From c8812faa1368ec1a139748263935994c399b74e8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Nov 2026 04:55:13 +0000
Subject: [PATCH] build(deps): Bump the gh-actions group with 3 updates

Bumps the gh-actions group with 3 updates: [gradle/actions/wrapper-validation](https://github.com/gradle/actions), [gradle/actions/setup-gradle](https://github.com/gradle/actions) and [sonarsource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action).


Updates `gradle/actions/wrapper-validation` from 6.4.0 to 6.4.1
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](https://github.com/gradle/actions/compare/3f5f9adaf7d9fecd50b5935e54106014257a94e6...8da46b539cd8fe6ab27ca75128919a18d757604c)

Updates `gradle/actions/setup-gradle` from 6.4.0 to 6.4.1
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](https://github.com/gradle/actions/compare/3f5f9adaf7d9fecd50b5935e54106014257a94e6...8da46b539cd8fe6ab27ca75128919a18d757604c)

Updates `sonarsource/sonarqube-scan-action` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/d209202bc7d53ff1cc128f7f907dac145c9d6ae9...4d1dc0c91ee400dcf8a6dddf2f705ac36542e304)

---
updated-dependencies:
- dependency-name: gradle/actions/wrapper-validation
  dependency-version: 6.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
- dependency-name: sonarsource/sonarqube-scan-action
  dependency-version: 8.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml             | 10 +++++-----
 .github/workflows/manual-release.yml |  2 +-
 .github/workflows/release.yml        |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bfabdc7..ed99822 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,10 +31,10 @@ jobs:
       # Verify gradle-wrapper.jar matches a known-good Gradle release checksum before it
       # is executed — guards against a tampered wrapper jar (a classic build-time backdoor).
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       # The persistence integration suites self-skip when PKAUTH_SKIP_TESTCONTAINERS=1. The CI
       # gate must exercise them against real Postgres/DynamoDB Local, so fail loudly if that
@@ -87,7 +87,7 @@ jobs:
         # runs — skip in both cases so the scan doesn't hard-fail without a token. Manual
         # (workflow_dispatch) and push runs always have the secret available.
         if: github.actor != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: sonarsource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        uses: sonarsource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
@@ -160,10 +160,10 @@ jobs:
       # The e2eTest task executes the wrapper jar (directly and again nested, when Playwright boots
       # the demo via the Gradle `run` task) — validate it for the same reason the build job does.
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Run ${{ matrix.demo }} e2e
         run: ./gradlew :examples:${{ matrix.demo }}:e2eTest --stacktrace
diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml
index 4cac613..40c4a47 100644
--- a/.github/workflows/manual-release.yml
+++ b/.github/workflows/manual-release.yml
@@ -62,7 +62,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Verify version matches tag
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 09db8f2..68cd432 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Verify version matches tag
         run: |