ci(deps): update github actions (major)

[meza-deps]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/setup-java	action	major	v5.4.0 → v6.0.0
actions/setup-node	action	major	v6.4.0 → v7.0.0
crowdin/github-action	action	major	v2.16.3 → v3.0.0	v3.0.2 (+1)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/setup-java (actions/setup-java)

v6.0.0

Compare Source

What's Changed

• dist: Migrate from Zulu Discovery API to Azul Metadata API by @​jameswald in #​1010
• feat: add .mvn/extensions.xml to Maven cache key pattern by @​brunoborges with @​Copilot in #​1041
• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1078
• Map Zulu x86 architecture to i686 for Azul Metadata API by @​brunoborges in #​1079
• Rename jdkFile input to jdk-file with deprecated alias by @​brunoborges in #​1083
• Infer distribution from asdf .tool-versions vendor prefix by @​brunoborges in #​1084
• Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1086
• feat: expose cache-primary-key output (#​597) by @​brunoborges in #​1088
• docs: clarify V6 ESM migration is not a user-facing breaking change by @​brunoborges in #​1090
• Support multi-field Java versions like 18.0.1.1 by @​brunoborges in #​1092
• docs: document seeding the Maven cache for plugin dependencies by @​brunoborges in #​1094
• docs: clarify Maven cache paths and key hash inputs by @​brunoborges in #​1096
• Support pinning java-version as "latest" by @​brunoborges in #​1093
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @​dependabot[bot] in #​1101
• chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @​dependabot[bot] in #​1103
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @​dependabot[bot] in #​1105
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1106
• chore(deps-dev): bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in #​1104
• dist: Cover Tencent Kona JDK 25 by @​johnshajiang in #​1108
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1102
• Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1111
• dist: Support Liberica NIK (#​878) by @​asm0dey in #​1112
• Fix template injection (zizmor alert #​118) in e2e-versions.yml by @​brunoborges with @​Copilot in #​1114
• Fix template injection in e2e-versions.yml (zizmor alert #​122) by @​brunoborges with @​Copilot in #​1120
• Disable persisted checkout credentials in e2e workflow by @​brunoborges with @​Copilot in #​1115
• feat: Update recommended configuration for GPG signing by @​wetneb in #​608
• Cache Maven and Gradle wrapper distributions separately from the dependency cache by @​brunoborges in #​1097
• Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @​brunoborges in #​1124
• Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @​brunoborges in #​1123
• Extract repeated directory-check assertions into check-dir.sh helper by @​brunoborges in #​1127
• Consolidate duplicate jobs in e2e-versions workflow by @​brunoborges in #​1125
• Use YAML anchors to reduce boilerplate in e2e-versions workflow by @​brunoborges in #​1126
• Updated msft json for now by @​jmjaffe37 in #​1129
• Document missing action inputs in README by @​brunoborges in #​1130
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​1128
• Add an option to disable Java problem matchers by @​brunoborges in #​1133
• docs: update setup-java examples by @​HarithaVattikuti in #​1131
• Clarify credential environment variable inputs by @​brunoborges in #​1134
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @​dependabot[bot] in #​1135
• chore(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​1143
• chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @​dependabot[bot] in #​1142
• chore(deps-dev): bump @​typescript-eslint/parser from 8.64.0 to 8.65.0 by @​dependabot[bot] in #​1138
• chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @​dependabot[bot] in #​1136
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1137
• chore(deps): fix npm audited vulnerabilities by @​mhoffrog in #​1140
• Fix formatting issues in README.md by @​brunoborges in #​1144
• Remediate npm audit findings and rebuild distributions by @​brunoborges with @​Copilot in #​1145
• Set GRAALVM_HOME for GraalVM distributions by @​brunoborges with @​Copilot in #​1146
• Add force-download option for reproducible JDK builds by @​brunoborges with @​Copilot in #​1148
• Add OpenJDK distribution by @​brunoborges with @​Copilot in #​1147
• Support Temurin JDKs with JMOD files by @​brunoborges with @​Copilot in #​1149
• Document Java package compatibility by distribution by @​brunoborges in #​1152
• Fix caching when wrapper distributions are absent by @​brunoborges in #​1151
• Reject invalid boolean input values by @​brunoborges in #​1160
• Fail on mismatched Maven toolchain ID counts by @​brunoborges in #​1161
• Consolidate JDK metadata retry handling by @​brunoborges in #​1162
• Add direct setup orchestration tests by @​brunoborges in #​1163
• Harden java-package validation across distributions by @​brunoborges in #​1165
• Verify JDK downloads with vendor checksums by @​brunoborges in #​1167
• Reduce change-time Java E2E matrix by @​brunoborges in #​1170
• Add read-only mode for dependency caching by @​brunoborges in #​1169
• Test Temurin 25 on hosted runners by @​brunoborges in #​1172
• Restore dependency and wrapper caches concurrently by @​brunoborges in #​1174
• Add dependency cache path overrides by @​brunoborges in #​1175
• Centralize OS/architecture capability validation by @​brunoborges in #​1178
• Optimize Temurin tool-cache fast path with lazy loading by @​brunoborges in #​1179
• Optimize Maven configuration warm path by @​brunoborges in #​1182
• Fix macOS e2e workflow assertions by @​brunoborges in #​1184
• Remove legacy Adopt distributions in v6 by @​brunoborges with @​Copilot in #​1185
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​1190
• Reimagine setup-java README by @​brunoborges in #​1192
• Document deprecation of setup-java v1 through v4 by @​brunoborges in #​1198
• Update setup-java README action from v6 to v5 by @​brunoborges in #​1199
• Highlight major changes in setup-java v5 by @​brunoborges in #​1200
• Highlight major changes in setup-java v6 by @​brunoborges in #​1203
• chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 by @​dependabot[bot] in #​1202
• Add conditional JDK caching by @​brunoborges in #​1201
• docs: fix README and advanced usage inconsistencies with actual behavior by @​brunoborges in #​1204
• Move the extracted JDK into the tool-cache instead of copying it by @​brunoborges in #​1206
• docs: drop benchmark numbers from the JDK caching section by @​brunoborges in #​1205
• docs: correct the mvn-toolchain-id default in README and action.yml by @​brunoborges in #​1207
• Cache resolved JDK releases to remove the vendor API from warm jobs by @​brunoborges in #​1208
• Report concrete versions for floating Oracle JDK downloads by @​jdubois in #​1213
• Import Maven signing keys into an isolated GPG home by @​jdubois in #​1214
• Reuse the tool cache for floating versions the resolution cache identified by @​brunoborges in #​1219
• Fix JetBrains Runtime release pagination by @​jdubois in #​1218
• Fix JDK resolution cache platform identity by @​jdubois in #​1210
• fix: select musl JDK artifacts on Alpine for Dragonwell, Corretto, Zulu and Liberica by @​brunoborges in #​1220
• Fix SapMachine early-access filtering by @​jdubois in #​1217
• Fix JetBrains GitHub token resolution by @​jdubois in #​1224
• Include gradle.properties in Gradle cache key by @​jdubois in #​1225
• Handle early dependency cache failures during Java setup by @​jdubois in #​1226
• Fix js-yaml audit vulnerability by @​brunoborges in #​1228
• Fix failing GitHub Actions job for graalvm 24-ea by @​brunoborges with @​Copilot in #​1227
• Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date by @​jmjaffe37 in #​1236
• chore(deps-dev): bump globals from 17.8.0 to 17.9.0 by @​dependabot[bot] in #​1233
• chore(deps-dev): bump @​types/semver from 7.7.1 to 7.8.0 by @​dependabot[bot] in #​1229
• chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 by @​dependabot[bot] in #​1231
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.65.0 to 8.67.0 by @​dependabot[bot] in #​1232
• Test JDK 26 installation from SDKMAN by @​brunoborges in #​1238
• Add support for multiple Maven servers by @​brunoborges in #​1239
• Add Maven dependency-resolution repositories by @​brunoborges in #​1240
• Add Red Hat Build of OpenJDK support by @​brunoborges in #​1241
• Fix Oracle macOS E2E version check by @​brunoborges in #​1243
• ci: constrain cache e2e job modes by @​philip-gai in #​1244
• Expose contributing guide to GitHub by @​brunoborges in #​1245
• Set default signature verification for supported distributions by @​johnoliver in #​1246
• chore(deps): combine open Dependabot npm updates by @​brunoborges in #​1252
• Prepare documentation for v6 release by @​brunoborges in #​1253

New Contributors

• @​jameswald made their first contribution in #​1010
• @​asm0dey made their first contribution in #​1112
• @​wetneb made their first contribution in #​608
• @​philip-gai made their first contribution in #​1128

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

v6

Compare Source

v5.7.0

Compare Source

What's Changed

• Fix npm audit failures on releases/v5 by @​brunoborges in #​1154
• Backport #​1151: Fix missing wrapper cache distributions by @​brunoborges in #​1153
• Deprecate legacy Adopt distributions in v5 by @​brunoborges in #​1186

Full Changelog: actions/setup-java@v5.6.0...v5.7.0

v5.6.0

Compare Source

What's Changed

• Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1087
• feat: expose cache-primary-key output (#​597) [v5 backport] by @​brunoborges in #​1089
• dist: Cover Tencent Kona JDK 25 (#​1108) [v5 backport] by @​brunoborges in #​1110
• Backport #​1111: Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1113
• Backport #​1097/#​1098 to v5: cache Maven and Gradle wrapper distributions separately by @​brunoborges in #​1122

Full Changelog: actions/setup-java@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

• chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by @​brunoborges in #​1061
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​1069
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1068
• Bump actions/setup-python from 5 to 6 by @​dependabot[bot] in #​1067
• Bump @​typescript-eslint/parser from 8.61.1 to 8.62.0 by @​dependabot[bot] in #​1062
• feat: Add verify-signature plumbing and Temurin+Microsoft verification support by @​johnoliver in #​1060
• Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by @​jmjaffe37 in #​1070
• Fix arm64 e2e workflow tests mislabeled as x64 by @​brunoborges with @​Copilot in #​1073
• feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by @​brunoborges in #​1053
• feat: Disable interactiveMode in generated Maven settings.xml by @​brunoborges with @​Copilot in #​1052
• Bump prettier from 3.6.2 to 3.9.1 by @​dependabot[bot] in #​1066
• chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by @​dependabot[bot] in #​1074
• fix: Maven Toolchains grows unexpectedly by @​Okeanos in #​534
• dist: Support Tencent Kona JDK by @​johnshajiang in #​672
• feat: Add set-default option by @​gsmet in #​1017
• docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by @​brunoborges in #​1075
• feat: Add distribution detection support to .sdkmanrc file by @​lukaszgyg in #​975

New Contributors

• @​jmjaffe37 made their first contribution in #​1070
• @​gsmet made their first contribution in #​1017
• @​lukaszgyg made their first contribution in #​975

Full Changelog: actions/setup-java@v5...v5.5.0

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

crowdin/github-action (crowdin/github-action)

v3.0.0

Compare Source

Crowdin GitHub Action v3 runs on Crowdin CLI 5 🚀 - a complete rewrite that starts instantly and no longer requires Java. Your workflows, crowdin.yml configuration, and exit codes stay the same, so most setups upgrade with a one-line change:

-uses: crowdin/github-action@v2
+uses: crowdin/github-action@v3

Breaking changes

Only relevant if you pass custom CLI arguments via the command, command_args, or other *_args inputs:

• pre-translate is now auto-translate (no alias); --translate-untranslated-only was removed - use --scope.
• --plain was removed - use --output plain.
• Redundant negatable flags were removed (e.g. --auto-update; --no-auto-update stays) - defaults are unchanged, simply drop them.

v3

Compare Source

v2.17.1

Compare Source

What's Changed

• CLI 4.15.1 by @​andrii-bodnar
• docs: replace deprecated Context Harvester CLI with AI agents approach by @​andrii-bodnar in #​317

Full Changelog: crowdin/github-action@v2.17.0...v2.17.1

v2.17.0

Compare Source

What's Changed

• fix: fail when no secret GPG key is imported by @​oiahoon in #​314
• CLI 4.15.0 by @​andrii-bodnar
• docs: add announcement for v3 pre-release by @​andrii-bodnar in #​316

Full Changelog: crowdin/github-action@v2.16.4...v2.17.0

v2.16.4

Compare Source

What's Changed

• fix: support non-RSA GPG signing keys by @​oiahoon in #​313
• CLI 4.14.4 by @​andrii-bodnar

New Contributors

• @​oiahoon made their first contribution in #​313

Full Changelog: crowdin/github-action@v2.16.3...v2.16.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.