build(deps): bump dart-lang/setup-dart from 1.8.0 to 1.8.1

[dependabot]

Bumps dart-lang/setup-dart from 1.8.0 to 1.8.1.

Release notes

Sourced from dart-lang/setup-dart's releases.

v1.8.1

• Update workflows to pin actions/checkout to a commit SHA.
• Harden workflow permissions to contents: read.
• Update publish.yml reusable workflow to reference setup-dart@v1.8.0 and latest setup-flutter.
• Bump undici to 6.28.0 and @vercel/ncc to 0.44.1.

Changelog

Sourced from dart-lang/setup-dart's changelog.

v1.8.1

• Update workflows to pin actions/checkout to a commit SHA.
• Harden workflow permissions to contents: read.
• Update publish.yml reusable workflow to reference setup-dart@v1.8.0 and latest setup-flutter.
• Bump undici to 6.28.0 and @vercel/ncc to 0.44.1.

v1.8.0

• Add a problem matcher for dart analyze to automatically create inline annotations on GitHub pull requests.
• Update publish.yml reusable workflow to reference setup-dart@v1.7.2 (running on Node 24) (#188[]).
• Update GitHub Action dependencies (actions/checkout v7).
• Bump undici to 6.27.0 and update npm dependencies.

#188: dart-lang/setup-dart#188

v1.7.2

• Update Node.js requirement to Node 24.
• Fix open Dependabot alerts by bumping undici to >=6.24.0.
• Update GitHub Action dependencies (@actions/core, @actions/exec, @actions/tool-cache, @actions/http-client).
• Update workflow actions to their latest versions (actions/checkout v6, setup-flutter).

v1.7.1

• Roll undici dependency to address CVE-2025-22150.
• Update to the latest npm dependencies.
• Recompile the action using the new Dart / JavaScript interop.

v1.7.0

• Install flutter sdk in publishing step, allowing Flutter packages to be published (#68[])

  #68: dart-lang/setup-dart#68

v1.6.5

• Fix zip path handling on Windows 11 (#118[])

#118: dart-lang/setup-dart#118

v1.6.4

• Rebuild JS code.

v1.6.3

... (truncated)

Commits

• 6afc89d Pin actions/checkout to a commit SHA and harden workflow permissions (#196)
• b653b3c Prepare v1.8.1 release (#195)
• 45165d2 Bump the github-actions group across 1 directory with 2 updates (#194)
• 9af6bba Pin actions/checkout to a commit SHA in publish.yml (#193)
• ddca5d2 Bump @​vercel/ncc in the npm-dependencies group across 1 directory (#185)
• 5c116a3 Bump undici from 6.27.0 to 6.28.0 (#190)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[CaiJingLong]

Reviewed the pinned v1.8.1 update and its upstream changes. The action inputs/runtime contract used here remain unchanged; the release contains dependency/build and upstream workflow-hardening changes. I found no blocking issue.

Verification: parsed the changed publishing workflow locally at a9aeed4 and checked the exact-head PR verification, CodeQL, and CI/CD security runs, all successful. The issue-comment-triggered publishing path was not executed by those PR checks and was not invoked during this review. No application unit tests were rerun locally for this action-only change. Review performed with OpenAI Codex assistance.