WIP dependency updates

.github/workflows/ci-theia.yml

@@ -30,16 +30,17 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: theia/.nvmrc
           cache: yarn
           cache-dependency-path: theia/yarn.lock
 
       - name: Install dependencies
         run: |
+          sudo apt-get update
           sudo apt-get install libsecret-1-dev
           yarn --frozen-lockfile
 

.github/workflows/e2e-tests-openshift.yml

@@ -87,14 +87,14 @@ jobs:
         run: echo "INPUT_THEIA_CLOUD_HELM_BRANCH=${{ inputs.theia-cloud-helm-branch || 'main' }}" >> $GITHUB_ENV
 
       - name: Checkout Theia Cloud
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: ./theia-cloud
 
       - name: Checkout Theia Cloud Helm
         # Required by 5-02_openshift_ci/theia_cloud.tf which loads
         # the chart via `chart = "../../../../theia-cloud-helm/charts/...`.
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: eclipse-theia/theia-cloud-helm
           ref: ${{ env.INPUT_THEIA_CLOUD_HELM_BRANCH }}
@@ -390,9 +390,9 @@ jobs:
           echo "OPENSHIFT_TOKEN=${TOKEN}" >> "$GITHUB_ENV"
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
-          terraform_version: "1.13.0"
+          terraform_version: "1.16.4"
           terraform_wrapper: false
 
       - name: Terraform apply (4_openshift-setup)
@@ -520,7 +520,7 @@ jobs:
       # ----------------------------------------------------------------
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: theia-cloud/node/.nvmrc
 
@@ -538,7 +538,7 @@ jobs:
 
       - name: Upload Playwright artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-failure-keycloak-${{ matrix.keycloak }}-ephemeral-${{ matrix.ephemeral }}-eagerstart-${{ matrix.eagerStart }}
           path: theia-cloud/node/e2e-tests/test-results/**/*.png

.github/workflows/e2e-tests.yml

@@ -28,7 +28,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kubernetes: [v1.35.3, v1.33.10] # https://kubernetes.io/releases/
+        kubernetes: [v1.37.0, v1.34.11] # https://kubernetes.io/releases/
         paths: [true, false]
         ephemeral: [true, false]
         keycloak: [true, false]
@@ -51,21 +51,21 @@ jobs:
         run: echo "INPUT_THEIA_CLOUD_HELM_BRANCH=${{ github.event.inputs.theia-cloud-helm-branch }}" >> $GITHUB_ENV
 
       - name: Checkout Theia Cloud
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: "./theia-cloud"
 
       - name: Checkout Theia Cloud Helm
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: "eclipse-theia/theia-cloud-helm"
           ref: "${{ env.INPUT_THEIA_CLOUD_HELM_BRANCH }}"
           path: "./theia-cloud-helm"
 
       - name: Setup Minikube
-        uses: manusa/actions-setup-minikube@b65276017fdec6f1e6498129fb740e34e260dc55 # v2.18.0
+        uses: manusa/actions-setup-minikube@001b9f30165b2a875b835ec5183ced75b94bc269 # v2.19.0
         with:
-          minikube version: v1.37.0
+          minikube version: v1.39.0
           kubernetes version: ${{ matrix.kubernetes }}
           github token: ${{ secrets.GITHUB_TOKEN }}
           start args: "--force"
@@ -97,7 +97,7 @@ jobs:
           helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts
           helm repo update
           helm install haproxy-ingress haproxy-ingress/haproxy-ingress \
-            --version 0.15.1 \
+            --version 0.16.2 \
             --namespace ingress-haproxy \
             --create-namespace \
             --set controller.ingressClassResource.enabled=true \
@@ -195,7 +195,7 @@ jobs:
           ls -al
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: theia-cloud/node/.nvmrc
 
@@ -261,7 +261,7 @@ jobs:
 
       - name: Upload Playwright test failure screenshots
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-failure-screenshots-k8s-${{ matrix.kubernetes }}-ingress-${{ matrix.ingress }}-paths-${{ matrix.paths }}-ephemeral-${{ matrix.ephemeral }}-keycloak-${{ matrix.keycloak }}-eagerstart-${{ matrix.eagerStart }}
           path: theia-cloud/node/e2e-tests/test-results/**/*.png

.github/workflows/eclipse-npm-license-check-node.yml

@@ -23,7 +23,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        java: [11]
+        java: [21]
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
@@ -34,17 +34,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
       - name: Use Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: node/.nvmrc
 
       - name: Use Java ${{ matrix.java }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: "temurin"
           java-version: ${{ matrix.java }}

.github/workflows/eclipse-npm-license-check-theia.yml

@@ -23,7 +23,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        java: [11]
+        java: [21]
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
@@ -34,17 +34,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
       - name: Use Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: theia/.nvmrc
 
       - name: Use Java ${{ matrix.java }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: "temurin"
           java-version: ${{ matrix.java }}

.github/workflows/reusable-demo.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create docker tags
         id: get_tags

.github/workflows/reusable-docker.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create docker tags
         id: get_tags
@@ -48,7 +48,7 @@ jobs:
     if: github.event_name == 'push' || github.event_name == 'release'
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Check if we have a valid *-next version for merges on main
       - name: Check version (only for push events)
@@ -79,11 +79,11 @@ jobs:
 
       # Set up QEMU for multi-architecture builds
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       # Set up Docker Buildx for multi-architecture builds
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           install: true
           driver: docker-container
@@ -106,7 +106,7 @@ jobs:
       # Build and push for main merges with next version
       - name: Build and push Docker tags (for push events with next version)
         if: github.event_name == 'push' && steps.version_check.outputs.is_next_version == 'true'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ${{ inputs.docker_file }}
@@ -119,7 +119,7 @@ jobs:
       # Build and push for releases
       - name: Build and push Docker tags (for release events)
         if: github.event_name == 'release'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ${{ inputs.docker_file }}

.github/workflows/reusable-maven.yml

@@ -22,12 +22,12 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Build dependencies
@@ -56,7 +56,7 @@ jobs:
     if: github.event_name == 'push' || github.event_name == 'release'
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Version Check
         id: version_check
@@ -72,13 +72,13 @@ jobs:
       # Only continue from here when the version matches the event, so either:
       # - main merge with snapshot version
       # - release with proper version
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         if: |
           (github.event_name == 'push' && steps.version_check.outputs.is_snapshot_version == 'true') || 
           (github.event_name == 'release' && steps.version_check.outputs.is_snapshot_version == 'false')
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Build dependencies

.github/workflows/reusable-npm.yml

@@ -22,14 +22,15 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: node/.nvmrc
 
       - name: Install dependencies
         run: |
+          sudo apt-get update
           sudo apt-get install libsecret-1-dev
           npm ci
 
@@ -44,7 +45,7 @@ jobs:
         working-directory: ./node
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check version (only for push events)
         if: github.event_name == 'push'
@@ -59,13 +60,14 @@ jobs:
           fi
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: node/.nvmrc
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
         run: |
+          sudo apt-get update
           sudo apt-get install libsecret-1-dev
           npm ci
 

.github/workflows/reusable-theia-extension.yml

@@ -21,7 +21,7 @@ jobs:
         working-directory: ./theia
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check version (only for push events)
         if: github.event_name == 'push'
@@ -36,7 +36,7 @@ jobs:
           fi
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: theia/.nvmrc
           registry-url: "https://registry.npmjs.org"
@@ -48,6 +48,7 @@ jobs:
         env:
           NODE_AUTH_TOKEN: dummy
         run: |
+          sudo apt-get update
           sudo apt-get install libsecret-1-dev
           yarn --frozen-lockfile
 

.github/workflows/stale.yml

@@ -10,7 +10,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v11
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-stale: 180
           days-before-close: 14

.prompts/project-info.prompttemplate

@@ -14,7 +14,7 @@ Located in `java/` with subfolders:
 - `service/org.eclipse.theia.cloud.service/` - Quarkus-based REST API
 - `conversion/` - CRD conversion webhook
 
-**Java Stack**: Java 21, Maven, Guice (DI), Fabric8 Kubernetes Client, Quarkus (service only), Picocli (CLI), Log4j2
+**Java Stack**: Java 25, Maven, Guice (DI), Fabric8 Kubernetes Client, Quarkus (service only), Picocli (CLI), Log4j2
 
 ### Node.js Components (`node/`)
 NPM workspaces monorepo with packages: