chore(deps): update github-actions

.github/actions/gradle-setup/action.yml

@@ -41,7 +41,7 @@ runs:
       run: mkdir -p ~/.gradle && cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
     - name: Set up JDK 25
-      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
+      uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
       with:
         java-version: '25'
         distribution: ${{ inputs.jdk_distribution }}
@@ -51,7 +51,7 @@ runs:
     # running Gradle; toolchains.xml still lists JBR.
     - name: Set up JetBrains JDK 25
       if: inputs.install_jetbrains_jdk == 'true'
-      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
+      uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
       with:
         java-version: '25'
         distribution: 'jetbrains'

.github/workflows/docs-deploy.yml

@@ -53,7 +53,7 @@ jobs:
 
       - name: Setup Ruby
         if: env.BUILD_SITE == 'true'
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         # With ruby-version unset this reads the root .ruby-version; the bundle is docs/Gemfile.
         env:
           BUNDLE_GEMFILE: docs/Gemfile

.github/workflows/docs-release.yml

@@ -91,7 +91,7 @@ jobs:
           cache_konan: 'true'
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         # With ruby-version unset this reads the root .ruby-version; the bundle is docs/Gemfile.
         env:
           BUNDLE_GEMFILE: docs/Gemfile

.github/workflows/play-listing.yml

@@ -44,7 +44,7 @@ jobs:
         run: python3 scripts/check-store-metadata.py
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 

.github/workflows/play-rollout.yml

@@ -59,7 +59,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 

.github/workflows/promote.yml

@@ -74,7 +74,7 @@ jobs:
           ref: ${{ inputs.tag_name }}
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 

.github/workflows/release.yml

@@ -479,7 +479,7 @@ jobs:
           path: ${{ runner.temp }}/google-aab
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 

.github/workflows/scheduled-updates.yml

@@ -158,7 +158,7 @@ jobs:
           fi
 
       - name: Sync with Crowdin
-        uses: crowdin/github-action@9c23991700c0ec5256fd41089b9d9d7d540e424e # v3.3.0
+        uses: crowdin/github-action@72955432d4aa4f6dd64cf17eeb88dd34d6ba064c # v3.4.0
         with:
           base_url: 'https://meshtastic.crowdin.com/api/v2'
           config: 'crowdin.yml'

.github/workflows/verify-flatpak.yml

@@ -71,7 +71,7 @@ jobs:
           fi
           echo "OK: $manifest vendors $wrapper_dist, matching $props"
 
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           distribution: temurin
           java-version: 25.0.4+101.0.LTS
@@ -80,7 +80,7 @@ jobs:
       # JBR resolves its version list via the GitHub API — unauthenticated requests
       # rate-limit on the shared runner IPs, so the token is required, not optional.
       # Fatal: foojay lists no JBR 25, so the build cannot configure without it.
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           distribution: jetbrains
           java-version: 25

.github/workflows/winget-publish.yml

@@ -62,7 +62,7 @@ jobs:
       # stripped (v2.8.0 -> 2.8.0), matching the MSI's ProductVersion.
       - name: Submit MSI manifest to microsoft/winget-pkgs
         if: env.HAS_WINGET_TOKEN == 'true'
-        uses: vedantmgoyal9/winget-releaser@f29ed1ffd34f91223a2aebaa71beaab0901ff9fd # v2
+        uses: vedantmgoyal9/winget-releaser@b7370d4d152efdce803a26cc6ca9eee58cb2ad54 # v2
         with:
           identifier: Meshtastic.MeshtasticDesktop
           installers-regex: '\.msi$'