Consolidate the dependabot bumps that hold the test baseline

[matanbaruch]

Folds the open dependabot bumps into one commit, keeping only the ones that hold the test baseline.

Each bump was applied on its own, then lint, test:unit and test:component were run and compared against master. A bump stayed only if all three held. Baseline on master (59e8504f): 0 errors / 0 warnings, 104 passing, 117 of 117. Final state of this branch: identical on all three.

Supersedes #248, #286, #290, #899, #900, #901, #902, #903, #905, #906 and #908.

Included, 11 bumps

PR	Bump	Evidence
#903	actions/checkout 5 to 7	13 uses: lines, v7 tag exists
#899	actions/setup-node 5 to 7	10 lines. No call site passes a cache: input, only node-version-file or node-version, so v6's auto-caching change does not apply
#900	actions/cache 5 to 6	7 lines. v6 is an ESM migration, no input changes
#901	actions/download-artifact 7 to 8	4 lines. name/path and pattern/merge-multiple are all still valid
#902	actions/github-script 8 to 9	1 line. The inline script under ci.yml:688 uses only the injected github/context/core plus require('fs'), never require('@actions/github'), which is the v9 break
#248	uuid 3.4.0 to 8.3.2	baseline held
#906	async 2.6.4 to 3.2.6	baseline held
#286	karma-jasmine 2.0.1 to 4.0.1	baseline held
#908	ws 5.2.7 to 8.21.3	baseline held, plus smoke tests below
#905	karma 2.0.5 to 6.4.4	117 of 117 on two consecutive runs, no config change needed
#290	protractor 5.4.2 to 7.0.0	loads and its config parses, but see the coverage note below

No call site needed changing. Two looked like they would and did not:

• lib/wire/util.js:19 calls uuid.v4(null, Buffer.alloc(16)). uuid 8 still supports the v4(options, buf, offset) form, and makePrivateChannel() returns a valid 16 byte base64 value.
• ws 8 delivers text frames as Buffer rather than string, which is a real break. The only consumer is lib/units/device/plugins/screen/stream.js:577, which passes the frame to RegExp.exec, and that coerces its argument. Checked over a live ws 8 socket with all four control messages: on, off, size 600x800 (w=600, h=800) and a garbage value, which stayed correctly unmatched.

Left out, and why

PR	Bump	Why
#904	protobufjs 5 to 8	test:unit exits 1 with 0 tests run: TypeError: ProtoBuf.loadProtoFile is not a function at lib/wire/index.js:5:21. Needs a source migration, which is #935. #904 is already closed
#907	eslint 4 to 10	Two blockers. npm run lint exits 1 with TypeError: EslintCLIEngine is not a constructor at gulpfile.js:56, because eslint 10 no longer exports CLIEngine. And npx eslint reports ESLint couldn't find an eslint.config.* file, so the 161 line .eslintrc is dead. That is a flat config migration plus a gulpfile rewrite, and it gets its own PR
#273	pug to 3.0.1	master already declares ^3.0.3, so this lowers the floor. Closed
#267	@julusian/jpeg-turbo to 1.0.1	master already declares ^2.2.0. This is a major downgrade of a production native dep used at lib/units/device/plugins/vnc/index.js:12. Closed
#603	passport-saml to 3.2.4	passport-saml is not a dependency any more. It was replaced by @node-saml/passport-saml: ^5.0.1, and lib/units/auth/saml2.js:10 already requires the scoped package, so this bump would re-add a dependency nothing imports. Closed

All six of the older PRs (#248, #267, #273, #286, #290, #603) also patch a yarn.lock that no longer exists, deleted in 872b0bcb.

Where a green suite is not evidence

Stating this plainly, because four of the included bumps are not actually exercised:

• protractor 7 has no coverage in any of the three suites. Its specs live under res/test/e2e/** and run only through gulp protractor, which needs a live STF at STF_URL plus webdriver. The positive evidence is only that it loads, res/test/protractor.conf.js parses with its 5 suites, the .bin layout that res/test/e2e/helpers/gulp-protractor-adv.js resolves is intact, and all 22 gulp tasks still register. Protractor is also EOL and npm prints the deprecation.
• ws 8 is used only by device plugin code that none of the three suites touch. Its evidence is the smoke tests above.
• async 3 is a devDependency with zero first party require('async') hits, so green carries no information.
• karma-jasmine 4 resolves the same nested jasmine-core 3.99.1 that 2.0.1 already did, so the effective jasmine version is unchanged.

Two things worth knowing

download-artifact v8 turns a digest mismatch into an error rather than a warning, and checks Content-Type before unzipping. No input change is needed, but a corrupted artifact will now fail the run instead of warning.

Every action in every workflow is bumped, per review. The dependabot PRs only patch ci.yml. That would have left docker.yml, docker-build.yml, release.yml and prepare-release.yml on checkout@v5, setup-node@v5 and download-artifact@v7, and would have left three actions with no dependabot PR at all sitting a major behind. Both gaps are closed here:

Action	Was	Now	Refs
actions/checkout	v5	v7	13
actions/upload-artifact	v6	v7	11
actions/setup-node	v5	v7	10
actions/cache, actions/cache/restore	v5	v6	7
actions/download-artifact	v7	v8	4
docker/setup-buildx-action	v3	v4	2
docker/build-push-action	v6	v7	2
actions/github-script	v8	v9	1
docker/login-action	v4	v4	2, already current

Nothing under .github/workflows is behind its latest major now. reactivecircus/android-emulator-runner stays pinned by commit sha on purpose.

upload-artifact v7, setup-buildx-action v4 and build-push-action v7 are all the same breaking change: Node 24 as the default runtime, requiring Actions Runner 2.327.1 or later. checkout@v7 and setup-node@v7 already carry that requirement and pass on ubuntu-24.04, so the runners are new enough.

The edits are provably nothing but version numbers. Stripping @vN from the diff makes the removed and added lines identical, and all five workflows still parse.

docker.yml runs on pull_request and calls docker-build.yml, so this PR's own Standard image (amd64) / (arm64) checks exercise setup-buildx-action@v4, build-push-action@v7, upload-artifact@v7 and download-artifact@v8 for real. release.yml and prepare-release.yml do not run on a PR, so their 6 lines stay unvalidated. Both call setup-node with only node-version-file or node-version, and checkout with only fetch-depth or ref, all unchanged inputs in the new majors.

Separately, karma 6 removes the Node 24 problem. On master, test:component cannot run on Node 24 at all: log4js calls the removed util.isError. On this branch it passes 117 of 117 on Node 24.19.0. .nvmrc still pins 22.11.0 and CI reads node-version-file, so CI behaviour does not change, but local development stops needing Node 22. Karma 6 also drops 277 transitive packages and reports the browser correctly as Chrome Headless 152.0.0.0 instead of HeadlessChrome 0.0.0.

Every install used --ignore-scripts to skip the prepare script, so no native compile step was exercised. bufferutil, utf-8-validate, zeromq and @julusian/jpeg-turbo came from prebuilds.

[koral--]

actions versions in other workflows can be also updated

[matanbaruch]

Done, all five workflows now use the same versions and every actions/* and docker/* reference is at its latest major, including upload-artifact 6 to 7, setup-buildx-action 3 to 4 and build-push-action 6 to 7 which had no dependabot PR.