Bump the github-actions group across 3 directories with 3 updates

Bumps the github-actions group with 3 updates in the / directory: [gradle/actions](https://github.com/gradle/actions), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Bumps the github-actions group with 1 update in the /.github/actions/build-dist directory: [actions/upload-artifact](https://github.com/actions/upload-artifact). Bumps the github-actions group with 1 update in the /.github/actions/init-integ-test directory: [actions/download-artifact](https://github.com/actions/download-artifact). Updates `gradle/actions` from 5.0.1 to 5.0.2 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](f29f5a9d7b...0723195856) Updates `actions/upload-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](b7c566a772...bbbca2ddaa) Updates `actions/download-artifact` from 7.0.0 to 8.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](37930b1c2a...70fc10c6e5) Updates `actions/upload-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](b7c566a772...bbbca2ddaa) Updates `actions/download-artifact` from 7.0.0 to 8.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](37930b1c2a...70fc10c6e5) --- updated-dependencies: - dependency-name: gradle/actions dependency-version: 5.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Bump github/codeql-action in the github-actions group across 1 directory (#864 )
2026-03-02 17:49:49 +08:00 · 2026-02-26 23:06:35 +00:00 · 2026-02-23 14:37:29 -07:00 · 2026-02-23 14:37:18 -07:00 · 2026-02-23 14:12:13 -07:00 · 2026-02-23 20:17:24 +00:00
52 changed files with 3456 additions and 945835 deletions
--- a/.github/actions/build-dist/action.yml
+++ b/.github/actions/build-dist/action.yml
@@ -23,7 +23,7 @@ runs:
        cp -r sources/dist .

    - name: Upload distribution
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: dist
        path: dist/
--- a/.github/actions/init-integ-test/action.yml
+++ b/.github/actions/init-integ-test/action.yml
@@ -10,7 +10,7 @@ runs:
  using: "composite"
  steps: 
    - name: Setup Java
-      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        distribution: 'temurin'
        java-version: ${{ inputs.java-version }}
@@ -23,7 +23,7 @@ runs:
    # Downloads a 'dist' directory artifact that was uploaded in an earlier 'build-dist' step
    - name: Download dist
      if: ${{ env.SKIP_DIST != 'true' && !env.ACT }}
-      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
      with:
        name: dist
        path: dist/
--- a/.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=0d585f69da091fc5b2beced877feab55a3064d43b8a1d46aeb07996b0915e0e0
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionSha256Sum=b266d5ff6b90eada6dc3b20cb090e3731302e553a27c5d3e4df1f0d76beaff06
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=0d585f69da091fc5b2beced877feab55a3064d43b8a1d46aeb07996b0915e0e0
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionSha256Sum=b266d5ff6b90eada6dc3b20cb090e3731302e553a27c5d3e4df1f0d76beaff06
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/groovy-dsl/settings.gradle
+++ b/.github/workflow-samples/groovy-dsl/settings.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "4.3.1"
+    id "com.gradle.develocity" version "4.3.2"
    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.4.0"
 }

--- a/.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=0d585f69da091fc5b2beced877feab55a3064d43b8a1d46aeb07996b0915e0e0
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionSha256Sum=b266d5ff6b90eada6dc3b20cb090e3731302e553a27c5d3e4df1f0d76beaff06
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=0d585f69da091fc5b2beced877feab55a3064d43b8a1d46aeb07996b0915e0e0
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionSha256Sum=b266d5ff6b90eada6dc3b20cb090e3731302e553a27c5d3e4df1f0d76beaff06
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/kotlin-dsl/settings.gradle.kts
+++ b/.github/workflow-samples/kotlin-dsl/settings.gradle.kts
@@ -1,5 +1,5 @@
 plugins {
-    id("com.gradle.develocity") version "4.3.1"
+    id("com.gradle.develocity") version "4.3.2"
    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.4.0"
 }

