ci(deps): bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: gradle/actions and advanced-security/spdx-dependency-submission-action.

Updates gradle/actions from 4 to 6

Release notes

Sourced from gradle/actions's releases.

v6.0.0

[!IMPORTANT] The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post. TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

• Caching functionality of 'gradle-actions' has been extracted into a separate gradle-actions-caching library, and is no longer open-source. See this blog post for more context.
• Existing, rudimentary, configuration-cache support has been removed, pending a fully functional implementation in gradle-actions-caching.
• Dependencies updated to address security vulnerabilities

[!IMPORTANT]

Licensing notice

The caching functionality in `gradle-actions` has been extracted into `gradle-actions-caching`, a proprietary commercial component that is not covered by the MIT License. The bundled `gradle-actions-caching` component is licensed and governed by a separate license, available at https://gradle.com/legal/terms-of-use/.

The `gradle-actions-caching` component is used only when caching is enabled and is not loaded or used when caching is disabled.

Use of the `gradle-actions-caching` component is subject to a separate license, available at https://gradle.com/legal/terms-of-use/. If you do not agree to these license terms, do not use the `gradle-actions-caching` component.

What's Changed

• Bump the npm-dependencies group in /sources with 2 updates by @​dependabot[bot] in gradle/actions#866
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#868
• Dependency updates by @​bigdaz in gradle/actions#876
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#878
• Bump @​types/node from 25.3.3 to 25.3.5 in /sources in the npm-dependencies group across 1 directory by @​dependabot[bot] in gradle/actions#877
• Bump the github-actions group across 3 directories with 3 updates by @​dependabot[bot] in gradle/actions#867
• Update known wrapper checksums by @​github-actions[bot] in gradle/actions#881
• Bump the npm-dependencies group in /sources with 6 updates by @​dependabot[bot] in gradle/actions#879
• Bump the github-actions group across 3 directories with 5 updates by @​dependabot[bot] in gradle/actions#880
• Remove configuration-cache support by @​bigdaz in gradle/actions#884
• Extract caching logic into a separate gradle-actions-caching component by @​bigdaz in gradle/actions#885
• Update gradle-actions-caching library to v0.3.0 by @​bot-githubaction in gradle/actions#899
• Avoid windows shutdown bug by @​bigdaz in gradle/actions#900
• Dependency updates by @​bigdaz in gradle/actions#905
• Fix critical and high npm vulnerabilities by @​bigdaz in gradle/actions#904
• Fix rendering of job-disabled message by @​bigdaz in gradle/actions#909

Full Changelog: gradle/actions@v5.0.2...v6.0.0

v5.0.2

Summary

This release contains no functional changes. It updates dependencies and known Gradle wrapper checksums.

What's Changed

• Update dependencies by @​bigdaz in gradle/actions#851

... (truncated)

Commits

• 9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
• 760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
• 73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
• a9d1438 Add dependabot ignore rules for TypeScript 7.x and @​types/node 25.x/26.x
• 68f3700 [bot] Update dist directory
• 5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
• b5bc804 [bot] Update dist directory
• dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and secu...
• ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
• 4318659 [bot] Update dist directory
• Additional commits viewable in compare view

Updates advanced-security/spdx-dependency-submission-action from 0.2.0 to 0.3.2

Release notes

Sourced from advanced-security/spdx-dependency-submission-action's releases.

v0.3.2

What's Changed

• fix: report check-dist as a 3-way success/neutral/failure status by @​felickz in advanced-security/spdx-dependency-submission-action#159
• Add .npmrc with min-release-age=7 supply-chain safeguard by @​felickz in advanced-security/spdx-dependency-submission-action#168
• fix: fail the check-dist-build job too on a real dist/ mismatch by @​felickz in advanced-security/spdx-dependency-submission-action#166
• Update Undici to patched version 6.28.0 by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#169
• Address #168 review feedback: align Dependabot cooldown, document min-release-age bypass by @​felickz in advanced-security/spdx-dependency-submission-action#171
• fix: drop the custom Checks API check-run, use plain job pass/fail instead by @​felickz in advanced-security/spdx-dependency-submission-action#172
• chore: bump version (patch) by @​github-actions[bot] in advanced-security/spdx-dependency-submission-action#175

