chore(deps): bump the github-actions group with 5 updates

[dependabot]

Bumps the github-actions group with 5 updates:

Package	From	To
subosito/flutter-action	2.21.0	2.23.0
reactivecircus/android-emulator-runner	2.35.0	2.37.0
dart-lang/setup-dart	1.7.0	1.7.2
futureware-tech/simulator-action	4	5
actions/cache	5.0.3	5.0.4

Updates subosito/flutter-action from 2.21.0 to 2.23.0

Release notes

Sourced from subosito/flutter-action's releases.

v2.23.0

What's Changed

• feat: fvm support by @​pedroafmonteiro in subosito/flutter-action#383
• Add separate pub-cache boolean flag by @​kuhnroyal in subosito/flutter-action#377
• chores by @​bartekpacia in subosito/flutter-action#390
• add a CI job that checks out a specific master commit by @​bartekpacia in subosito/flutter-action#391
• readme: minor updates by @​bartekpacia in subosito/flutter-action#392
• Simplify extraction of zip files by @​kuhnroyal in subosito/flutter-action#379

New Contributors

• @​pedroafmonteiro made their first contribution in subosito/flutter-action#383

Full Changelog: subosito/flutter-action@v2...v2.23.0

v2.22.0

What's Changed

• Upgrade actions/cache to v5 by @​Azincc in subosito/flutter-action#385
• Remove macos-13 (Intel) runner from CI by @​bartekpacia in subosito/flutter-action#388

New Contributors

• @​Azincc made their first contribution in subosito/flutter-action#385

Full Changelog: subosito/flutter-action@v2...v2.22.0

Commits

• 1a44944 Simplify extraction of zip files (#379)
• 4efee11 readme: minor updates (#392)
• d97c38e add a CI job that checks out a specific master commit (#391)
• 75b905c chores (#390)
• 7ff07e9 Add separate pub-cache boolean flag (#377)
• 6622f58 feat: fvm support (#383)
• 0ca7a94 Remove macos-13 (Intel) runner from CI (#388)
• de04a6a Upgrade actions/cache to v5 (#385)
• See full diff in compare view

Updates reactivecircus/android-emulator-runner from 2.35.0 to 2.37.0

Release notes

Sourced from reactivecircus/android-emulator-runner's releases.

v2.37.0

What's Changed

• Modernize test-fixture project. by @​ychescale9 in ReactiveCircus/android-emulator-runner#465
• Update to Node 24. by @​ychescale9 in ReactiveCircus/android-emulator-runner#466
• SDK build tools 36.0.0, SDK command-line tools 12.0. by @​ychescale9 in ReactiveCircus/android-emulator-runner#467

Full Changelog: ReactiveCircus/android-emulator-runner@v2.36.0...v2.37.0

v2.36.0

What's Changed

• Add Compose Unstyled to the list of users by @​alexstyl in ReactiveCircus/android-emulator-runner#457
• Replace deprecated macos-13 runner with macos-15-intel. by @​ychescale9 in ReactiveCircus/android-emulator-runner#460
• fix: remove problematic / unneeded --abi option in avd creation by @​mikehardy in ReactiveCircus/android-emulator-runner#456
• Add F3D in the list of projects by @​Meakk in ReactiveCircus/android-emulator-runner#462

New Contributors

• @​alexstyl made their first contribution in ReactiveCircus/android-emulator-runner#457
• @​Meakk made their first contribution in ReactiveCircus/android-emulator-runner#462

Full Changelog: ReactiveCircus/android-emulator-runner@v2.35.0...v2.36.0

Changelog

Sourced from reactivecircus/android-emulator-runner's changelog.

Change Log

Unreleased

v2.37.0

• Update SDK build tools to 36.0.0, update SDK command-line tools to 20.0. - #467
• Run action on Node 24. - #466
• Update Node and npm packages. - #466

v2.36.0

• Remove --abi option to better support 16-KB-based system images (#456).

v2.35.0

• Optimize config.ini updates and efficiency improvements report (#436).
• Fix pre-emulator-launch-script (#439).
• Allow google_apis_ps16k as a valid target (#440).

v2.34.0

• Allow arbitrary value for api-level such as Baklava and 35-ext15. - 428
• Add option to specify system-image-api-level to use a system image with a different API level than the platform. - 428
• Support automotive and desktop targets: android-automotive, android-automotive-playstore, android-desktop. - 428

v2.33.0

• Fix missing AVD directory in ubuntu-24.04 runner. - 415
• Update SDK build tools to 35.0.0, update SDK command-line tools to 16.0. - #356
• Stop changing owner of the SDK directory. - 406 #409
• Upgrade to latest npm dependencies. - #401

v2.32.0

• Add port parameter for customizing the emulator port to use. - #383

v2.31.0

• Support setting VanillaIceCream as api-level. - #378
• Install platforms for the specified api-level. - #384

v2.30.1

• Run action on Node 20. - #371

v2.30.0

... (truncated)

Commits

• e89f39f Merge branch 'main' into release/v2
• 9644b1a Prepare for release 2.37.0.
• 4fe4b1a Build build tools 36.0.0, SDK command-line tools 12.0. (#467)
• 6fe36e1 Update to Node 24. (#466)
• 597aa7c Modernize test-fixture project. (#465)
• 5d6e86d Merge branch 'main' into release/v2
• 38164a2 Prepare for release 2.36.0.
• 969c989 Add F3D in the list of projects (#462)
• 29b35ed fix: remove problematic / unneeded --abi option in avd creation (#456)
• 001613e Replace deprecated macos-13 runner with macos-15-intel. (#460)
• Additional commits viewable in compare view

Updates dart-lang/setup-dart from 1.7.0 to 1.7.2

Release notes

Sourced from dart-lang/setup-dart's releases.

v1.7.2

• Update Node.js requirement to Node 24.
• Fix open Dependabot alerts by bumping undici to >=6.24.0.
• Update GitHub Action dependencies (@actions/core, @actions/exec, @actions/tool-cache, @actions/http-client).
• Update workflow actions to their latest versions (actions/checkout v6, setup-flutter).

v1.7.1

• Roll undici dependency to address CVE-2025-22150.
• Update to the latest npm dependencies.
• Recompile the action using the new Dart / JavaScript interop.

Changelog

Sourced from dart-lang/setup-dart's changelog.

v1.7.2

• Update Node.js requirement to Node 24.
• Fix open Dependabot alerts by bumping undici to >=6.24.0.
• Update GitHub Action dependencies (@actions/core, @actions/exec, @actions/tool-cache, @actions/http-client).
• Update workflow actions to their latest versions (actions/checkout v6, setup-flutter).

v1.7.1

• Roll undici dependency to address CVE-2025-22150.
• Update to the latest npm dependencies.
• Recompile the action using the new Dart / JavaScript interop.

v1.7.0

• Install flutter sdk in publishing step, allowing Flutter packages to be published (#68[])

  #68: dart-lang/setup-dart#68

v1.6.5

• Fix zip path handling on Windows 11 (#118[])

#118: dart-lang/setup-dart#118

v1.6.4

• Rebuild JS code.

v1.6.3

• Roll undici dependency to address CVE-2024-30260 and CVE-2024-30261.

v1.6.2

• Switch to running the workflow on node20`` from node16`. See also Transitioning from Node 16 to Node 20.

v1.6.1

• Updated the google storage url for main channel releases.

... (truncated)

Commits

• 65eb853 chore: prepare v1.7.2 release (#175)
• 6e0ff0b Node 24 (#174)
• 03a180d Group npm dependency updates (#172)
• 74195ec Bump @​actions/exec from 1.1.1 to 3.0.0 (#167)
• 41705c9 Bump @​actions/core from 1.11.1 to 3.0.0 (#168)
• dd42013 Bump @​actions/tool-cache from 2.0.2 to 4.0.0 (#169)
• b36cb5e Bump @​actions/http-client from 3.0.0 to 4.0.0 (#170)
• 21e68f4 Bump actions/checkout from 5 to 6 in the github-actions group (#162)
• 0bdb602 Bump @​actions/http-client from 2.2.3 to 3.0.0 (#160)
• daef289 Bump flutter-actions/setup-flutter in the github-actions group (#159)
• Additional commits viewable in compare view

Updates futureware-tech/simulator-action from 4 to 5

Release notes

Sourced from futureware-tech/simulator-action's releases.

v5

• Fix flaky boot issues by adding a retry parameter (#563).
• Print stdout/stderr even if the command fails (#562).

Changelog

Sourced from futureware-tech/simulator-action's changelog.

v5

• Fix flaky boot issues by adding a retry parameter (#563).
• Print stdout/stderr even if the command fails (#562).

v4

• Add a wait_for_boot option (default false, preserving current behavior) to wait for Simulator to finish booting the requested image before continuing.

v3

• Breaking: change the default simulator from "model = iPhone 8" to "os = iOS", to avoid re-releasing the action each time the current model gets outdated.
• Bump NodeJS to 20.

v2

• Update a few packages for security reasons.
• Bump NodeJS to 16 (#249).

v1

• Initial release.

Commits

• e89aa8f Merge pull request #565 from futureware-tech/v5
• 477bd6a Release v5
• f93dbb7 Bump eslint to 10.x
• ebb69a2 Update dependabot settings from template
• 6a2cef2 Merge pull request #563 from nilsreichardt/fix-boot-issue
• 1833a2e Merge branch 'main' into fix-boot-issue
• 759066b Merge pull request #562 from futureware-tech/logging
• a7ad1bf Fix boot timeout
• e163eaf Add EOL in package-lock.json
• 32fbe00 Use package-lock.json from main
• Additional commits viewable in compare view

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

• Add release instructions and update maintainer docs by @​Link- in actions/cache#1696
• Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @​Link- in actions/cache#1697
• Fix workflow permissions and cleanup workflow names / formatting by @​Link- in actions/cache#1699
• docs: Update examples to use the latest version by @​XZTDean in actions/cache#1690
• Fix proxy integration tests by @​Link- in actions/cache#1701
• Fix cache key in examples.md for bun.lock by @​RyPeck in actions/cache#1722
• Update dependencies & patch security vulnerabilities by @​Link- in actions/cache#1738

New Contributors

• @​XZTDean made their first contribution in actions/cache#1690
• @​RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

• Bump @actions/cache to v5.0.3 #1692

5.0.1

• Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

• 6682284 Merge pull request #1738 from actions/prepare-v5.0.4
• e340396 Update RELEASES
• 8a67110 Add licenses
• 1865903 Update dependencies & patch security vulnerabilities
• 5656298 Merge pull request #1722 from RyPeck/patch-1
• 4e380d1 Fix cache key in examples.md for bun.lock
• b7e8d49 Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests
• 984a21b Add traffic sanity check step
• acf2f1f Fix resolution
• 95a07c5 Add wait for proxy
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

PR Health

Changelog Entry ✔️

Package	Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.

Coverage ✔️

File	Coverage

This check for test coverage is informational (issues shown here will not fail the PR).

This check can be disabled by tagging the PR with skip-coverage-check.

Unused Dependencies ✔️

Package	Status
None	No packages found to check.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

Breaking changes ✔️

Package	Change	Current Version	New Version	Needed Version	Looking good?

This check can be disabled by tagging the PR with skip-breaking-check.

API leaks ✔️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package	Leaked API symbol	Leaking sources

This check can be disabled by tagging the PR with skip-leaking-check.

License Headers ✔️

""

Files
no missing headers

All source files should start with a license header.

Unrelated files missing license headers

Files
pkgs/cupertino_http/example/example.dart
pkgs/http/example/main.dart
pkgs/http_multi_server/test/cert.dart

This check can be disabled by tagging the PR with skip-license-check.

[github-actions]

PR Health

Changelog Entry ✔️

Package	Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.

Coverage ✔️

File	Coverage

This check for test coverage is informational (issues shown here will not fail the PR).

This check can be disabled by tagging the PR with skip-coverage-check.

Unused Dependencies ✔️

Package	Status
None	No packages found to check.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

Breaking changes ✔️

Package	Change	Current Version	New Version	Needed Version	Looking good?

This check can be disabled by tagging the PR with skip-breaking-check.

API leaks ✔️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package	Leaked API symbol	Leaking sources

This check can be disabled by tagging the PR with skip-leaking-check.

License Headers ✔️

""

Files
no missing headers

All source files should start with a license header.

Unrelated files missing license headers

Files
pkgs/cupertino_http/example/example.dart
pkgs/http/example/main.dart
pkgs/http_multi_server/test/cert.dart

This check can be disabled by tagging the PR with skip-license-check.

[auto-submit]

autosubmit label was removed for dart-lang/http/1901, because - The status or check suite macOS: Test (3.10.0, macos-latest) has failed. Please fix the issues identified (or deflake) before re-applying this label.