--- a/.github/workflow-samples/no-wrapper-gradle-5/build.gradle
+++ b/.github/workflow-samples/no-wrapper-gradle-5/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "4.3.1" 
+    id "com.gradle.develocity" version "4.3.2" 
 }

 develocity {
--- a/.github/workflow-samples/no-wrapper/settings.gradle
+++ b/.github/workflow-samples/no-wrapper/settings.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "4.3.1"
+    id "com.gradle.develocity" version "4.3.2"
 }

 develocity {
--- a/.github/workflow-samples/non-executable-wrapper/settings.gradle
+++ b/.github/workflow-samples/non-executable-wrapper/settings.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "4.3.1"
+    id "com.gradle.develocity" version "4.3.2"
 }

 develocity {
--- a/.github/workflows/ci-check-and-unit-test.yml
+++ b/.github/workflows/ci-check-and-unit-test.yml
@@ -26,16 +26,23 @@ jobs:
        cache-dependency-path: sources/package-lock.json
    - name: Setup Gradle
      # Use a released version to avoid breakages
-      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
      env:
        ALLOWED_GRADLE_WRAPPER_CHECKSUMS: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 # Invalid wrapper jar used for testing
      with:
        gradle-version: '8.14.2'

+    - name: Install Develocity npm agent
+      run: |
+        npm exec -y -- pacote extract @gradle-tech/develocity-agent@3.0.1 ~/.node_libraries/@gradle-tech/develocity-agent
+
    - name: Install npm dependencies
      run: |
        npm clean-install
      working-directory: sources
+      env:
+        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
+        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'

    - name: Check formatting and compile
      run: |
@@ -44,7 +51,6 @@ jobs:
      working-directory: sources
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
-        DEVELOCITY_URL: 'https://ge.solutions-team.gradle.com'
        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'

    - name: Run unit tests
@@ -53,5 +59,4 @@ jobs:
      working-directory: sources
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
-        DEVELOCITY_URL: 'https://ge.solutions-team.gradle.com'
        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'
--- a/.github/workflows/ci-check-no-dist-update.yml
+++ b/.github/workflows/ci-check-no-dist-update.yml
@@ -21,7 +21,7 @@ jobs:

    - name: Get changed files
      id: changed-files
-      uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
+      uses: tj-actions/changed-files@7dee1b0c1557f278e5c7dc244927139d78c0e22a # v47.0.4
      with:
        files: |
          dist/**
--- a/.github/workflows/ci-codeql.yml
+++ b/.github/workflows/ci-codeql.yml
@@ -35,7 +35,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
+      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
      with:
        languages: ${{ matrix.language }}
        config: |
@@ -43,4 +43,4 @@ jobs:
          - sources/src

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
+      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
--- a/.github/workflows/ci-init-script-check.yml
+++ b/.github/workflows/ci-init-script-check.yml
@@ -30,7 +30,7 @@ jobs:
        java-version: 17
    - name: Setup Gradle
      # Use a released version to avoid breakages
-      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
      env:
        ALLOWED_GRADLE_WRAPPER_CHECKSUMS: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 # Invalid wrapper jar used for testing
    - name: Run integration tests
--- a/.github/workflows/ci-ossf-scorecard.yml
+++ b/.github/workflows/ci-ossf-scorecard.yml
@@ -44,7 +44,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: 'Upload artifact'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: SARIF file
          path: results.sarif
@@ -52,6 +52,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
        with:
          sarif_file: results.sarif
--- a/.github/workflows/ci-update-dist.yml
+++ b/.github/workflows/ci-update-dist.yml
@@ -34,10 +34,17 @@ jobs:
        cache: npm
        cache-dependency-path: sources/package-lock.json

+    - name: Install Develocity npm agent
+      run: |
+        npm exec -y -- pacote extract @gradle-tech/develocity-agent@3.0.1 ~/.node_libraries/@gradle-tech/develocity-agent
+
    - name: Install npm dependencies
      run: |
        npm clean-install
      working-directory: sources
+      env:
+        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
+        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'

    - name: Build distribution
      run: |
--- a/.github/workflows/ci-validate-wrappers.yml
+++ b/.github/workflows/ci-validate-wrappers.yml
@@ -12,6 +12,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - uses: gradle/actions/wrapper-validation@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
        with:
          allow-checksums: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
--- a/.github/workflows/integ-test-cache-cleanup.yml
+++ b/.github/workflows/integ-test-cache-cleanup.yml
@@ -70,9 +70,10 @@ jobs:
      working-directory: sources/test/jest/resources/cache-cleanup
      run: ./gradlew --no-daemon --build-cache -Dcommons_math3_version="3.1.1" build

+  # Third build will restore cache entry from second, and verify stale content removed
  cache-cleanup-check-clean-cache:
    env:
-      GRADLE_BUILD_ACTION_CACHE_KEY_JOB_EXECUTION: ${{github.sha}}_2
+      GRADLE_BUILD_ACTION_CACHE_KEY_JOB_EXECUTION: ${{github.sha}}_1
    needs: cache-cleanup-assemble-build
    strategy:
      max-parallel: 1
--- a/.github/workflows/integ-test-dependency-graph.yml
+++ b/.github/workflows/integ-test-dependency-graph.yml
@@ -178,7 +178,7 @@ jobs:
    runs-on: "ubuntu-latest"
    steps:
    - name: Download dependency-graph artifact
-      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
      with:
        path: downloaded-dependency-graphs
        pattern: dependency-graph_*dependency-graph-generate-submit-and-upload.json
--- a/.github/workflows/integ-test-dependency-submission.yml
+++ b/.github/workflows/integ-test-dependency-submission.yml
@@ -394,7 +394,7 @@ jobs:
        dependency-graph-report-dir: '${{ github.workspace }}/custom/report-dir'
        build-root-directory: .github/workflow-samples/groovy-dsl

-  custom-report-dir-download-and-submit:
+  dependency-submission-custom-report-dir-download-and-submit:
    permissions:
      contents: write
    needs: [dependency-submission-custom-report-dir-upload]
--- a/.github/workflows/integ-test-inject-develocity.yml
+++ b/.github/workflows/integ-test-inject-develocity.yml
@@ -30,7 +30,7 @@ jobs:
      matrix:
        gradle: ['current', '8.14.3', '7.6.2', '6.9.4', '5.6.4']
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: ['3.16.2', '4.3.1']
+        plugin-version: ['3.16.2', '4.3.2']
        include:
          - java-version: 17
          - gradle: '8.14.3'
@@ -43,7 +43,7 @@ jobs:
            java-version: 11
          - plugin-version: '3.16.2'
            accessKeyEnv: GRADLE_ENTERPRISE_ACCESS_KEY
-          - plugin-version: '4.3.1'
+          - plugin-version: '4.3.2'
            accessKeyEnv: DEVELOCITY_ACCESS_KEY
    runs-on: ${{ matrix.os }}
    env:
@@ -92,7 +92,7 @@ jobs:
      matrix:
        gradle: ['current', '8.14.3', '7.6.2', '6.9.4', '5.6.4']
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: ['3.16.2', '4.3.1']
+        plugin-version: ['3.16.2', '4.3.2']
        include:
          - java-version: 17
          - gradle: '8.14.3'
@@ -148,7 +148,7 @@ jobs:
      matrix:
        gradle: ['current', '8.14.3', '7.6.2', '6.9.4', '5.6.4']
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: [ '3.16.2', '4.3.1' ]
+        plugin-version: [ '3.16.2', '4.3.2' ]
        include:
          - java-version: 17
          - gradle: '8.14.3'
@@ -191,7 +191,7 @@ jobs:
      matrix:
        gradle: ['current', '8.14.3', '7.6.2', '6.9.4', '5.6.4']
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: [ '3.16.2', '4.3.1' ]
+        plugin-version: [ '3.16.2', '4.3.2' ]
        include:
          - java-version: 17
          - gradle: '8.14.3'
--- a/sources/.tool-versions
+++ b/sources/.tool-versions
@@ -1,3 +1,4 @@
 # Configuration file for asdf version manager
 nodejs 24.3.0
 gradle 8.14.2
+java liberica-11.0.26+9
--- a/6
+++ b/6
@@ -2,12 +2,6 @@

 cd sources

-if [[ -f ~/.gradle/develocity/keys.properties ]]; then
-    export NODE_OPTIONS='-r @gradle-tech/develocity-agent/preload'
-    export DEVELOCITY_URL=https://ge.solutions-team.gradle.com
-    export DEVELOCITY_ACCESS_KEY=$(paste -sd ';' ~/.gradle/develocity/keys.properties)
-fi
-
 case "$1" in
    all)
        npm run all
--- a/dist/dependency-submission/main/index.js
+++ b/dist/dependency-submission/main/index.js
--- a/dist/dependency-submission/main/index.js.map
+++ b/dist/dependency-submission/main/index.js.map
--- a/dist/dependency-submission/post/index.js
+++ b/dist/dependency-submission/post/index.js
--- a/dist/dependency-submission/post/index.js.map
+++ b/dist/dependency-submission/post/index.js.map
--- a/dist/setup-gradle/main/index.js
+++ b/dist/setup-gradle/main/index.js
--- a/dist/setup-gradle/main/index.js.map
+++ b/dist/setup-gradle/main/index.js.map
--- a/dist/setup-gradle/post/index.js
+++ b/dist/setup-gradle/post/index.js
--- a/dist/setup-gradle/post/index.js.map
+++ b/dist/setup-gradle/post/index.js.map
--- a/dist/wrapper-validation/main/index.js
+++ b/dist/wrapper-validation/main/index.js
--- a/dist/wrapper-validation/main/index.js.map
+++ b/dist/wrapper-validation/main/index.js.map
--- a/docs/setup-gradle.md
+++ b/docs/setup-gradle.md
@@ -847,7 +847,7 @@ Here's a minimal example:
      run: ./gradlew build
 ```

-This configuration will automatically apply `v4.3.1` of the [Develocity Gradle plugin](https://docs.gradle.com/develocity/gradle-plugin/), and publish build scans to https://develocity.your-server.com.
+This configuration will automatically apply `v4.3.2` of the [Develocity Gradle plugin](https://docs.gradle.com/develocity/gradle-plugin/), and publish build scans to https://develocity.your-server.com.

 This example assumes that the `develocity.your-server.com` server allows anonymous publishing of build scans.
 In the likely scenario that your Develocity server requires authentication, you will also need to pass a valid [Develocity access key](https://docs.gradle.com/develocity/gradle-plugin/#via_environment_variable) taken from a secret:
--- a/sources/develocity.config.cjs
+++ b/sources/develocity.config.cjs
@@ -0,0 +1,8 @@
+const { fromPropertiesFile, inGradleUserHome } = require('@gradle-tech/develocity-agent/api/config');
+
+module.exports = {
+  server: {
+    url: 'https://ge.solutions-team.gradle.com/',
+    accessKey: fromPropertiesFile(inGradleUserHome())
+  },
+}
--- a/sources/jest.config.js
+++ b/sources/jest.config.js
@@ -1,14 +1,20 @@
-module.exports = {
+import {createRequire} from 'node:module'
+
+const require = createRequire(import.meta.url)
+const develocityReporter = require.resolve('@gradle-tech/develocity-agent/jest-reporter')
+
+export default {
  clearMocks: true,
  moduleFileExtensions: ['js', 'ts', 'json'],
  testEnvironment: 'node',
  testMatch: ['**/*.test.ts'],
+  extensionsToTreatAsEsm: ['.ts'],
  transform: {
-    '^.+\\.ts$': 'ts-jest'
+    '^.+\\.ts$': ['ts-jest', { useESM: true }]
  },
  reporters: [
    'default',
-      '@gradle-tech/develocity-agent/jest-reporter',
+    develocityReporter
  ],
  verbose: true
 }
--- a/sources/package-lock.json
+++ b/sources/package-lock.json
--- a/sources/package.json
+++ b/sources/package.json
@@ -2,21 +2,22 @@
  "name": "gradle-actions",
  "version": "1.0.0",
  "private": true,
+  "type": "module",
  "description": "Execute Gradle Build",
  "scripts": {
    "postinstall": "patch-package",
    "prettier-write": "prettier --write 'src/**/*.ts'",
    "prettier-check": "prettier --check 'src/**/*.ts'",
    "lint": "eslint 'src/**/*.ts'",
-    "compile-dependency-submission-main": "ncc build src/actions/dependency-submission/main.ts --out dist/dependency-submission/main --source-map --no-source-map-register",
-    "compile-dependency-submission-post": "ncc build src/actions/dependency-submission/post.ts --out dist/dependency-submission/post --source-map --no-source-map-register",
-    "compile-setup-gradle-main": "ncc build src/actions/setup-gradle/main.ts --out dist/setup-gradle/main --source-map --no-source-map-register",
-    "compile-setup-gradle-post": "ncc build src/actions/setup-gradle/post.ts --out dist/setup-gradle/post --source-map --no-source-map-register",
-    "compile-wrapper-validation-main": "ncc build src/actions/wrapper-validation/main.ts --out dist/wrapper-validation/main --source-map --no-source-map-register",
+    "compile-dependency-submission-main": "esbuild src/actions/dependency-submission/main.ts --bundle --platform=node --target=node24 --format=esm --banner:js=\"import {createRequire} from 'module';const require=createRequire(import.meta.url);\" --outfile=dist/dependency-submission/main/index.js --sourcemap --minify",
+    "compile-dependency-submission-post": "esbuild src/actions/dependency-submission/post.ts --bundle --platform=node --target=node24 --format=esm --banner:js=\"import {createRequire} from 'module';const require=createRequire(import.meta.url);\" --outfile=dist/dependency-submission/post/index.js --sourcemap --minify",
+    "compile-setup-gradle-main": "esbuild src/actions/setup-gradle/main.ts --bundle --platform=node --target=node24 --format=esm --banner:js=\"import {createRequire} from 'module';const require=createRequire(import.meta.url);\" --outfile=dist/setup-gradle/main/index.js --sourcemap --minify",
+    "compile-setup-gradle-post": "esbuild src/actions/setup-gradle/post.ts --bundle --platform=node --target=node24 --format=esm --banner:js=\"import {createRequire} from 'module';const require=createRequire(import.meta.url);\" --outfile=dist/setup-gradle/post/index.js --sourcemap --minify",
+    "compile-wrapper-validation-main": "esbuild src/actions/wrapper-validation/main.ts --bundle --platform=node --target=node24 --format=esm --banner:js=\"import {createRequire} from 'module';const require=createRequire(import.meta.url);\" --outfile=dist/wrapper-validation/main/index.js --sourcemap --minify",
    "compile": "npm-run-all --parallel compile-*",
    "check": "npm-run-all --parallel prettier-check lint",
    "format": "npm-run-all --parallel prettier-write lint",
-    "test": "jest",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
    "build": "npm run format && npm run compile",
    "all": "npm run build && npm test"
  },
@@ -35,39 +36,38 @@
    "node": ">=24.0.0"
  },
  "dependencies": {
-    "@actions/artifact": "4.0.0",
+    "@actions/artifact": "6.1.0",
    "@actions/cache": "4.0.5",
-    "@actions/core": "2.0.2",
-    "@actions/exec": "2.0.0",
-    "@actions/github": "7.0.0",
-    "@actions/glob": "0.5.0",
-    "@actions/http-client": "3.0.1",
-    "@actions/tool-cache": "3.0.0",
+    "@actions/core": "3.0.0",
+    "@actions/exec": "3.0.0",
+    "@actions/github": "9.0.0",
+    "@actions/glob": "0.6.1",
+    "@actions/http-client": "4.0.0",
+    "@actions/tool-cache": "4.0.0",
    "@octokit/webhooks-types": "7.6.1",
-    "cheerio": "1.1.2",
-    "semver": "7.7.3",
+    "cheerio": "1.2.0",
+    "semver": "7.7.4",
    "string-argv": "0.3.2",
    "unhomoglyph": "1.0.6",
-    "which": "6.0.0"
+    "which": "6.0.1"
  },
  "devDependencies": {
-    "@gradle-tech/develocity-agent": "3.0.1",
    "@jest/globals": "30.2.0",
    "@types/jest": "30.0.0",
-    "@types/node": "25.0.9",
+    "@types/node": "25.3.0",
