deps: safe bumps across rust / kotlin / js / actions

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
           - name: windows-latest
             runner: [windows-latest]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
@@ -50,7 +50,7 @@ jobs:
     name: fmt + clippy + docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy

.github/workflows/ci_js.yml

@@ -38,10 +38,10 @@ jobs:
     timeout-minutes: 30
     runs-on: [self-hosted, macOS, ARM64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: Enable corepack (yarn)
@@ -133,9 +133,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         if: ${{ !matrix.settings.docker }}
         with:
           node-version: 24
@@ -175,7 +175,7 @@ jobs:
       - name: Install dependencies
         run: yarn install
       - name: Setup node x86
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         if: matrix.settings.target == 'i686-pc-windows-msvc'
         with:
           node-version: 24
@@ -219,9 +219,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           architecture: x64
@@ -255,9 +255,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - name: Enable corepack (yarn)
@@ -295,9 +295,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - name: Enable corepack (yarn)
@@ -333,9 +333,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - name: Enable corepack (yarn)
@@ -385,9 +385,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - name: Enable corepack (yarn)
@@ -437,9 +437,9 @@ jobs:
       run:
         working-directory: ./iroh-js
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - name: Enable corepack (yarn)
@@ -485,7 +485,7 @@ jobs:
       - test-linux-aarch64-musl-binding
       - test-linux-arm-gnueabihf-binding
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Setup node
         # Per npm's official Trusted Publishing docs
         # (https://docs.npmjs.com/trusted-publishers): node 24 + setup-node@v6

.github/workflows/ci_kotlin.yml

@@ -30,13 +30,13 @@ jobs:
           - name: macOS-arm-latest
             runner: [self-hosted, macOS, ARM64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "21"
@@ -71,7 +71,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
@@ -88,7 +88,7 @@ jobs:
           if ! command -v cargo-make >/dev/null 2>&1; then
             cargo install --locked cargo-make
           fi
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "21"
@@ -102,15 +102,15 @@ jobs:
     timeout-minutes: 45
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "21"
@@ -131,15 +131,15 @@ jobs:
     # self-hosted runner doesn't.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "17"

.github/workflows/ci_python.yml

@@ -21,10 +21,10 @@ jobs:
     timeout-minutes: 30
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Set up virtualenv

.github/workflows/ci_swift.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 60
     runs-on: [self-hosted, macOS, ARM64, xcode16]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios,aarch64-apple-darwin

.github/workflows/docs.yml

@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 45
     runs-on: [self-hosted, macOS, ARM64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
@@ -51,11 +51,11 @@ jobs:
     timeout-minutes: 30
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Set up virtualenv (maturin builds the extension)
@@ -78,11 +78,11 @@ jobs:
     timeout-minutes: 30
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
       # Self-hosted runners don't ship yarn; corepack provides it (matches
@@ -102,11 +102,11 @@ jobs:
     timeout-minutes: 30
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "17"
@@ -122,8 +122,8 @@ jobs:
     timeout-minutes: 10
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - run: pip install pyyaml

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
         echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
         echo "version is: ${GITHUB_REF#refs/tags/}"
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 1
     - name: Promote draft release (or create fresh)
@@ -95,7 +95,7 @@ jobs:
             runner: [windows-latest]
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 1
     - name: Install Rust
@@ -173,7 +173,7 @@ jobs:
             target: x86_64-pc-windows-msvc
             lib_file: iroh_ffi.dll
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -196,7 +196,7 @@ jobs:
     timeout-minutes: 60
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
@@ -238,11 +238,11 @@ jobs:
     # doesn't have KVM enabled.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "17"
@@ -279,11 +279,11 @@ jobs:
     needs: [create-release, build-kotlin-cdylib, build-kotlin-android, verify-kotlin-android-consumer]
     runs-on: [self-hosted, linux, X64]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "17"

.github/workflows/release_swift.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: [self-hosted, macOS, ARM64, xcode16]
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/wheels.yml

@@ -35,7 +35,7 @@ jobs:
             container: quay.io/pypa/manylinux_2_28_aarch64
             runner: [self-hosted, linux, ARM64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install rust + cargo-make
         run: |
           curl --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
@@ -58,11 +58,11 @@ jobs:
     # were dropped.
     runs-on: [self-hosted, macOS, ARM64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-apple-darwin
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - run: pip install -U maturin uniffi-bindgen
@@ -76,10 +76,10 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: davidB/rust-cargo-make@v1
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - run: pip install -U maturin uniffi-bindgen