ci: upgrade GitHub Actions and fix Dependabot yarn.lock alerts

.github/workflows/ci.yml

@@ -44,14 +44,16 @@ jobs:
     # 6-hour default; generous over the real ~few-minute runtime.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           # Matches the module's jvmToolchain(21); running Gradle on 21 means no separate
           # toolchain JDK has to be provisioned (there is no foojay resolver configured).
           distribution: corretto
           java-version: '21'
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
       # Restore the Kotlin/Native toolchain (~1 GB: compiler bundle + LLVM/sysroot/gcc deps under
       # ~/.konan). setup-gradle caches ~/.gradle but not ~/.konan, and apiCheck's KLIB ABI validation
       # compiles every native klib here, so without this the whole bundle re-downloads each run.
@@ -112,12 +114,14 @@ jobs:
     # real runtime so only a genuine hang trips the limit.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           distribution: corretto
           java-version: '21'
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
       # Gradle's configuration cache lives in the checkout (.gradle/configuration-cache), not
       # GRADLE_USER_HOME, so setup-gradle's default cache never covers it (see the `native` job
       # for the full rationale). Scoped `-web-` since this job's task set (jsTest/wasmJsTest)
@@ -190,12 +194,14 @@ jobs:
               watchosArm64TestBinaries
               klibApiCheck
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           distribution: corretto
           java-version: '21'
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
       # Restore the Kotlin/Native toolchain (~1 GB under ~/.konan) that this native job compiles and
       # links against; setup-gradle caches ~/.gradle but not ~/.konan. runner.os in the key keeps the
       # Linux/Windows/macOS legs separate, and the `-native-` scope keeps the Linux leg's smaller
@@ -251,12 +257,14 @@ jobs:
     # Host-side JVM tests; same generous bound as the other Linux JVM job.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           distribution: corretto
           java-version: '21'
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
       - name: Android host (JVM) unit tests
         # Runs commonTest compiled for the Android target on the JVM — no emulator.
         run: ./gradlew :kuri:testAndroidHostTest --stacktrace
@@ -268,12 +276,14 @@ jobs:
     # wedged or never-booting emulator fails fast instead of hanging to the 6-hour default.
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           distribution: corretto
           java-version: '21'
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
       # Hardware acceleration for the emulator; required for a reliable boot on hosted runners.
       - name: Enable KVM
         run: |

.github/workflows/codeql.yml

@@ -41,13 +41,15 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           # Match the CI jobs: Gradle runs on Corretto 21 (the module's jvmToolchain(21)).
           distribution: corretto
           java-version: '21'
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
 
       # Initialise the CodeQL tracer BEFORE the build so the Kotlin/Java compilation is extracted.
       # 'java' is CodeQL's identifier for the Java/Kotlin extractor (it analyses Kotlin too).

.github/workflows/commit-convention.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       # Check out the BASE branch (not the PR head) so the validator script cannot be weakened by the
       # PR under review. The PR title itself comes from the event payload, not the checkout.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.base_ref }}
       - name: Validate the PR title
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Validate the HEAD commit message
         run: |
           git log -1 --pretty=%B > "$RUNNER_TEMP/message.txt"

.github/workflows/publish.yml

@@ -34,16 +34,18 @@ jobs:
       # Optional release notification. Empty (secret unset) => the notify step is skipped, not failed.
       RELEASE_WEBHOOK_URL: ${{ secrets.RELEASE_WEBHOOK_URL }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: corretto
           java-version: '21'
       # The Android target's publication needs an SDK (compileSdk 35) at build time.
       - uses: android-actions/setup-android@v3
-      - uses: gradle/actions/setup-gradle@v4
+      # Default (Enhanced Caching, gradle-actions-caching): free for public repos, no extra config
+      # needed, and it caches GRADLE_USER_HOME (dependencies, wrapper distributions, build cache).
+      - uses: gradle/actions/setup-gradle@v6
 
       - name: Resolve version
         id: version
@@ -134,7 +136,7 @@ jobs:
     timeout-minutes: 35
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
       - name: Resolve version

build.gradle.kts

@@ -1,3 +1,6 @@
+import org.jetbrains.kotlin.gradle.targets.js.yarn.YarnPlugin
+import org.jetbrains.kotlin.gradle.targets.js.yarn.YarnRootExtension
+
 plugins {
     alias(libs.plugins.kotlin.multiplatform) apply false
     alias(libs.plugins.android.kmp.library) apply false
@@ -7,6 +10,19 @@ plugins {
     alias(libs.plugins.binary.compat) apply false
 }
 
+// kotlin-js-store/yarn.lock pins whatever transitive versions this Kotlin/JS Gradle plugin release
+// declares for its bundled browser-test tooling (mocha/karma/webpack); those versions aren't otherwise
+// reachable from this build script, and a KGP bump is too heavy a lever for a single vulnerable
+// transitive dep. Force Yarn's resolution field for each dependency Dependabot flagged, to their first
+// patched release, until a future KGP upgrade moves the plugin's own defaults past them.
+rootProject.plugins.withType<YarnPlugin>().configureEach {
+    rootProject.extensions.configure<YarnRootExtension> {
+        resolution("webpack", "5.104.1")
+        resolution("serialize-javascript", "7.0.5")
+        resolution("diff", "8.0.3")
+    }
+}
+
 // --- Fixture & lookup-table code generation ----------------------------------
 // Thin Gradle wrappers over the Go code generators under tools/, so every fixture and lookup
 // table regenerates via `./gradlew` rather than invoking the Go tool by hand. Each task runs the