    "@types/semver": "7.7.1",
    "@types/unzipper": "0.10.11",
    "@types/which": "3.0.4",
-    "@typescript-eslint/eslint-plugin": "8.53.0",
-    "@vercel/ncc": "0.38.4",
+    "@typescript-eslint/eslint-plugin": "8.56.1",
    "dedent": "1.7.1",
-    "eslint": "9.24.0",
-    "globals": "17.0.0",
+    "esbuild": "0.27.3",
+    "eslint": "10.0.1",
+    "globals": "17.3.0",
    "jest": "30.2.0",
    "nock": "15.0.0",
    "npm-run-all": "4.1.5",
    "patch-package": "8.0.1",
-    "prettier": "3.8.0",
+    "prettier": "3.8.1",
    "ts-jest": "29.4.6",
    "typescript": "5.9.3"
  },
--- a/sources/src/caching/cache-reporting.ts
+++ b/sources/src/caching/cache-reporting.ts
@@ -4,9 +4,9 @@ export const DEFAULT_CACHE_ENABLED_REASON = `[Cache was enabled](https://github.

 export const DEFAULT_READONLY_REASON = `[Cache was read-only](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#using-the-cache-read-only). By default, the action will only write to the cache for Jobs running on the default branch.`

-export const DEFAULT_DISABLED_REASON = `[Cache was disabled](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#disabling-caching) via action configuration. Gradle User Home was not restored from or saved to the cache.`
+export const DEFAULT_DISABLED_REASON = `[Cache was disabled](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#disabling-caching). Gradle User Home was not restored from or saved to the cache.`

-export const DEFAULT_WRITEONLY_REASON = `[Cache was set to write-only](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#using-the-cache-write-only) via action configuration. Gradle User Home was not restored from cache.`
+export const DEFAULT_WRITEONLY_REASON = `[Cache was set to write-only](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#using-the-cache-write-only). Gradle User Home was not restored from cache.`

 export const EXISTING_GRADLE_HOME = `[Cache was disabled to avoid overwriting a pre-existing Gradle User Home](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#overwriting-an-existing-gradle-user-home). Gradle User Home was not restored from or saved to the cache.`

--- a/sources/src/caching/gradle-user-home-utils.ts
+++ b/sources/src/caching/gradle-user-home-utils.ts
@@ -1,9 +1,11 @@
 import path from 'path'
 import fs from 'fs'
+import {fileURLToPath} from 'url'

 export function readResourceFileAsString(...paths: string[]): string {
    // Resolving relative to __dirname will allow node to find the resource at runtime
-    const absolutePath = path.resolve(__dirname, '..', '..', '..', 'sources', 'src', 'resources', ...paths)
+    const moduleDir = path.dirname(fileURLToPath(import.meta.url))
+    const absolutePath = path.resolve(moduleDir, '..', '..', '..', 'sources', 'src', 'resources', ...paths)
    return fs.readFileSync(absolutePath, 'utf8')
 }

--- a/sources/src/configuration.ts
+++ b/sources/src/configuration.ts
@@ -2,11 +2,11 @@ import * as core from '@actions/core'
 import * as github from '@actions/github'
 import * as cache from '@actions/cache'
 import * as deprecator from './deprecation-collector'
-import {SUMMARY_ENV_VAR} from '@actions/core/lib/summary'

-import path from 'path'
+import * as path from 'path'

 const ACTION_ID_VAR = 'GRADLE_ACTION_ID'
+const SUMMARY_ENV_VAR = 'GITHUB_STEP_SUMMARY'

 export const ACTION_METADATA_DIR = '.setup-gradle'

--- a/sources/src/develocity/build-scan.ts
+++ b/sources/src/develocity/build-scan.ts
@@ -34,7 +34,7 @@ export async function setup(config: BuildScanConfig): Promise<void> {
    // except if they are defined in the configuration
    if (config.getBuildScanPublishEnabled()) {
        maybeExportVariable('DEVELOCITY_INJECTION_ENABLED', 'true')
-        maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.3.1')
+        maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.3.2')
        maybeExportVariable('DEVELOCITY_INJECTION_CCUD_PLUGIN_VERSION', '2.1')
        maybeExportVariable('DEVELOCITY_INJECTION_TERMS_OF_USE_URL', config.getBuildScanTermsOfUseUrl())
        maybeExportVariable('DEVELOCITY_INJECTION_TERMS_OF_USE_AGREE', config.getBuildScanTermsOfUseAgree())
--- a/sources/src/wrapper-validation/wrapper-checksums.json
+++ b/sources/src/wrapper-validation/wrapper-checksums.json
@@ -1,4 +1,24 @@
 [
+  {
+    "version": "9.5.0-milestone-3",
+    "checksum": "55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c"
+  },
+  {
+    "version": "9.5.0-milestone-2",
+    "checksum": "55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c"
+  },
+  {
+    "version": "9.4.0-rc-1",
+    "checksum": "55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c"
+  },
+  {
+    "version": "9.3.1",
+    "checksum": "b3a875ddc1f044746e1b1a55f645584505f4a10438c1afea9f15e92a7c42ec13"
+  },
+  {
+    "version": "9.5.0-milestone-1",
+    "checksum": "55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c"
+  },
  {
    "version": "8.14.4",
    "checksum": "7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172"
--- a/sources/test/init-scripts/build.gradle
+++ b/sources/test/init-scripts/build.gradle
@@ -20,7 +20,7 @@ dependencies {
    testImplementation ('io.ratpack:ratpack-groovy-test:1.9.0') {
        exclude group: 'org.codehaus.groovy', module: 'groovy-all'
    }
-    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.21.0'
+    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.21.1'

    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
 }
--- a/sources/test/init-scripts/gradle/wrapper/gradle-wrapper.properties
+++ b/sources/test/init-scripts/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=0d585f69da091fc5b2beced877feab55a3064d43b8a1d46aeb07996b0915e0e0
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionSha256Sum=b266d5ff6b90eada6dc3b20cb090e3731302e553a27c5d3e4df1f0d76beaff06
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/sources/test/init-scripts/settings.gradle
+++ b/sources/test/init-scripts/settings.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "4.3.1"
+    id "com.gradle.develocity" version "4.3.2"
    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.4.0"
 }

--- a/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy
+++ b/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy
@@ -16,7 +16,7 @@ import java.nio.file.Files
 import java.util.zip.GZIPOutputStream

 class BaseInitScriptTest extends Specification {
-    static final String DEVELOCITY_PLUGIN_VERSION = '4.3.1'
+    static final String DEVELOCITY_PLUGIN_VERSION = '4.3.2'
    static final String CCUD_PLUGIN_VERSION = '2.1'

    static final TestGradleVersion GRADLE_4_X = new TestGradleVersion(GradleVersion.version('4.10.3'), 7, 10)
--- a/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy
+++ b/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy
@@ -248,7 +248,7 @@ task expectFailure {
        when:
        settingsFile.text = """
            plugins {
-                id 'com.gradle.develocity' version '4.3.1' apply(false)
+                id 'com.gradle.develocity' version '4.3.2' apply(false)
            }
            gradle.settingsEvaluated {
                apply plugin: 'com.gradle.develocity'
--- a/sources/test/jest/short-lived-token.test.ts
+++ b/sources/test/jest/short-lived-token.test.ts
@@ -31,30 +31,6 @@ describe('short lived tokens', () => {
        expect(develocityAccessCredentials?.raw()).toBe('host1=key1;host2=key2')
    })

-    it('get short lived token fails when cannot connect', async () => {
-        nock('http://localhost:3333')
-            .post('/api/auth/token')
-            .times(3)
-            .replyWithError({
-                message: 'connect ECONNREFUSED 127.0.0.1:3333',
-                code: 'ECONNREFUSED'
-            })
-        await expect(getToken('localhost=key0', false, ''))
-            .resolves
-            .toBeNull()
-    })
-
-    it('get short lived token is null when request fails', async () => {
-        nock('http://dev:3333')
-            .post('/api/auth/token')
-            .times(3)
-            .reply(500, 'Internal error')
-        expect.assertions(1)
-        await expect(getToken('dev=xyz', false, ''))
-            .resolves
-            .toBeNull()
-    })
-
    it('get short lived token returns null when access key is empty', async () => {
        expect.assertions(1)
        await expect(getToken('', false, ''))
@@ -127,3 +103,34 @@ describe('short lived tokens', () => {
            .toEqual({"keys": [{"hostname": "dev", "key": "token"}]})
    })
 })
+
+describe('short lived tokens with retry', () => {
+    afterEach(() => {
+        nock.cleanAll()
+        nock.restore()
+    })
+
+    it('get short lived token fails when cannot connect', async () => {
+        nock('http://localhost:3333')
+            .post('/api/auth/token')
+            .times(3)
+            .replyWithError({
+                message: 'connect ECONNREFUSED 127.0.0.1:3333',
+                code: 'ECONNREFUSED'
+            })
+        await expect(getToken('localhost=key0', false, ''))
+            .resolves
+            .toBeNull()
+    })
+
+    it('get short lived token is null when request fails', async () => {
+        nock('http://dev:3333')
+            .post('/api/auth/token')
+            .times(3)
+            .reply(500, 'Internal error')
+        expect.assertions(1)
+        await expect(getToken('dev=xyz', false, ''))
+            .resolves
+            .toBeNull()
+    })
+})
--- a/sources/test/jest/wrapper-validation/checksums.test.ts
+++ b/sources/test/jest/wrapper-validation/checksums.test.ts
@@ -58,6 +58,7 @@ test('fetches wrapper jar checksums for snapshots', async () => {
 describe('retry', () => {
  afterEach(() => {
    nock.cleanAll()
+    nock.restore()
  })

  describe('for /versions/all API', () => {
--- a/sources/tsconfig.json
+++ b/sources/tsconfig.json
@@ -3,7 +3,7 @@
    /* Basic Options */
    "incremental": false,                     /* Enable incremental compilation */
    "target": "es2021",                       /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    "module": "ESNext",                       /* Emit ESM so source aligns with package "type": "module". */
    // "allowJs": true,                       /* Allow javascript files to be compiled. */
    // "checkJs": true,                       /* Report errors in .js files. */
    // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
@@ -38,7 +38,7 @@
    "noFallthroughCasesInSwitch": true,       /* Report errors for fallthrough cases in switch statement. */

    /* Module Resolution Options */
-    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
+    "moduleResolution": "bundler",            /* Use bundler-friendly resolution to avoid requiring file extensions in TS imports. */
    // "baseUrl": "./",                       /* Base directory to resolve non-absolute module names. */
    // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
    // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */