From 0201bcebe1d9f41a424275a84fa92b2b5b8df4c9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:00:06 +0000 Subject: [PATCH 1/7] chore(ci): bump gradle/actions from 4 to 6 Bumps [gradle/actions](https://github.com/gradle/actions) from 4 to 6. - [Release notes](https://github.com/gradle/actions/releases) - [Commits](https://github.com/gradle/actions/compare/v4...v6) --- updated-dependencies: - dependency-name: gradle/actions dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/coverage.yml | 2 +- .github/workflows/cross-platform-tests.yml | 2 +- .github/workflows/dependency-security.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 3e166662..fd642e0d 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -50,7 +50,7 @@ jobs: distribution: 'corretto' - name: Set up Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v6 # The task deliberately lets tests fail so a flake cannot block the report. The report # itself carries the failure count, and gradle.yml is what actually gates on tests. diff --git a/.github/workflows/cross-platform-tests.yml b/.github/workflows/cross-platform-tests.yml index b3bed7bc..0c6bc72a 100644 --- a/.github/workflows/cross-platform-tests.yml +++ b/.github/workflows/cross-platform-tests.yml @@ -43,7 +43,7 @@ jobs: distribution: 'corretto' - name: Set up Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v6 # bash on both platforms so one command works everywhere; Git Bash ships on the Windows runner. - name: Run the core SDK tests diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index 6f2393f6..a1a62703 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -49,7 +49,7 @@ jobs: distribution: 'corretto' - name: Set up Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v6 - name: Resolve dependencies for every module run: | @@ -155,7 +155,7 @@ jobs: java-version: '17' distribution: 'corretto' - name: Submit resolved dependency graph to GitHub - uses: gradle/actions/dependency-submission@v4 + uses: gradle/actions/dependency-submission@v6 dependency-review: name: Review dependency changes From be87e541a330c95c2dea96b4d20e4c6d7c86f417 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:00:11 +0000 Subject: [PATCH 2/7] chore(ci): bump sarisia/actions-status-discord from 1.13.0 to 1.16.0 Bumps [sarisia/actions-status-discord](https://github.com/sarisia/actions-status-discord) from 1.13.0 to 1.16.0. - [Release notes](https://github.com/sarisia/actions-status-discord/releases) - [Commits](https://github.com/sarisia/actions-status-discord/compare/v1.13...v1.16) --- updated-dependencies: - dependency-name: sarisia/actions-status-discord dependency-version: 1.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d95216c3..9bfb98d5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -233,7 +233,7 @@ jobs: env: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE }} - name: Discord - uses: sarisia/actions-status-discord@9904e3130b8905d5b973df25623f17672dcb3466 # v1.13.0 + uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0 with: webhook: ${{ secrets.DISCORD_WEBHOOK_URL }} nodetail: true From 9332c74c0eef5f1ecc8e06352fa73daf83fd917d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:00:20 +0000 Subject: [PATCH 3/7] chore(ci): bump actions/setup-java from 3 to 6 Bumps [actions/setup-java](https://github.com/actions/setup-java) from 3 to 6. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v3...v6) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/coverage.yml | 2 +- .github/workflows/cross-platform-tests.yml | 2 +- .github/workflows/dependency-security.yml | 4 ++-- .github/workflows/gradle.yml | 2 +- .github/workflows/publishing.yml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 3e166662..bc1cbfc8 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -44,7 +44,7 @@ jobs: fetch-depth: 0 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version: '17' distribution: 'corretto' diff --git a/.github/workflows/cross-platform-tests.yml b/.github/workflows/cross-platform-tests.yml index b3bed7bc..32e13840 100644 --- a/.github/workflows/cross-platform-tests.yml +++ b/.github/workflows/cross-platform-tests.yml @@ -37,7 +37,7 @@ jobs: uses: actions/checkout@v4 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version: '17' distribution: 'corretto' diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index 6f2393f6..3fcbaa8c 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -43,7 +43,7 @@ jobs: # dependencies -- exactly the blind spot that let a known org.json CVE sit in the demo # modules after sdk-java had been fixed. - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version: '17' distribution: 'corretto' @@ -150,7 +150,7 @@ jobs: contents: write steps: - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@v6 with: java-version: '17' distribution: 'corretto' diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 3a9cad6d..0b34e564 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@v4 - name: Set up JDK 8 - uses: actions/setup-java@v3 + uses: actions/setup-java@v6 with: java-version: '8' distribution: 'corretto' diff --git a/.github/workflows/publishing.yml b/.github/workflows/publishing.yml index 5daee1da..e5a1dfe3 100644 --- a/.github/workflows/publishing.yml +++ b/.github/workflows/publishing.yml @@ -17,7 +17,7 @@ jobs: uses: actions/checkout@v4 - name: Set up JDK 8 - uses: actions/setup-java@v3 + uses: actions/setup-java@v6 with: java-version: '8' distribution: 'corretto' From a92179083e85507d53f62538747d6586f5f8fc3b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:00:45 +0000 Subject: [PATCH 4/7] chore(ci): bump gradle/actions/setup-gradle from 6.3.0 to 6.4.0 Bumps [gradle/actions/setup-gradle](https://github.com/gradle/actions) from 6.3.0 to 6.4.0. - [Release notes](https://github.com/gradle/actions/releases) - [Commits](https://github.com/gradle/actions/compare/9c971963bec38e04b3d30dcc455b5382be2fdbfb...3f5f9adaf7d9fecd50b5935e54106014257a94e6) --- updated-dependencies: - dependency-name: gradle/actions/setup-gradle dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d95216c3..d3d8dd94 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -101,7 +101,7 @@ jobs: run: | echo '### JDK, Java 8 runtime and Maven' >> "$GITHUB_STEP_SUMMARY" { java -version; "$JAVA_HOME_8_X64/bin/java" -version; mvn -v; } 2>&1 | sed 's/^/ /' >> "$GITHUB_STEP_SUMMARY" - - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 + - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 with: cache-disabled: true - name: Make sure a virtual display for the JavaFX tests exists From 969ddb4f008c7a90d6d6c40c78e08c3b940e2935 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:00:49 +0000 Subject: [PATCH 5/7] chore(ci): bump actions/upload-artifact from 4 to 7 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/coverage.yml | 2 +- .github/workflows/cross-platform-tests.yml | 2 +- .github/workflows/dependency-security.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 3e166662..f164739d 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -146,7 +146,7 @@ jobs: - name: Upload the coverage reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: coverage-reports path: | diff --git a/.github/workflows/cross-platform-tests.yml b/.github/workflows/cross-platform-tests.yml index b3bed7bc..a2c77634 100644 --- a/.github/workflows/cross-platform-tests.yml +++ b/.github/workflows/cross-platform-tests.yml @@ -69,7 +69,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: test-results-${{ matrix.os }} path: | diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index 6f2393f6..c628018f 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -128,7 +128,7 @@ jobs: - name: Upload dependency list if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: resolved-dependencies path: | From 69a25fd5158bb2987dcb9f84e32138d3b9575fd0 Mon Sep 17 00:00:00 2001 From: Arif Burak Demiray Date: Wed, 21 Oct 2026 21:36:27 +0300 Subject: [PATCH 6/7] Point Dependabot at staging Dependabot reads its configuration from the default branch, so the target-branch has to be set here for it to apply. Releases are tagged on staging; updates merged into master never reached a release (org.json 20260814 is on master but not on staging). The file matches the one the staging sync carries, so the next release merge does not conflict. --- .github/dependabot.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bce2dc92..edf452cf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,10 +1,17 @@ version: 2 updates: - # Gradle dependencies. org.json is declared separately in sdk-java, app-java - # and app-javafx; Dependabot opens one PR per module, so check that a bump - # lands everywhere before closing the others. + # Gradle dependencies. org.json is declared separately in sdk-java, sdk-java-ui, + # app-java and app-javafx; Dependabot opens one PR per module, so check that a + # bump lands everywhere before closing the others. A bump of a published + # dependency also has to update .github/release-contract/, or the release + # checks fail. + # + # Releases are tagged on staging, so version updates target staging; master + # receives them with the next release. Security updates still open against + # master, so merge master into staging after taking one. - package-ecosystem: gradle directory: "/" + target-branch: staging schedule: interval: weekly day: monday @@ -16,6 +23,7 @@ updates: - package-ecosystem: github-actions directory: "/" + target-branch: staging schedule: interval: monthly labels: From 3b418b5ac08470d98f8115e466c4b551e554f739 Mon Sep 17 00:00:00 2001 From: Arif Burak Demiray <57103426+arifBurakDemiray@users.noreply.github.com> Date: Thu, 22 Oct 2026 09:00:16 +0300 Subject: [PATCH 7/7] Delete .github/workflows/publishing.yml --- .github/workflows/publishing.yml | 35 -------------------------------- 1 file changed, 35 deletions(-) delete mode 100644 .github/workflows/publishing.yml diff --git a/.github/workflows/publishing.yml b/.github/workflows/publishing.yml deleted file mode 100644 index e5a1dfe3..00000000 --- a/.github/workflows/publishing.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Publish the Java SDK -on: - workflow_dispatch: - inputs: - deploy: - description: 'Deploy?' - required: true - type: boolean -jobs: - build: - name: Build and Test - if: ${{ inputs.deploy }} - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Set up JDK 8 - uses: actions/setup-java@v6 - with: - java-version: '8' - distribution: 'corretto' - - - name: Build and Test with Gradle - run: ./gradlew build - - - name: Publish SDK Library to Maven Central - run: ./gradlew publishAllPublicationsToMavenCentralRepository --no-configuration-cache - env: - ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }} - ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }} - ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_KEY }} - ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.GPG_KEY_ID }} - ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_KEY_PASSWORD }}