109 Commits

Author	SHA1	Message	Date
Copilot	69304e5bab	Remediate npm audit findings and rebuild distributions (#1145) ... * Pin patched brace-expansion release * Rebuild action bundles * Refresh licensed npm cache records * Restore compatible brace expansion versions * Restore transitive dependency license records * Fix brace-expansion GHSA-mh99-v99m-4gvg vulnerability via npm overrides * Update licensed dependency records to fix CI license check --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-27 21:57:35 -04:00
Markus Hoffrogge	c59dceb0cd	chore(deps): fix npm audited vulnerabilities (#1140)	2026-07-27 14:34:04 -04:00
Bruno Borges	c3d7ccbf81	Clarify credential environment variable inputs (#1134) ... * Clarify credential environment variable inputs Rename credential-related inputs to make their environment-variable semantics explicit while preserving deprecated aliases with migration warnings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 70a3daa8-dbc9-4eb0-a57b-df198a459315 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-17 20:10:58 -04:00
Bruno Borges	e40a8e0642	Add an option to disable Java problem matchers (#1133) ... * Add problem matcher opt-out Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 38eb7886-7ea3-4e4d-8d5f-e3f975135053 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-16 11:28:10 -04:00
Philip Gai	6e2e32e729	chore(deps): bump @actions/cache to 6.2.0 (#1128) ... * chore(deps): bump @actions/cache to 6.2.0 Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist/ bundles. 6.2.0 honors ACTIONS_CACHE_MODE to skip restore/save when the effective cache-mode disallows it, and surfaces a core.warning (instead of failing the run) when the cache service denies a read/write due to token scopes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 * chore: update licensed record for @actions/cache 6.2.0 Refresh the cached licensed dependency record so the version matches the bumped @actions/cache 6.2.0. License text, summary, and homepage are unchanged; only the version field was stale, which failed the "Check licenses" CI job. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-15 17:16:17 -04:00
Bruno Borges	7d485884af	Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server (#1123) ... * Use gpg.passphraseEnvName instead of gpg.passphrase server The maven-gpg-plugin's `gpg.passphrase`/`passphraseServerId` mechanism is deprecated and fails when the plugin's `bestPractices` mode is enabled. Stop writing the `gpg.passphrase` server to settings.xml and instead set `gpg.passphraseEnvName` via an active profile when the configured passphrase env var name differs from the plugin default (MAVEN_GPG_PASSPHRASE). The default `gpg-passphrase` input value (GPG_PASSPHRASE) is unchanged, so the plugin reads the same environment variable as before. Fixes #760 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix settings.xml publishing validation Update the publishing e2e check to assert the settings.xml generated when gpg-passphrase is MAVEN_GPG_PASSPHRASE. In that default case the action no longer writes a gpg.passphrase server entry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Default gpg-passphrase to MAVEN_GPG_PASSPHRASE Align the default `gpg-passphrase` input value with the maven-gpg-plugin default environment variable name (MAVEN_GPG_PASSPHRASE). With this default, setup-java writes no extra GPG configuration to settings.xml and the plugin reads the passphrase from MAVEN_GPG_PASSPHRASE out of the box. Also document that reading the passphrase from an environment variable via `gpg.passphraseEnvName` requires maven-gpg-plugin 3.2.0 or newer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Document gpg-passphrase breaking change in V6 Add a "Breaking changes in V6" section to the README covering the switch to gpg.passphraseEnvName, the new MAVEN_GPG_PASSPHRASE default, and the maven-gpg-plugin 3.2.0+ requirement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Keep GPG_PASSPHRASE default for v5 compatibility Revert the gpg-passphrase input default back to GPG_PASSPHRASE so existing v5 workflows that set the GPG_PASSPHRASE environment variable keep working without changes. setup-java writes gpg.passphraseEnvName=GPG_PASSPHRASE into an active profile, so the maven-gpg-plugin reads the same variable as before. The only remaining compatibility requirement is maven-gpg-plugin 3.2.0+, which is documented in the README and advanced usage guide. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Clarify GPG passphrase profile compatibility Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-15 10:33:09 -04:00
Bruno Borges	81c13a41f9	Cache Maven and Gradle wrapper distributions separately from the dependency cache (#1097) ... * Cache Maven wrapper distribution separately from the local repository The Maven wrapper distribution (~/.m2/wrapper/dists) was cached in the same entry as the local Maven repository (~/.m2/repository), keyed on a hash of **/pom.xml (plus wrapper properties and extensions). Because pom.xml changes frequently and no restoreKeys are used (by design, #269), almost every change produces a full cache miss and the wrapper distribution is re-downloaded via mvnw — which intermittently fails due to upstream rate limiting. The wrapper distribution only depends on maven-wrapper.properties, which changes very rarely. Give it its own cache entry keyed solely on **/.mvn/wrapper/maven-wrapper.properties so it survives the frequent pom.xml changes that rotate the main dependency cache key. - Add a generic additionalCaches concept to PackageManager, restored and saved independently with name-scoped state keys. - Move ~/.m2/wrapper/dists out of the main maven path into a maven-wrapper additional cache; skip silently when the project does not use mvnw. - Keep cache-hit / cache-primary-key outputs driven by the main cache. - Update tests, docs, and rebuild dist bundles. Fixes #1095 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache Gradle wrapper distribution separately from the dependency cache (#1098) The Gradle wrapper distribution (~/.gradle/wrapper) only depends on gradle-wrapper.properties, which changes rarely, but it was previously cached in the same entry as ~/.gradle/caches, keyed on volatile **/*.gradle* files with no restoreKeys (issue #269). Every dependency change therefore re-downloaded the wrapper. Move ~/.gradle/wrapper into a dedicated `gradle-wrapper` additional cache keyed only on **/gradle-wrapper.properties, reusing the additionalCaches infrastructure introduced for the Maven wrapper fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix broken try/catch in saveAdditionalCache and rebuild dist The autofix commits dropped the `} catch (error) {` line in saveAdditionalCache, leaving a `try` block without a catch and a dangling `error` reference, which broke compilation and Prettier. Restore the catch clause, reformat, and regenerate the dist bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address cache.ts review feedback - saveAdditionalCache: handle @actions/cache ValidationError (thrown when the cache paths do not resolve, e.g. the wrapper distribution was never downloaded) by skipping instead of failing the post step. Add a test. - Point the Gradle wrapper cache comment at issue #269 (Gradle wrapper cache churn) instead of the Maven-specific #1095. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Document Gradle Wrapper distribution caching in README Add a parallel "Gradle Wrapper" note alongside the Maven Wrapper note, so the new behavior for cache: 'gradle' (caching ~/.gradle/wrapper in a separate entry keyed on **/gradle-wrapper.properties) is documented. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-14 17:14:23 -04:00
Bruno Borges	174d4b5609	Support pinning java-version as "latest" (#1093) ... * Support pinning java-version as "latest" Add a `latest` alias for the `java-version` input that floats to the newest available stable (GA) release. It is normalized to the SemVer wildcard at the base-installer layer and always resolves from remote (like `check-latest: true`). List-based distributions resolve it automatically via the existing newest-first matching. Corretto selects its newest available major; Oracle and GraalVM look up the newest GA major via the Adoptium API and request it, failing with an actionable error if that major isn't published yet. The jdkfile distribution rejects `latest`. Closes #832 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify latest note for oracle/graalvm version resolution vs download Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * graalvm-community: float latest to its own newest GA release GraalVM Community publishes its releases on GitHub, so the `latest` alias now matches against that real release list using the SemVer wildcard instead of asking the Adoptium API for the newest GA major. This prevents `latest` from hard-failing when GraalVM lags behind a freshly released Java major (e.g. Adoptium reports 26 before GraalVM ships it). Oracle GraalVM has no listing endpoint, so it keeps deriving the newest major from Adoptium and errors clearly if that major is not yet published. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Give latest+qualifier inputs (e.g. latest-ea) a targeted error Inputs like 'latest-ea' had their '-ea' suffix stripped and fell through to the generic SemVer validation, failing with a confusing "'latest' is not valid SemVer" message even though 'latest' is supported. Add an explicit guard so any 'latest*' value other than exactly 'latest' throws a targeted error explaining that 'latest' resolves GA releases only and cannot be combined with '-ea' or other qualifiers. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-09 20:11:03 -04:00
Bruno Borges	f848fd1976	feat: expose cache-primary-key output (#597) (#1088) ... * feat: expose cache-primary-key output (#597) Expose the primary cache key computed by the caching logic as a new `cache-primary-key` action output, so workflows can compose the built-in setup-java cache key with actions/cache or actions/cache/restore across steps and dependent jobs. - src/cache.ts: set the `cache-primary-key` output in restore() - action.yml: declare the new output - README.md: document the new output - __tests__/cache.test.ts: assert the output is set - dist: rebuild Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * chore: rebuild dist Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-09 11:19:31 -04:00
Bruno Borges	4db08ef6bf	Infer distribution from asdf .tool-versions vendor prefix (#1084) ... * Infer distribution from asdf .tool-versions vendor prefix asdf-java encodes the JDK vendor as a prefix on the version string in .tool-versions (e.g. `java temurin-17.0.3+7`). Capture that prefix and map it to a setup-java distribution, mirroring the existing .sdkmanrc behavior. Unknown prefixes warn and fall back to the distribution input. Fixes #1081 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-08 12:57:52 -04:00
Bruno Borges	7dbccc66ee	Rename jdkFile input to jdk-file with deprecated alias (#1083) ... * Rename jdkFile input to jdk-file with deprecated alias Add a standardized `jdk-file` input to match the lowercase-dash naming used by every other action input. The camelCase `jdkFile` input is kept as a deprecated alias: it still works, but emits a deprecation warning and may be removed in a future release. `jdk-file` takes precedence when both are provided. Updates docs and the local-file e2e workflow (one case intentionally keeps using the deprecated alias for coverage) and regenerates the dist bundles. Fixes #1077 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: keep jdkFile in switching-to-v2 guide The switching-to-v2 migration guide uses actions/setup-java@v2, which only supports the camelCase jdkFile input. Keep the new jdk-file spelling in current-version docs only. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-08 12:44:58 -04:00
Priya Gupta	f7121373a9	Migrate to ESM and upgrade dependencies (#1078) ... * Migrate to ESM and upgrade dependencies * fix: update import statement for JSON module in kona-installer test --------- Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-07-08 10:15:00 +01:00
Copilot	2a07c83aea	feat: add .mvn/extensions.xml to Maven cache key pattern (#1041) ... * Initial plan * feat: add .mvn/extensions.xml to Maven cache key pattern Closes #990 Maven build extensions declared in `.mvn/extensions.xml` can introduce additional plugin dependencies (e.g. lifecycle participants, custom packaging types). Including this file in the cache key hash ensures that changes to extensions — which affect what plugin JARs Maven downloads — properly invalidate the cache, preventing stale caches from missing newly-required plugin dependencies. Changes: - src/cache.ts: add `**/.mvn/extensions.xml` to Maven pattern array - __tests__/cache.test.ts: update pattern expectations; add new test - README.md: document the new file in the Maven cache key hash list * test: update maven cache error test name for extensions.xml --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-08 10:07:54 +01:00
Lukasz	0f481fcb61	feat: Add distribution detection support to .sdkmanrc file (#975) ... * feat: Add distribution detection support to .sdkmanrc file Extends .sdkmanrc support to automatically detect Java distribution from SDKMAN identifiers (e.g., java=21.0.5-tem maps to temurin distribution). Makes distribution input optional when using .sdkmanrc with distribution suffix. * fix: align SDKMAN sem identifier mapping * fix: support SDKMAN albba identifier * docs: clarify sdkmanrc distribution inference scope Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Tencent Kona SDKMAN mapping and format sdkmanrc docs as a table - Map SDKMAN 'kona' identifier to the 'kona' distribution (added in #672) - Add a .sdkmanrc test case for the kona suffix - Convert the inline SDKMAN suffix mapping in advanced-usage.md to a table - Rebuild dist bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <bruno.borges@gmail.com>	2026-07-07 14:49:12 -04:00
Guillaume Smet	6657b99340	feat: Add set-default option (#1017) ... * Add set-default option This option allows to install an additional JDK without making it the default one. I have wanted this for quite a long time as I'm running custom GitHub Actions with Java, which might require a specific JDK and I don't want to pollute the JDK that is used by the overall workflow calling the action. And I'm apparently not alone as there was a preexisting issue. Fixes #560 * Dedupe setJavaDefault and document multi-version/toolchain behavior - Refactor setJavaDefault to delegate shared output/env logic to setJavaEnvironment, avoiding duplication between the two. - Document that set-default applies to all JDKs in a multiline java-version, and that installed JDKs remain registered in Maven toolchains regardless of set-default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: fix Prettier formatting in base-installer test Resolves the failing 'Basic validation / build' format-check on __tests__/distributors/base-installer.test.ts (line exceeded print width). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-07-07 12:38:57 -04:00
Bruno Borges	6c4d4a5025	feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) (#1053) ... * feat: suppress Maven transfer progress via MAVEN_ARGS by default Set MAVEN_ARGS to include -ntp (--no-transfer-progress) so Maven invocations in the job produce cleaner CI logs without download/transfer progress noise. Add a new optional 'show-download-progress' input (default false); set it to true to keep the progress output. The change preserves any existing MAVEN_ARGS value (the flag is appended, not overwritten) and is idempotent (it won't add the flag twice if -ntp or --no-transfer-progress is already present). Applies on all platforms; honored by Maven 3.9.0+ and the Maven Wrapper, and is a no-op for non-Maven builds. - action.yml: add show-download-progress input - src/constants.ts: add input + MAVEN_ARGS constants - src/maven-args.ts: new configureMavenArgs() - src/setup-java.ts: invoke configureMavenArgs() during setup - __tests__/maven-args.test.ts: unit tests - docs/advanced-usage.md: document the behavior and input - dist: rebuild bundled action Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Update generated dist for Maven args log change --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-02 17:12:50 -04:00
John	b150355f04	feat: Add verify-signature plumbing and Temurin+Microsoft verification support (#1060) ... * Add verify-signature plumbing and Temurin verification support * Rebuild dist after signature verification changes * Refine signature verification errors and regenerate dist * refactor: make gpg.ts generic, move Adoptium-specific constant to temurin distribution * fix: mock renameWinArchive in temurin tests and add signature e2e job * refactor: bundle Adoptium public key, replace keyserver lookup with local import * feat: add verify-signature-public-key input to allow custom GPG key override * refactor: extract Adoptium public key to adoptium-key.ts; tighten gpg.ts cleanup scope * Add verify-signature plumbing and Temurin verification support * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Add Microsoft signature verification support * Regenerate dist bundles for Microsoft signature checks * Harden Microsoft signature URL handling * Add setup-java-microsoft-signature-verification e2e job * chore: regenerate dist files * Fix e2e-versions: remove duplicate job, update signature jobs to checkout@v7 with env vars * Fix Prettier formatting in test files * fix: mock renameWinArchive in microsoft-installer tests to fix Windows CI failure * fix: use --homedir flag instead of GNUPGHOME env var for Windows GPG compatibility The Git-bundled GPG on Windows (MSYS2-based) does not automatically convert Windows-style paths in environment variables like GNUPGHOME. This caused GPG to fail with exit code 2 when verifying Microsoft JDK signatures on Windows, because the GNUPGHOME path (D:\a\_temp\...) was not recognized as a valid POSIX path. Fix: pass --homedir as an explicit command-line argument to both gpg --import and gpg --verify. MSYS2 does correctly convert Windows paths in command-line arguments, so this approach works reliably on Windows, Linux, and macOS. * fix: convert Windows paths to POSIX format for MSYS2 GPG on Windows The Git-bundled GPG on Windows (C:\Program Files\Git\usr\bin\gpg.exe) is an MSYS2-based binary that uses POSIX path conventions internally. When Windows-style paths with backslashes and drive letters (D:\a\_temp\...) are passed as arguments, GPG may fail to resolve them correctly, resulting in a fatal error (exit code 2). Fix: add a toGpgPath() helper that converts Windows paths to MSYS2 POSIX format (/d/a/_temp/...) before passing them to any gpg command. On Linux and macOS the helper is a no-op. Applied to all four paths used in verifyPackageSignature: - gpgHome (--homedir argument) - publicKeyFile (--import argument) - signaturePath (--verify signature argument) - archivePath (--verify data argument) * Fix gpg test formatting --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-06-29 13:19:49 +01:00
Bruno Borges	525097081d	Update undici artifacts to 6.27.0 (license cache + dist) (#1040) ... * Update undici license cache to 6.27.0 The Licensed check failed because the cached license record for undici was pinned to 6.24.1 while the installed dependency is 6.27.0, causing "license: mit, allowed: false" / source enumeration errors. Regenerate the cached record with `licensed cache` so it matches the installed version. `licensed status` now reports 0 errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Rebuild dist with undici 6.27.0 The committed dist/ bundle was built with undici 6.24.1, but the lockfile resolves undici 6.27.0. The check-dist workflow rebuilds the bundle and detected this drift (uncommitted changes after build). Rebuild dist/setup and dist/cleanup with `npm run build` so the committed bundle matches the installed undici 6.27.0, aligning with the license cache update in this PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 16:43:17 -04:00
mahabaleshwars	ce7f9ce621	Add Maven Wrapper cache feature (#1027) ... * add Maven Wrapper distribution caching * update test case --------- Co-authored-by: Bruno Borges <bruno.borges@gmail.com>	2026-06-22 09:45:18 -05:00
Jason Ginchereau	6e9017e125	Bump @actions/cache to 5.1.0, handle cache write denied (#1026)	2026-06-22 09:16:01 +01:00
Sean Proctor	baa1691374	fix: reject non-semver candidate versions in isVersionSatisfies (#1009) ... Distributions like JetBrains Runtime publish 4-segment versions such as '17.0.8.1+1080.1' that the semver package rejects. Both compareBuild and satisfies throw on these, which surfaced to users as "Error: Invalid Version: 17.0.8.1+1080.1" and aborted the whole install when any available version was non-semver. Guard with an early semver.valid check so unparseable versions are treated as a non-match. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-17 22:47:02 -05:00
dependabot[bot]	f300429fba	Bump @typescript-eslint/parser from 8.48.0 to 8.61.1 (#1021) ... * Bump @typescript-eslint/parser from 8.48.0 to 8.61.1 Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.48.0 to 8.61.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.1/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-version: 8.61.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run licensed and update dist --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-06-16 15:12:38 -07:00
dependabot[bot]	ad2b38190b	Bump @vercel/ncc from 0.38.1 to 0.44.0 (#1018) ... * Bump @vercel/ncc from 0.38.1 to 0.44.0 Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.38.1 to 0.44.0. - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](https://github.com/vercel/ncc/compare/0.38.1...0.44.0) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-version: 0.44.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * recompile dist --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-06-16 09:37:47 +02:00
John	43120bc3c3	Implement pagination with link headers for Adoptium based apis (#1014) ... * Use Link headers for Adoptium pagination * Fix nullable pagination URL types and rebuild dist * Add 1000-page safeguard for JetBrains pagination * Adjust plan for pagination safeguard scope * Move pagination safeguard to non-JetBrains installers * Add 1000-page safeguard to Adopt Temurin and Semeru pagination * Fix Prettier formatting in adopt, semeru, and temurin installer files * Fix CI audit failure by updating vulnerable transitive deps * Address PR review: RFC-compliant Link parsing, SSRF validation, centralized constant - Make getNextPageUrlFromLinkHeader RFC 8288 compliant by splitting link-values and checking for rel=next anywhere in the parameters, not just as the first parameter after the semicolon. - Add validatePaginationUrl utility to reject pagination URLs that point to unexpected origins (SSRF mitigation). - Centralize MAX_PAGINATION_PAGES in util.ts instead of duplicating across Adopt, Semeru, and Temurin installers. - Add tests for rel not being the first parameter, and for URL origin validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address code review feedback on pagination implementation - Tighten rel regex with word boundary to prevent false positives (e.g., rel="nextsomething" no longer matches). - Use parsed.origin comparison in validatePaginationUrl to correctly handle explicit default ports (e.g., :443 for HTTPS). - Fix pagination safeguard tests to use same-origin URLs so they actually exercise the 1000-page limit instead of being rejected by origin validation on the first request. - Add test for rel="nextsomething" not matching. - Add test for explicit default port acceptance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix prettier formatting in util.test.ts * Rebuild dist/ to fix check-dist CI failure --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-12 11:50:16 +01:00
