[deps]: Update actions/setup-dotnet action to v5

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-dotnet	action	major	v4.3.1 -> v5.0.0

---

Release Notes

actions/setup-dotnet (actions/setup-dotnet)

v5.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to Node.js 24 and modernize async usage by @​salmanmkc in #​654

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Updates

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in #​622
• Upgrade husky from 8.0.3 to 9.1.7 by @​dependabot[bot] in #​591
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot[bot] in #​594
• Upgrade eslint-config-prettier from 9.1.0 to 10.1.5 by @​dependabot[bot] in #​639
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​641
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​652
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​662

Bug Fixes

• Remove Support for older .NET Versions and Update installers scripts by @​gowridurgad in #​647

New Contributors

• @​gowridurgad made their first contribution in #​647
• @​salmanmkc made their first contribution in #​654

Full Changelog: actions/setup-dotnet@v4...v5.0.0

---

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-25768
• Link: https://bitwarden.atlassian.net/browse/PM-25768

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Checkmarx One – Scan Summary & Details – fcb2d6cb-f1b4-4816-97a8-1ab92eb55fe8

Great job! No new security vulnerabilities introduced in this pull request

[AmyLGalles]

LGTM

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[claude]

Claude finished @renovate[bot]'s task —— View job

---

Review of PR #442: Update actions/setup-dotnet to v5

Summary of Changes

This PR updates actions/setup-dotnet from v4.3.1 to v5.0.0 across 3 workflow files:

• .github/templates/workflow-templates/example-references/_build.yml
• .github/templates/workflow-templates/example-references/_test.yml
• .github/workflows/_sonar.yml

All updates correctly pin to commit hash d4c94342e560b34958eacfc5d055d21461ed1c5d with version comment # v5.0.0.

---

Critical Issues

None identified. The changes are clean and properly implemented.

---

Suggested Improvements

1. Runner Version Compatibility Check

Severity: Medium

The v5.0.0 release notes state:

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Recommendation: Verify that all GitHub Actions runners used by Bitwarden (including self-hosted runners, if any) are running version v2.327.1 or newer. The workflows currently specify:

• ubuntu-22.04 in _build.yml and _test.yml
• ubuntu-24.04 in _sonar.yml

GitHub-hosted runners should be up-to-date, but if you use self-hosted runners for .NET builds, confirm they meet this requirement.

2. Test Coverage

Severity: Low

While this is a straightforward dependency update, consider:

• Running test workflows that use these templates to ensure v5 compatibility
• Verifying that the Node.js 24 upgrade doesn't introduce any behavioral changes in your .NET setup processes

---

Good Practices Observed

• ✅ Actions properly pinned to commit hash with version comment
• ✅ Consistent updates across all files
• ✅ Follows Bitwarden workflow linter rules (step_pinned.py)
• ✅ All three instances of the action updated (complete coverage)

---

Breaking Changes Impact Assessment

The v5.0.0 release includes these breaking changes:

1. Node.js 24 upgrade: Should be transparent to end users since it's internal to the action
2. Modernized async usage: Internal refactoring, no API changes
3. Removed support for older .NET versions: Review if any projects rely on older .NET SDK versions that may no longer be supported

Risk Level: Low - These are primarily internal improvements with minimal risk to existing workflows.

---

Action Items

• Confirm runner compatibility: Verify all runners (especially any self-hosted) are v2.327.1+
• Test workflows: Run test workflows using these templates to validate v5 compatibility
• Review .NET versions: Ensure projects don't rely on older .NET versions removed in setup-dotnet v5

---

Conclusion

This is a well-executed dependency update that follows all security best practices and repository guidelines. The changes are minimal, properly pinned, and comprehensive. The main consideration is ensuring runner compatibility as noted in the v5 release notes.

Recommendation: Approve and merge after confirming runner versions.

---