chore(deps): bump the all-actions group across 1 directory with 2 updates

[dependabot]

Bumps the all-actions group with 2 updates in the / directory: gradle/actions and github/codeql-action.

Updates gradle/actions from 6.2.0 to 6.3.0

Release notes

Sourced from gradle/actions's releases.

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

• Cache entries failed to store at all on Windows.. Every entry failed with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of @actions/glob combined with a silently swallowed require() in the bundle, which left Windows path separators unnormalized.

• Cache cleanup deleted instrumented jars that were in use. A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created caches/jars-9 entries as unused and remove them, so the instrumented-jars entry was never saved and every job re-instrumented its classpaths.

  Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT] Existing cache entries are invalidated by this release. The cache protocol version was bumped to v2, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports (Entry not saved: save failed) in the Job Summary when a cache save fails, rather than reporting success (#1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (#1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

• Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
• 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

• Render configuration-cache status in the caching Job Summary by @​bigdaz in gradle/actions#989
• Update gradle-actions-caching library to v0.8.0 by @​bot-githubaction in gradle/actions#993
• Support experimental project-entry caching (configuration-cache + build-logic) by @​bigdaz in gradle/actions#994
• Update gradle-actions-caching library to v0.9.0 by @​bot-githubaction in gradle/actions#996
• Disable Isolated Projects via promoted property in dependency-submission by @​reinsch82 in gradle/actions#1025
• Add Windows coverage for caching via a new smoke-test suite by @​bigdaz in gradle/actions#1027

... (truncated)

Commits

• 9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
• 760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
• 73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
• a9d1438 Add dependabot ignore rules for TypeScript 7.x and @​types/node 25.x/26.x
• 68f3700 [bot] Update dist directory
• 5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
• b5bc804 [bot] Update dist directory
• dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and secu...
• ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
• 4318659 [bot] Update dist directory
• Additional commits viewable in compare view

Updates github/codeql-action from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

[devcrocod]

@dependabot rebase

[devcrocod]

@dependabot rebase