37.0.
  • a917366 Build tools 37.0.0 (#475)
  • ae2c4d7 Add FreeOrion to the list (#470)
  • See full diff in compare view

Updates gradle/actions/setup-gradle from 6.1.0 to 6.2.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.2.0

Highlights

This release brings significant behaviour improvements to Enhanced caching, improvements to the generated Job Summary, and a number of correctness and security fixes.

  1. Improved cache-cleanup mechanism. Cleanup of stale files from the Gradle User Home is now faster, and no longer depends on Gradle or a JVM. It works by inspecting the local file state directly, removing the Gradle invocation from the post-build step.
  2. More granular, more stable caching. The local build cache is stored as a separate cache entry, so it can be restored and invalidated independently of the main Gradle User Home entry. Transient Gradle housekeeping files are excluded from the cache, reducing its size and improving stability.
  3. Hide obsolete Job summaries in PR commments: When a new Job summary comment is added to a PR, previous outdated Job summaries are now hidden.
  4. Improved caching report in the job summary. The cache report now uses a single, consistent layout across all cache states and providers. Provider information is integrated directly into the report, and per-entry details are available in an expandable section. (#985)
  5. Correctness and security fixes. A unique cache key is now used per run attempt, so re-runs no longer collide; the job summary shows the cache key string rather than an internal id; and bundled dependencies have been updated, including a ReDoS fix and a fast-xml CVE fix.

What's Changed

New Contributors

Full Changelog: gradle/actions@v6.1.1...v6.2.0

v6.1.1

This release updates various dependency versions, resolving several reported security vulnerabilities. No functional changes are included

What's Changed

Full Changelog: gradle/actions@v6.1.0...v6.1.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 3…
5307e1c 
… updates

Bumps the minor-and-patch group with 3 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java), [reactivecircus/android-emulator-runner](https://github.com/reactivecircus/android-emulator-runner) and [gradle/actions/setup-gradle](https://github.com/gradle/actions).


Updates `actions/setup-java` from 5.2.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@be666c2...1bcf9fb)

Updates `reactivecircus/android-emulator-runner` from 2.37.0 to 2.38.0
- [Release notes](https://github.com/reactivecircus/android-emulator-runner/releases)
- [Changelog](https://github.com/ReactiveCircus/android-emulator-runner/blob/main/CHANGELOG.md)
- [Commits](ReactiveCircus/android-emulator-runner@e89f39f...a421e43)

Updates `gradle/actions/setup-gradle` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@50e97c2...3f131e8)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: reactivecircus/android-emulator-runner
  dependency-version: 2.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added Dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 5, 2026
dj4oC
dj4oC approved these changes Jul 8, 2026
View reviewed changes

@dj4oC dj4oC left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot grouped bump: minor-and-patch GitHub Actions versions (actions/setup-java 5.2.0→5.4.0, reactivecircus/android-emulator-runner, gradle/actions/setup-gradle).

Findings

Nothing blocking. All are minor/patch bumps of CI workflow actions (no application code or dependency-manifest risk), CI is green (Validate semantic commits, Calculate commits, Validate strings, CodeQL), and there's no open question on the thread.

Verdict

Approved — eligible for the Dependabot fast-lane auto-merge (green CI, no open questions, no known CVE introduced). Merging now.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

Generated by Claude Code

@dj4oC Claude

dj4oC commented Jul 8, 2026

Copy link
Copy Markdown
Contributor
  • Security: no findings
  • Stability: no findings
  • Performance: no findings
  • Test coverage: n/a (CI workflow version bump only)
  • TODOs found: none
  • Dependency touched: yes — confirmed covered by .github/dependabot.yml (github-actions ecosystem)
  • CI status: all green
  • Stale review: no

Dependabot fast-lane: auto-merging (green CI, no open questions, no CVE).

🤖 Automated review by Claude Code (security · stability · performance · coverage)

Generated by Claude Code

@dj4oC Claude

dj4oC commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Follow-up on the fast-lane auto-merge verdict above: this PR still meets all criteria (CI green, no open questions, no CVE), but the branch is behind master and this bot's GitHub App token does not have branch-update or merge permissions (update_pull_request_branch, merge_pull_request, and enable_pr_auto_merge all returned 403 "Resource not accessible by integration").

@owncloud maintainers — could someone comment ·@·d·ependabot r·ebase and merge once green? Flagging so this doesn't sit as a false "merging now" claim.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@dj4oC dj4oC dj4oC approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

Dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dj4oC