chore: integrate dependabot GitHub Actions updates (#61, #60, #59, #58)

[devin-ai-integration]

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you successfully ran tests with your changes locally?

Summary

Integrates the following open Dependabot PRs into a single branch, tested locally:

• build(deps): bump actions/cache from 5 to 6 #61 — actions/cache 5 → 6
• build(deps): bump JetBrains/qodana-action from 2026.1.0 to 2026.1.3 #60 — JetBrains/qodana-action 2026.1.0 → 2026.1.3
• build(deps): bump actions/checkout from 6 to 7 #59 — actions/checkout 6 → 7
• build(deps): bump codecov/codecov-action from 6 to 7 #58 — codecov/codecov-action 6 → 7

Verification

dotnet build QRCoder.Core.sln
dotnet test QRCoder.Core.Tests/QRCoder.Core.Tests.csproj --framework net8.0
dotnet test QRCoder.Core.Tests/QRCoder.Core.Tests.csproj --framework net10.0

All builds succeeded and tests passed (498 tests, 0 failures) after each merge. net48 tests were not executed because mono is not available in the local environment.

Notes

• PR docs(readme): fix namespace references #54 (docs(readme): fix namespace references) was not included because it has merge conflicts with main and the README.md already contains the correct namespaces.
• Qodana and Snyk CI failures are pre-existing and unrelated to these dependency updates.

Link to Devin session: https://app.devin.ai/sessions/5682754ac3ea4a03a3edc50c84591a2d
Requested by: @afonsoft

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 Pre-existing broken markdown in release body template

The release body template in publish-all.yml:174 opens a ```bash code block but never closes it before a new ```shell block starts at line 178. This means the rendered release notes on GitHub will have malformed markdown — the "Installation" section will appear as raw text inside a code block. This is a pre-existing issue not introduced by this PR, but since the file is being touched, it may be worth fixing in a follow-up.

(Refers to lines 165-184)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 Pre-existing SonarQube project key references wrong project

The SonarQube configuration uses /k:"afonsoft_metar-decoder" as the project key (code-quality.yml:96 and security-scan.yml:124), which appears to be a copy-paste artifact from a different repository (metar-decoder). For QRCoder.Core, this should likely be afonsoft_qrcoder-core or similar. This means SonarQube analysis results are being reported under the wrong project on SonarCloud. Pre-existing issue, not introduced by this PR.

---

Was this helpful? React with 👍 or 👎 to provide feedback.