Full Changelog: advanced-security/spdx-dependency-submission-action@v0.3.1...v0.3.2

v0.3.1

What's Changed

• Handle percent-encoded epochs in SPDX purls by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#153
• Retry snapshot submission with exponential backoff on transient API errors by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#154
• fix: read the standard SPDX versionInfo field instead of packageVersion by @​felickz in advanced-security/spdx-dependency-submission-action#156
• Support dependency snapshot submission to target repositories by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#155
• fix: scope check-dist to release-related changes only by @​felickz in advanced-security/spdx-dependency-submission-action#157
• chore: bump version (patch) by @​github-actions[bot] in advanced-security/spdx-dependency-submission-action#158

Full Changelog: advanced-security/spdx-dependency-submission-action@v0.3.0...v0.3.1

v0.3.0

What's Changed

• README:Update SBOM upload action version to 0.2.0 by @​felickz in advanced-security/spdx-dependency-submission-action#103
• chore: Bump eslint from 10.0.0 to 10.0.1 in the development-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#104
• chore: Bump the development-dependencies group with 2 updates by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#108
• deps: Bump actions/upload-artifact from 6 to 7 in the production-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#107
• build(deps-dev): Bump minimatch from 3.1.2 to 3.1.5 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#109
• chore: Bump eslint from 10.0.2 to 10.0.3 in the development-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#112
• chore: Bump flatted from 3.3.3 to 3.4.2 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#117
• chore: Bump picomatch from 2.3.1 to 2.3.2 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#119
• deps: Bump actions/setup-node from 6.2.0 to 6.3.0 in the production-dependencies group by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#111
• build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#120
• chore(security): add 3-day Dependabot cooldown and grouped updates by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#126
• deps: Bump actions/setup-node from 6.3.0 to 6.4.0 in the actions group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#129
• Bump undici to 6.24.0 to fix GHSA-vrm6-8vpv-qv8q (CVE-2026-1526) by @​adrienpessu with @​Copilot in advanced-security/spdx-dependency-submission-action#133
• deps: Bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#138
• Fix SPDX dependency classification by @​nullchimp in advanced-security/spdx-dependency-submission-action#137
• build(deps-dev): Bump brace-expansion from 1.1.13 to 1.1.18 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#136
• chore: Bump the development-dependencies group across 1 directory with 4 updates by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#131
• deps: Bump the production-dependencies group across 1 directory with 2 updates & bumps CI to node 24 by @​dependabot[bot] in advanced-security/spdx-dependency-submission-action#125
• feat: add .release.yml versioning automation and release workflow by @​felickz in advanced-security/spdx-dependency-submission-action#143
• Allow reusable release workflow PR updates by @​felickz with @​Copilot in advanced-security/spdx-dependency-submission-action#144
• fix: pin patch-release-me to 0.6.5 (0.6.6 image missing from ghcr.io) by @​felickz in advanced-security/spdx-dependency-submission-action#145
• fix: skip lifecycle scripts when syncing package-lock.json by @​felickz in advanced-security/spdx-dependency-submission-action#146
• fix: invoke patch-release-me via docker run to avoid mode arg quoting bug by @​felickz in advanced-security/spdx-dependency-submission-action#148

... (truncated)

Commits

• 8b97fad chore: bump version (patch) (#175)
• 411bc66 fix: drop the custom Checks API check-run, use plain job pass/fail instead (#...
• 4d50327 Address PR #168 review feedback (#171)
• b61ae62 Update Undici to patched version 6.28.0 (#169)
• 1feba8b fix: fail the check-dist-build job too on a real dist/ mismatch (#166)
• c239063 Add .npmrc with min-release-age=7 to block newly published packages (#168)
• 2b22041 fix: report check-dist as a 3-way success/neutral/failure status (#159)
• 08de881 chore: bump version (patch) (#158)
• ecad333 fix: scope check-dist to release-related changes only (#157)
• 5460a4e Support dependency snapshot submission to target repositories (#155)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

⚠️ Build results unavailable — artifact download from one or more platform workflows failed
(likely artifact retention expiry or transient API error). The combined report cannot be generated for this run.

See the Build Results workflow run for details.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.