chore(deps): bump dart-lang/setup-dart/.github/workflows/publish.yml from 1 to 1.7.2

[dependabot]

Bumps dart-lang/setup-dart/.github/workflows/publish.yml from 1 to 1.7.2.

Release notes

Sourced from dart-lang/setup-dart/.github/workflows/publish.yml's releases.

v1.7.2

• Update Node.js requirement to Node 24.
• Fix open Dependabot alerts by bumping undici to >=6.24.0.
• Update GitHub Action dependencies (@actions/core, @actions/exec, @actions/tool-cache, @actions/http-client).
• Update workflow actions to their latest versions (actions/checkout v6, setup-flutter).

v1.7.1

• Roll undici dependency to address CVE-2025-22150.
• Update to the latest npm dependencies.
• Recompile the action using the new Dart / JavaScript interop.

v1.7.0

What's Changed

• Install a Flutter SDK in the publish workflow allowing for publication of flutter packages.

v1.6.5

• Fix zip path handling on Windows 11 (#118[])

#118: dart-lang/setup-dart#118

v1.6.4

• Rebuild JS code to include changes from v1.6.3

v1.6.3

• Roll undici dependency to address CVE-2024-30260 and CVE-2024-30261.

v1.6.2

• Switch to running the workflow on node20 from node16. See also Transitioning from Node 16 to Node 20.

v1.6.1

• Updated the google storage url for main channel releases.

v1.6.0

• Enable provisioning of the latest Dart SDK patch release by specifying just the major and minor version (e.g. 3.2).

v1.5.1

• No longer test the setup-dart action on pre-2.12 SDKs.
• Upgrade JS interop code to use extension types (the new name for inline classes).
• The upcoming rename of the be channel to main is now supported with forward compatibility that switches when the rename happens.

v1.5.0

• Re-wrote the implementation of the action into Dart.
• Auto-detect the platform architecture (x64, ia32, arm, arm64).

... (truncated)

Changelog

Sourced from dart-lang/setup-dart/.github/workflows/publish.yml's changelog.

v1.7.2

• Update Node.js requirement to Node 24.
• Fix open Dependabot alerts by bumping undici to >=6.24.0.
• Update GitHub Action dependencies (@actions/core, @actions/exec, @actions/tool-cache, @actions/http-client).
• Update workflow actions to their latest versions (actions/checkout v6, setup-flutter).

v1.7.1

• Roll undici dependency to address CVE-2025-22150.
• Update to the latest npm dependencies.
• Recompile the action using the new Dart / JavaScript interop.

v1.7.0

• Install flutter sdk in publishing step, allowing Flutter packages to be published (#68[])

  #68: dart-lang/setup-dart#68

v1.6.5

• Fix zip path handling on Windows 11 (#118[])

#118: dart-lang/setup-dart#118

v1.6.4

• Rebuild JS code.

v1.6.3

• Roll undici dependency to address CVE-2024-30260 and CVE-2024-30261.

v1.6.2

• Switch to running the workflow on node20`` from node16`. See also Transitioning from Node 16 to Node 20.

v1.6.1

• Updated the google storage url for main channel releases.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[anilcancakir]

Merging. The one thing PR CI cannot tell us about this change is the only thing that matters, so it is verified by hand instead: dart-lang/setup-dart tag v1.7.2 resolves to commit 65eb853c7ba1 and .github/workflows/publish.yml exists there (1986 bytes). Nothing in the publish path is being pointed at something that is not there.

It also matches this repo's existing convention: all 13 uses: refs across .github/workflows/ are tag-pinned, none by SHA, so the pin is consistent rather than a new policy.

Worth stating the direction, since it is the opposite of how a version bump usually reads: @v1 is a MUTABLE tag, so today the publish path can change under us with no PR at all. @v1.7.2 freezes it and routes future updates through a Dependabot PR, which is the posture a release path should have. This is a narrowing, not a loosening.