Merge pull request #180 from doublegate/chore/deps-consolidation-2026-06

Consolidated Dependabot update: 4 GitHub Actions + 9 Cargo bumps (#167-#179), with the jni 0.22 / RustCrypto 0.11 code fixes and the open-source gradle cache provider. Core byte-identical, AccuracyCoin 139/139.

Author: doublegate

.github/workflows/android.yml

@@ -39,7 +39,7 @@ jobs:
     name: NDK cross-build + UniFFI bindings
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # The project toolchain (rust-toolchain.toml = 1.96) plus the two shipped
       # Android targets (arm64 ships; x86_64 is the emulator/CI ABI).
@@ -104,22 +104,27 @@ jobs:
     continue-on-error: true
     needs: cross-build
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install Android Rust targets
         run: rustup target add aarch64-linux-android x86_64-linux-android
       - uses: Swatinem/rust-cache@v2
         with:
           key: android-ndk
       - name: Install cargo-ndk
         run: cargo install cargo-ndk --version "^3" --locked
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '17'
       - name: Resolve NDK
         run: echo "ANDROID_NDK_HOME=$ANDROID_NDK_LATEST_HOME" >> "$GITHUB_ENV"
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
         with:
+          # v6 extracted the default ("enhanced") Gradle User Home cache into the
+          # closed-source `gradle-actions-caching` library (separate Terms of Use).
+          # RustyNES is OSS, so pin the fully open-source (MIT) provider built on
+          # the standard GitHub Actions cache instead of the proprietary default.
+          cache-provider: basic
           # Publish a Gradle Build Scan for every run (the free scans.gradle.com
           # service) so CI Gradle failures have a shareable diagnostic URL in the
           # log. ToS auto-accepted for the public service.

.github/workflows/ci.yml

@@ -77,10 +77,10 @@ jobs:
       # the base commit. (On `pull_request` it uses the GitHub API and needs no
       # history.) Without this the push-event filter falls back to "everything
       # changed" — safe, but it loses the docs-only skip on direct main pushes.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -138,7 +138,7 @@ jobs:
     env:
       RUSTDOCFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: 1.96.0
@@ -182,7 +182,7 @@ jobs:
       matrix:
         os: ${{ fromJSON(needs.setup.outputs.os) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           cache-key: test
@@ -197,7 +197,7 @@ jobs:
     if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           cache-key: test-roms
@@ -221,7 +221,7 @@ jobs:
     if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           targets: thumbv7em-none-eabihf
@@ -239,7 +239,7 @@ jobs:
     if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           targets: wasm32-unknown-unknown
@@ -262,7 +262,7 @@ jobs:
     if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           apt: "false"

.github/workflows/pgo.yml

@@ -73,7 +73,7 @@ jobs:
       promotable: ${{ steps.gate.outputs.promotable }}
       speedup_pct: ${{ steps.gate.outputs.speedup_pct }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Pinned to the project toolchain (rust-toolchain.toml = 1.96.0), matching
       # the other jobs. PGO needs the llvm-tools-preview component (profdata
@@ -192,7 +192,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: 1.96.0

.github/workflows/release.yml

@@ -76,7 +76,7 @@ jobs:
             archive_ext: zip
             bin_name: rustynes.exe
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Shared toolchain + Linux deps (no-op on macOS/Windows) + cargo cache.
       # The per-target cache key keeps each platform's artifacts separate.

.github/workflows/security.yml

@@ -52,7 +52,7 @@ jobs:
     name: Dependency Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Install the PREBUILT binary, never `cargo install` (build-from-source):
       # the repo pins rustc 1.96 (rust-toolchain.toml), but the current
       # cargo-audit release needs >= 1.88 to COMPILE. The prebuilt binary RUNS
@@ -67,7 +67,7 @@ jobs:
     name: Cargo Deny Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Prebuilt binary for the same reason as the audit job: the latest
       # cargo-deny needs rustc >= 1.88 to build from source, while the repo is
       # pinned to 1.96. Policy lives in `deny.toml`.
@@ -80,7 +80,7 @@ jobs:
     name: Clippy Security Lints
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: 1.96.0

.github/workflows/web.yml

@@ -70,7 +70,7 @@ jobs:
     name: build demo + docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Shared toolchain + cargo cache. `apt: true` because the rustdoc build
       # compiles the whole workspace (incl. rustynes-frontend) for the host,

CHANGELOG.md

@@ -15,6 +15,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **Dependency maintenance — consolidated 13 Dependabot updates.** A single
+  branch folding the 4 GitHub Actions bumps (`actions/checkout` 6 → 7,
+  `dorny/paths-filter` 3 → 4, `actions/setup-java` 4 → 5,
+  `gradle/actions/setup-gradle` 4 → 6) and 9 Cargo bumps: **zip 2.4 → 8.6**
+  (frontend / mobile / hdpack / test-harness, deflate read path), **naga 25 → 29**
+  (matches wgpu 29, drops the duplicate naga from the lock), **jni 0.21 → 0.22**
+  (the `Env` / `EnvUnowned` split — the six `rustynes-android` native methods now
+  take `EnvUnowned` and reach the owned `Env` via `with_env(..).resolve::<…>()`
+  with the non-deprecated `JByteArray::len` / `get_region` accessors),
+  **sha1 + md-5 0.10 → 0.11** (RustCrypto `digest` 0.11; the movie-export hashes
+  import `Digest` from `sha1` so the core keeps `sha2` 0.10 for its `no_std`
+  Sha256), **pollster 0.3 → 0.4**, **android_logger 0.14 → 0.15**,
+  **lz4_flex 0.11 → 0.13**, and the production-dependencies group
+  (cc 1.2.65 / log 0.4.33 / ratatui 0.30.2). The emulation core is untouched —
+  the chip stack stays `no_std` + byte-identical, so **AccuracyCoin holds 100%
+  (139/139)** and the desktop / wasm / Android builds are behaviourally unchanged.
+
 ## [1.8.8] - 2026-06-20 - "Atlas" (Google Play launch readiness)
 
 The Google-Play-launch + Android-native-excellence release: it modernizes the Android