chore(deps): Update build systems (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/checkout	action	major	v4 → v7
actions/setup-java	action	major	v4 → v5
actions/upload-artifact	action	major	v4 → v7
gradle (source)		major	8.12 → 9.6.1
gradle/actions	action	major	v4 → v6
stefanzweifel/git-auto-commit-action	action	major	v5 → v7
net.ltgt.errorprone	plugin	major	4.1.0 → 5.1.0
com.gradleup.shadow	plugin	major	8.3.5 → 9.6.1
com.diffplug.spotless	plugin	major	6.25.0 → 8.9.0
net.kyori.indra.git	plugin	major	3.1.3 → 4.0.0
net.kyori.indra.publishing	plugin	major	3.1.3 → 4.0.0
net.kyori.indra	plugin	major	3.1.3 → 4.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v6

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v5.1.0

Compare Source

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

v5

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

actions/setup-java (actions/setup-java)

v5.6.0

Compare Source

What's Changed

• Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1087
• feat: expose cache-primary-key output (#​597) [v5 backport] by @​brunoborges in #​1089
• dist: Cover Tencent Kona JDK 25 (#​1108) [v5 backport] by @​brunoborges in #​1110
• Backport #​1111: Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1113
• Backport #​1097/#​1098 to v5: cache Maven and Gradle wrapper distributions separately by @​brunoborges in #​1122

Full Changelog: actions/setup-java@v5...v5.6.0

v5.5.0

Compare Source

v5.4.0

Compare Source

What's Changed

• Bump @​typescript-eslint/parser from 8.48.0 to 8.61.1 by @​dependabot[bot] in #​1021
• Fix codeql workflow permissions by @​jsoref in #​993
• fix CodeQL permissions by @​gdams in #​1025
• fix: reject non-semver candidate versions in isVersionSatisfies by @​sproctor in #​1009
• Bump @​actions/cache to 5.1.0, handle cache write denied by @​jasongin in #​1026
• Add Maven Wrapper cache feature by @​mahabaleshwars in #​1027
• Spelling by @​jsoref in #​713
• add link to advanced configuration for JetBrains by @​robstoll in #​850
• docs(action): fix missing required or default fields by @​kranthipoturaju in #​1007
• feat: add microsoft openjdk 17.0.18 by @​al-kau in #​1002
• Update README.md - use "alert syntax for Markdown" for notes by @​mhoffrog in #​924
• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​1033
• Update contributor guide with emoji for clarity by @​brunoborges in #​1028
• add javac problem matcher by @​Trass3r in #​562
• Clarify README version syntax and migration guidance by @​brunoborges with @​Copilot in #​1038
• Update undici artifacts to 6.27.0 (license cache + dist) by @​brunoborges in #​1040
• docs: enhance custom jdk file installation by @​stephanabel in #​996
• Templates for new Java distributions by @​panticmilos in #​429
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1032
• Bump @​types/node from 25.9.3 to 26.0.0 by @​dependabot[bot] in #​1031
• docs: replace non-existent HelloWorldApp references with java --version by @​brunoborges with @​Copilot in #​1043
• docs: add JavaFX Maven project configuration instructions by @​brunoborges with @​Copilot in #​1044
• docs: self-signed certificate / internal CA handling for GitHub Enterprise by @​brunoborges in #​1050
• docs: document importing an internal CA into the installed JDK (cacerts) by @​brunoborges in #​1051
• chore: Harden workflows: least-privilege permissions + zizmor integration by @​brunoborges in #​1039
• dist: Add GraalVM Community distribution support by @​brunoborges with @​Copilot in #​1042
• docs: note jdkfile approach for Early Access / unreleased JDK builds by @​brunoborges in #​1058
• dist: Apply Copilot review suggestions from PR #​1042 (GraalVM Community) by @​brunoborges in #​1059

New Contributors

• @​jsoref made their first contribution in #​993
• @​sproctor made their first contribution in #​1009
• @​jasongin made their first contribution in #​1026
• @​robstoll made their first contribution in #​850
• @​kranthipoturaju made their first contribution in #​1007
• @​al-kau made their first contribution in #​1002
• @​mhoffrog made their first contribution in #​924
• @​brunoborges made their first contribution in #​1028
• @​Trass3r made their first contribution in #​562
• @​stephanabel made their first contribution in #​996

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in #​969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in #​989
• chore: upgrade dependencies (@​actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @​Copilot in #​999
• Add Oracle JDK 17 licensing limitation note by @​mahabaleshwars in #​1001
• Update readme for ubuntu sudo java_home behavior by @​mahabaleshwars in #​1013
• temurin: add support for Alpine Linux by @​gdams in #​674
• fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @​gdams in #​1015
• Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @​dependabot[bot] in #​952
• Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot[bot] in #​881
• Bump picomatch, @​types/jest, jest, jest-circus and ts-jest by @​dependabot[bot] in #​1016
• Bump @​types/node from 24.1.0 to 25.9.3 by @​dependabot[bot] in #​950
• Implement pagination with link headers for Adoptium based apis by @​johnoliver in #​1014
• Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @​johnoliver in #​522
• Bump @​vercel/ncc from 0.38.1 to 0.44.0 by @​dependabot[bot] in #​1018

