build(deps): bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: gradle/actions, docker/login-action and SonarSource/sonarqube-scan-action.

Updates gradle/actions from 5.0.2 to 6.1.0

Release notes

Sourced from gradle/actions's releases.

v6.1.0

New: Basic Cache Provider

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

• Built on @actions/cache -- fully open source
• Caches ~/.gradle/caches and ~/.gradle/wrapper directories
• Cache key derived from build files (*.gradle*, gradle-wrapper.properties, etc.)
• Clean cache on build file changes (no restore keys, preventing stale entry accumulation)

Limitations vs Enhanced Caching: No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.

Revamped Licensing & Distribution Documentation

• New DISTRIBUTION.md documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)
• Simplified licensing notices in README, docs, and runtime log output
• Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos

What's Changed

• Use a unique cache entry for wrapper-validation test by @​bigdaz in gradle/actions#921
• Update Dependencies by @​bigdaz in gradle/actions#922
• Update dependencies and resolve npm vulnerabilities by @​bigdaz in gradle/actions#933
• Add open-source 'basic' cache provider and revamp licensing documentation by @​bigdaz in gradle/actions#930
• Restructure caching documentation for basic and enhanced providers by @​bigdaz in gradle/actions#934

Full Changelog: gradle/actions@v6.0.1...v6.1.0

v6.0.1

[!IMPORTANT] The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post. TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

The license changes in v6 introduced a gradle-actions-caching license notice that is printed in logs and in each job summary.

With this release, the license notice will be muted if build-scan terms have been accepted, or if a Develocity access key is provided.

What's Changed

• Bump actions used in docs by @​Goooler in gradle/actions#792
• Add typing information for use by typesafegithub by @​bigdaz in gradle/actions#910
• Mute license warning when terms are accepted by @​bigdaz in gradle/actions#911
• Mention explicit license acceptance in notice by @​bigdaz in gradle/actions#912
• Bump com.fasterxml.jackson.dataformat:jackson-dataformat-smile from 2.21.1 to 2.21.2 in /sources/test/init-scripts in the gradle group across 1 directory by @​dependabot[bot] in gradle/actions#907

Full Changelog: gradle/actions@v6.0.0...v6.0.1

v6.0.0

[!IMPORTANT]

... (truncated)

Commits

• 50e97c2 Link to docs for caching providers
• f2e6298 Restructure caching documentation for basic and enhanced providers (#934)
• b294b1e Really fix integ-test-full
• 83d3189 Revise license details for gradle-actions-caching
• 1d5db06 Update license link for gradle-actions-caching component
• 1c80961 Fix license link for Enhanced Caching component
• 9e99920 Fix integ-test-full workflow
• bb8aaaf Fix workflow permissions
• f5dfb43 [bot] Update dist directory
• ff9ae24 Add open-source 'basic' cache provider and revamp licensing documentation (#930)
• Additional commits viewable in compare view

Updates docker/login-action from 4.0.0 to 4.1.0

Release notes

Sourced from docker/login-action's releases.

v4.1.0

• Fix scoped Docker Hub cleanup path when registry is omitted by @​crazy-max in docker/login-action#945
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930
• Bump @​docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936
• Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952
• Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942
• Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944
• Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940
• Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949
• Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937
• Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958
• Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941
• Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948
• Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

Commits

• 4907a6d Merge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
• 1e233e6 chore: update generated content
• 6c24ead build(deps): bump the aws-sdk-dependencies group with 2 updates
• ee034d7 Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.1
• 1527209 Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
• d39362a build(deps): bump lodash from 4.17.23 to 4.18.1
• a6f092b chore: update generated content
• 60953f0 build(deps): bump the proxy-agent-dependencies group with 2 updates
• 62c6885 Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 102c0e6 chore: update generated content
• Additional commits viewable in compare view

Updates SonarSource/sonarqube-scan-action from 7.0.0 to 7.1.0

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v7.1.0

What's Changed

• SQSCANGHA-128 NO-JIRA Bump actions/cache from 4 to 5 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#219
• SQSCANGHA-130 Bump rollup from 4.50.1 to 4.59.0 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#221
• SQSCANGHA-131 Bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#223
• SQSCANGHA-132 Upgrade Node to 24 by @​claire-villard-sonarsource in SonarSource/sonarqube-scan-action#224

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.1.0

Commits

• 299e4b7 SQSCANGHA-132 Upgrade Node to 24 (#224)
• 3988e54 SQSCANGHA-131 Bump picomatch from 4.0.3 to 4.0.4 (#223)
• 9598b8a SQSCANGHA-130 Bump rollup from 4.50.1 to 4.59.0 (#221)
• dcc5211 SQSCANGHA-128 NO-JIRA Bump actions/cache from 4 to 5 (#219)
• b9f37f9 SQSCANGHA-129 Fix the Analysis Processing team name in CODEOWNERS (#220)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions