Update GitHub Actions (major)

[solrbot]

This PR contains the following updates:

Package	Type	Update	Change
actions/labeler	action	major	v6.2.0 → v7.0.0
actions/setup-java	action	major	v5.7.0 → v6.0.0
actions/setup-python	action	major	v6.3.0 → v7.0.0
actions/stale	action	major	v10.4.0 → v11.0.0

---

Release Notes

actions/labeler (actions/labeler)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Migrate to ESM and update dependencies by @​chiranjib-swain in #​949

Full Changelog: actions/labeler@v6...v7.0.0

v7

Compare Source

actions/setup-java (actions/setup-java)

v6.0.0

Compare Source

What's Changed

• dist: Migrate from Zulu Discovery API to Azul Metadata API by @​jameswald in #​1010
• feat: add .mvn/extensions.xml to Maven cache key pattern by @​brunoborges with @​Copilot in #​1041
• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1078
• Map Zulu x86 architecture to i686 for Azul Metadata API by @​brunoborges in #​1079
• Rename jdkFile input to jdk-file with deprecated alias by @​brunoborges in #​1083
• Infer distribution from asdf .tool-versions vendor prefix by @​brunoborges in #​1084
• Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1086
• feat: expose cache-primary-key output (#​597) by @​brunoborges in #​1088
• docs: clarify V6 ESM migration is not a user-facing breaking change by @​brunoborges in #​1090
• Support multi-field Java versions like 18.0.1.1 by @​brunoborges in #​1092
• docs: document seeding the Maven cache for plugin dependencies by @​brunoborges in #​1094
• docs: clarify Maven cache paths and key hash inputs by @​brunoborges in #​1096
• Support pinning java-version as "latest" by @​brunoborges in #​1093
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @​dependabot[bot] in #​1101
• chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @​dependabot[bot] in #​1103
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @​dependabot[bot] in #​1105
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1106
• chore(deps-dev): bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in #​1104
• dist: Cover Tencent Kona JDK 25 by @​johnshajiang in #​1108
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1102
• Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1111
• dist: Support Liberica NIK (#​878) by @​asm0dey in #​1112
• Fix template injection (zizmor alert #​118) in e2e-versions.yml by @​brunoborges with @​Copilot in #​1114
• Fix template injection in e2e-versions.yml (zizmor alert #​122) by @​brunoborges with @​Copilot in #​1120
• Disable persisted checkout credentials in e2e workflow by @​brunoborges with @​Copilot in #​1115
• feat: Update recommended configuration for GPG signing by @​wetneb in #​608
• Cache Maven and Gradle wrapper distributions separately from the dependency cache by @​brunoborges in #​1097
• Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @​brunoborges in #​1124
• Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @​brunoborges in #​1123
• Extract repeated directory-check assertions into check-dir.sh helper by @​brunoborges in #​1127
• Consolidate duplicate jobs in e2e-versions workflow by @​brunoborges in #​1125
• Use YAML anchors to reduce boilerplate in e2e-versions workflow by @​brunoborges in #​1126
• Updated msft json for now by @​jmjaffe37 in #​1129
• Document missing action inputs in README by @​brunoborges in #​1130
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​1128
• Add an option to disable Java problem matchers by @​brunoborges in #​1133
• docs: update setup-java examples by @​HarithaVattikuti in #​1131
• Clarify credential environment variable inputs by @​brunoborges in #​1134
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @​dependabot[bot] in #​1135
• chore(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​1143
• chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @​dependabot[bot] in #​1142
• chore(deps-dev): bump @​typescript-eslint/parser from 8.64.0 to 8.65.0 by @​dependabot[bot] in #​1138
• chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @​dependabot[bot] in #​1136
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1137
• chore(deps): fix npm audited vulnerabilities by @​mhoffrog in #​1140
• Fix formatting issues in README.md by @​brunoborges in #​1144
• Remediate npm audit findings and rebuild distributions by @​brunoborges with @​Copilot in #​1145
• Set GRAALVM_HOME for GraalVM distributions by @​brunoborges with @​Copilot in #​1146
• Add force-download option for reproducible JDK builds by @​brunoborges with @​Copilot in #​1148
• Add OpenJDK distribution by @​brunoborges with @​Copilot in #​1147
• Support Temurin JDKs with JMOD files by @​brunoborges with @​Copilot in #​1149
• Document Java package compatibility by distribution by @​brunoborges in #​1152
• Fix caching when wrapper distributions are absent by @​brunoborges in #​1151
• Reject invalid boolean input values by @​brunoborges in #​1160
• Fail on mismatched Maven toolchain ID counts by @​brunoborges in #​1161
• Consolidate JDK metadata retry handling by @​brunoborges in #​1162
• Add direct setup orchestration tests by @​brunoborges in #​1163
• Harden java-package validation across distributions by @​brunoborges in #​1165
• Verify JDK downloads with vendor checksums by @​brunoborges in #​1167
• Reduce change-time Java E2E matrix by @​brunoborges in #​1170
• Add read-only mode for dependency caching by @​brunoborges in #​1169
• Test Temurin 25 on hosted runners by @​brunoborges in #​1172
• Restore dependency and wrapper caches concurrently by @​brunoborges in #​1174
• Add dependency cache path overrides by @​brunoborges in #​1175
• Centralize OS/architecture capability validation by @​brunoborges in #​1178
• Optimize Temurin tool-cache fast path with lazy loading by @​brunoborges in #​1179
• Optimize Maven configuration warm path by @​brunoborges in #​1182
• Fix macOS e2e workflow assertions by @​brunoborges in #​1184
• Remove legacy Adopt distributions in v6 by @​brunoborges with @​Copilot in #​1185
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​1190
• Reimagine setup-java README by @​brunoborges in #​1192
• Document deprecation of setup-java v1 through v4 by @​brunoborges in #​1198
• Update setup-java README action from v6 to v5 by @​brunoborges in #​1199
• Highlight major changes in setup-java v5 by @​brunoborges in #​1200
• Highlight major changes in setup-java v6 by @​brunoborges in #​1203
• chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 by @​dependabot[bot] in #​1202
• Add conditional JDK caching by @​brunoborges in #​1201
• docs: fix README and advanced usage inconsistencies with actual behavior by @​brunoborges in #​1204
• Move the extracted JDK into the tool-cache instead of copying it by @​brunoborges in #​1206
• docs: drop benchmark numbers from the JDK caching section by @​brunoborges in #​1205
• docs: correct the mvn-toolchain-id default in README and action.yml by @​brunoborges in #​1207
• Cache resolved JDK releases to remove the vendor API from warm jobs by @​brunoborges in #​1208
• Report concrete versions for floating Oracle JDK downloads by @​jdubois in #​1213
• Import Maven signing keys into an isolated GPG home by @​jdubois in #​1214
• Reuse the tool cache for floating versions the resolution cache identified by @​brunoborges in #​1219
• Fix JetBrains Runtime release pagination by @​jdubois in #​1218
• Fix JDK resolution cache platform identity by @​jdubois in #​1210
• fix: select musl JDK artifacts on Alpine for Dragonwell, Corretto, Zulu and Liberica by @​brunoborges in #​1220
• Fix SapMachine early-access filtering by @​jdubois in #​1217
• Fix JetBrains GitHub token resolution by @​jdubois in #​1224
• Include gradle.properties in Gradle cache key by @​jdubois in #​1225
• Handle early dependency cache failures during Java setup by @​jdubois in #​1226
• Fix js-yaml audit vulnerability by @​brunoborges in #​1228
• Fix failing GitHub Actions job for graalvm 24-ea by @​brunoborges with @​Copilot in #​1227
• Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date by @​jmjaffe37 in #​1236
• chore(deps-dev): bump globals from 17.8.0 to 17.9.0 by @​dependabot[bot] in #​1233
• chore(deps-dev): bump @​types/semver from 7.7.1 to 7.8.0 by @​dependabot[bot] in #​1229
• chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 by @​dependabot[bot] in #​1231
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.65.0 to 8.67.0 by @​dependabot[bot] in #​1232
• Test JDK 26 installation from SDKMAN by @​brunoborges in #​1238
• Add support for multiple Maven servers by @​brunoborges in #​1239
• Add Maven dependency-resolution repositories by @​brunoborges in #​1240
• Add Red Hat Build of OpenJDK support by @​brunoborges in #​1241
• Fix Oracle macOS E2E version check by @​brunoborges in #​1243
• ci: constrain cache e2e job modes by @​philip-gai in #​1244
• Expose contributing guide to GitHub by @​brunoborges in #​1245
• Set default signature verification for supported distributions by @​johnoliver in #​1246
• chore(deps): combine open Dependabot npm updates by @​brunoborges in #​1252
• Prepare documentation for v6 release by @​brunoborges in #​1253

New Contributors

• @​jameswald made their first contribution in #​1010
• @​asm0dey made their first contribution in #​1112
• @​wetneb made their first contribution in #​608
• @​philip-gai made their first contribution in #​1128

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

v6

Compare Source

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in #​1338
• Remove the pip-install input by @​gowridurgad in #​1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in #​1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in #​1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in #​1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in #​1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in #​1337

New Contributors

• @​lmvysakh made their first contribution in #​1335
• @​philip-gai made their first contribution in #​1337

Full Changelog: actions/setup-python@v6...v7.0.0

v7

Compare Source

actions/stale (actions/stale)

v11.0.0

Compare Source

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in #​1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in #​1351

Full Changelog: actions/stale@v10...v11.0.0

v11

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot

[epugh]

I wish all the gha would have been run to confirm no regressions.