New Contributors

• @​alaahong made their first contribution in #​969
• @​Copilot made their first contribution in #​999
• @​johnoliver made their first contribution in #​1014

Full Changelog: actions/setup-java@v5...v5.3.0

v5.2.0

Compare Source

What's Changed

Enhancement

• Retry on HTTP 522 Connection timed out by @​findepi in #​964

Documentation Changes

• Update gradle caching by @​priya-kinthali in #​972
• Update checkout to v6 by @​mahabaleshwars in #​973

Dependency Updates

• Upgrade @​actions/cache to v5 by @​salmanmkc in #​968
• Upgrade actions/checkout from 5 to 6 by @​dependabot in #​961

New Contributors

• @​findepi made their first contribution in #​964

Full Changelog: actions/setup-java@v5...v5.2.0

v5.1.0

Compare Source

What's Changed

New Features

• Add support for .sdkmanrc file in java-version-file parameter by @​guicamest in #​736
• Add support for Microsoft OpenJDK 25 builds by @​the-mod in #​927

Bug Fixes & Improvements

• Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File by @​aparnajyothi-y in #​767
• Enhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by @​priya-kinthali in #​946
• Update SapMachine URLs by @​RealCLanger in #​955
• Add GitHub Token Support for GraalVM and Refactor Code by @​mahabaleshwars in #​849

Documentation changes

• Update documentation to use checkout and Java v5 by @​lmvysakh in #​903
• Clarify JAVA_HOME and PATH setup in README by @​chiranjib-swain in #​841

Dependency updates

• Upgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by @​dependabot in #​873
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot in #​912

New Contributors

• @​lmvysakh made their first contribution in #​903
• @​chiranjib-swain made their first contribution in #​841
• @​the-mod made their first contribution in #​927
• @​priya-kinthali made their first contribution in #​946
• @​guicamest made their first contribution in #​736

Full Changelog: actions/setup-java@v5...v5.1.0

v5.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in #​888

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Upgrades

• Upgrade Publish Immutable Action by @​HarithaVattikuti in #​798
• Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @​dependabot[bot] in #​730
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​833
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​887
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​896

Bug Fixes

• Prevent default installation of JetBrains pre-releases by @​priyagupta108 in #​859
• Improve Error Handling for Setup-Java Action to Help Debug Intermittent Failures by @​gowridurgad in #​848

New Contributors

• @​gowridurgad made their first contribution in #​848
• @​salmanmkc made their first contribution in #​888

Full Changelog: actions/setup-java@v4...v5.0.0

v5

Compare Source

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

v6.0.0

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@​v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in #​719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in #​744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in #​745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v6

Compare Source

v5.0.0

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

• Update README.md by @​GhadimiR in #​681
• Update README.md by @​nebuk89 in #​712
• Readme: spell out the first use of GHES by @​danwkennedy in #​727
• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in #​725
• Bump @actions/artifact to v4.0.0
• Prepare v5.0.0 by @​danwkennedy in #​734

New Contributors

• @​GhadimiR made their first contribution in #​681
• @​nebuk89 made their first contribution in #​712
• @​danwkennedy made their first contribution in #​727
• @​patrikpolyak made their first contribution in #​725

Full Changelog: actions/upload-artifact@v4...v5.0.0

v5

Compare Source

gradle/gradle (gradle)

v9.6.1

Compare Source

v9.6.0

Compare Source

v9.5.1: 9.5.1

Compare Source

The Gradle team is excited to announce Gradle 9.5.1.

Here are the highlights of this release:

• Task provenance in reports and failure messages
• Type-safe accessors for precompiled Kotlin Settings plugins

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
atm1020,
mataha,
Adam,
Attila Kelemen,
Benedikt Ritter,
Björn Kautler,
Caro Silva Rode,
CHANHAN,
Dmitry Nezavitin,
Eng Zer Jun,
KugelLibelle,
Madalin Valceleanu,
Markus Gaisbauer,
Oliver Kopp,
Philip Wedemann,
ploober,
Roberto Perez Alcolea,
Rohit Anand,
Suvrat Acharya,
Ujwal Suresh Vanjare,
Victor Merkulov

Upgrade instructions

Switch your build to use Gradle 9.5.1 by updating your wrapper:

./gradlew wrapper --gradle-version=9.5.1 && ./gradlew wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.5.0: 9.5.0

Compare Source

The Gradle team is excited to announce Gradle 9.5.0.

Here are the highlights of this release:

• Task provenance in reports and failure messages
• Type-safe accessors for precompiled Kotlin Settings plugins

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
atm1020,
mataha,
Adam,
Attila Kelemen,
Benedikt Ritter,
Björn Kautler,
Caro Silva Rode,
CHANHAN,
Dmitry Nezavitin,
Eng Zer Jun,
KugelLibelle,
Madalin Valceleanu,
Markus Gaisbauer,
Oliver Kopp,
Philip Wedemann,
ploober,
Roberto Perez Alcolea,
Rohit Anand,
Suvrat Acharya,
Ujwal Suresh Vanjare,
Victor Merkulov

Upgrade instructions

Switch your build to use Gradle 9.5.0 by updating your wrapper:

./gradlew wrapper --gradle-version=9.5.0 && ./gradlew wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.4.1: 9.4.1

Compare Source

The Gradle team is excited to announce Gradle 9.4.1.

Here are the highlights of this release:

• Java 26 support
• Non-class-based JVM tests
• Enhanced console progress bar

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
akankshaa-00,
Attila Kelemen,
Björn Kautler,
dblood,
Dennis Rieks,
duvvuvenkataramana,
John Burns,
Julian,
kevinstembridge,
Niels Doucet,
Philip Wedemann,
ploober,
Richard Hernandez,
Roberto Perez Alcolea,
Sebastian Lövdahl,
stephan2405,
Stephane Landelle,
Ujwal Suresh Vanjare,
Victor Merkulov,
Vincent Potuček,
Vladimir Sitnikov.

Upgrade instructions

Switch your build to use Gradle 9.4.1 by updating your wrapper:

./gradlew wrapper --gradle-version=9.4.1 && ./gradlew wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.4.0: 9.4.0

Compare Source

The Gradle team is excited to announce Gradle 9.4.0.

Here are the highlights of this release:

• Java 26 support
• Non-class-based JVM tests
• Enhanced console progress bar

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
akankshaa-00,
Attila Kelemen,
Björn Kautler,
dblood,
Dennis Rieks,
duvvuvenkataramana,
John Burns,
Julian,
kevinstembridge,
Niels Doucet,
Philip Wedemann,
ploober,
Richard Hernandez,
Roberto Perez Alcolea,
Sebastian Lövdahl,
stephan2405,
Stephane Landelle,
Ujwal Suresh Vanjare,
Victor Merkulov,
Vincent Potuček,
Vladimir Sitnikov.

Upgrade instructions

Switch your build to use Gradle 9.4.0 by updating your wrapper:

./gradlew wrapper --gradle-version=9.4.0 && ./gradlew wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.3.1: 9.3.1

Compare Source

This is a patch release for 9.3.0. We recommend using 9.3.1 instead of 9.3.0.

The following issues were resolved:

• Cannot find testcases from Android Screenshot Test plugin since Gradle 9.3.0
• Excluding dependencies from included builds doesn't work in Gradle 9.3.0
• ExternalDependency and DependencyConstraint cannot be passed to DependencyResolveDetails#useTarget
• Gradle 9.3.0 generate JUnit test result files with wrong name
• Build cache cannot handle outputs with non-BMP characters in the filename
• Emojis in test names should not break build caching
• Non utf-8 c code is no longer buildable
• Breaking change in 9.3.0 regarding cross-project dependency manipulation
• JUnit3 tests cannot be run with Gradle 9.3.0
• Test.setScanForTestClasses(false) causes all junit4 tests to be skipped

Read the Release Notes

Upgrade instructions

Switch your build to use Gradle 9.3.1 by updating your wrapper:

./gradlew wrapper --gradle-version=9.3.1 && ./gradlew wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.3.0: 9.3.0

Compare Source

The Gradle team is excited to announce Gradle 9.3.0.

Here are the highlights of this release:

• Test reporting improvements
• Error and warning improvements
• Build authoring improvements

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Adam,
Adam,
Aharnish Solanki,
Andrzej Zabost,
Björn Kautler,
Boris Petrov,
Jendrik Johannes,
Kamil Krzywanski,
KANAKALA SAI KIRAN,
Megmeehey,
NurmukhametovAlexey,
Philip Wedemann,
Piotr Kubowicz,
Samay Kumar,
Shin Minjun,
Stefan Oehme,
Vincent Potuček,
[Yongshun Ye](https://redirect.github

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 1 of the month (* * 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Note

Upgrade Gradle wrapper to 9.6.1 and update major build plugin versions

• Updates the Gradle wrapper from 8.12 to 9.6.1 in gradle-wrapper.properties.
• Bumps Gradle plugin versions in libs.versions.toml: indra 4.0.0, spotless 8.9.0, shadow 9.6.1, and errorprone-gradle 5.1.0.
• Pins GitHub Actions in build.yml to specific commit SHAs and newer major versions (checkout v7, setup-java v5, setup-gradle v6, upload-artifact v7, git-auto-commit v7).
• Risk: all major version bumps may introduce breaking changes in build behavior or plugin APIs.

^{Macroscope summarized 353a482.}