dependabot[bot]	039af37997	Bump picomatch, @types/jest, jest, jest-circus and ts-jest (#1016) ... * Bump picomatch, @types/jest, jest, jest-circus and ts-jest Bumps [picomatch](https://github.com/micromatch/picomatch) to 4.0.4 and updates ancestor dependencies [picomatch](https://github.com/micromatch/picomatch), [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest), [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest), [jest-circus](https://github.com/jestjs/jest/tree/HEAD/packages/jest-circus) and [ts-jest](https://github.com/kulshekhar/ts-jest). These dependencies need to be updated together. Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4) Updates `@types/jest` from 29.5.14 to 30.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Updates `jest` from 29.7.0 to 30.4.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest) Updates `jest-circus` from 29.7.0 to 30.4.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest-circus) Updates `ts-jest` from 29.3.0 to 29.4.11 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/kulshekhar/ts-jest/compare/v29.3.0...v29.4.11) --- updated-dependencies: - dependency-name: "@types/jest" dependency-version: 30.0.0 dependency-type: direct:development - dependency-name: jest dependency-version: 30.4.2 dependency-type: direct:development - dependency-name: jest-circus dependency-version: 30.4.2 dependency-type: direct:development - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect - dependency-name: ts-jest dependency-version: 29.4.11 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * run licensed and update dist --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-06-12 10:05:41 +01:00
George Adams	1071fc12d6	fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser (#1015) ... * fix: update dependency license records and resolve npm audit vulnerabilities - Bump fast-xml-builder 1.1.4 → 1.2.0 (GHSA-5wm8-gmm8-39j9) - Bump fast-xml-parser 5.5.10 → 5.8.0 (GHSA-gh4j-gqv2-49f6) - Bump strnum 2.2.3 → 2.4.0 - Bump path-expression-matcher 1.4.0 → 1.5.0 - Add license records for new deps @nodable/entities and xml-naming * fix: add anynum license record and rebuild dist * re-run licensed	2026-06-12 09:49:51 +01:00
Copilot	c76542e033	chore: upgrade dependencies (@actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) (#999) ... * chore: upgrade dependencies and update license cache Agent-Logs-Url: https://github.com/actions/setup-java/sessions/55ba1e4b-a515-4177-8a35-44bffa4ad0c0 Co-authored-by: lmvysakh <187510632+lmvysakh@users.noreply.github.com> * chore: upgrade @actions/exec ^1.0.4→^2.0.0 and @actions/io ^1.0.2→^2.0.0 Agent-Logs-Url: https://github.com/actions/setup-java/sessions/8be3df50-f347-42da-9734-73f71bf89d40 Co-authored-by: lmvysakh <187510632+lmvysakh@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lmvysakh <187510632+lmvysakh@users.noreply.github.com>	2026-04-15 12:30:24 -05:00
dependabot[bot]	1d018f9b8b	Bump minimatch from 3.1.2 to 3.1.5 (#984) ... * Bump minimatch from 3.1.2 to 3.1.5 Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Check failure fix --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-03-02 15:50:04 -06:00
Salman Chishti	d81c4e45f3	Upgrade @actions/cache to v5 (#968) ... * Upgrade @actions/cache to v5 - Bump @actions/cache from 4.0.3 to 5.0.0 - Update license cache files for new/updated dependencies - Rebuild dist bundles - Mark @actions/http-client as reviewed in licensed config (MIT license text present but detected as 'other') * chore: Update version to 5.0.1 in package.json and package-lock.json * upgrade actions/cache to 5.0.1 --------- Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2026-01-20 09:24:36 -06:00
guicamest	4e7e684fbb	feat: Add support for .sdkmanrc file in java-version-file parameter (#736) ... * chore(e2e-versions): Add e2e test scenario on `setup-java-version-from-file-major-minor-patch-with-dist` for `.sdkmanrc` * chore(e2e-versions): Update `setup-java-version-from-file-major-minor-patch-with-dist` test to include the file name of the java-version-file that is used * feat: Add support for `.sdkmanrc` as *Java Version File* * chore: Add test for the latest known sdkman java versions * docs(advanced-usage): Document support for `.sdkmanrc` as java-version-file * chore(docs): Anyone can contribute and maintain 🤷 * Update advanced-usage.md Add example step/file for `.sdkmanrc` * Update advanced-usage.md * Update util.ts * chore: format and rebuild * chore: untouch toolchains.ts * fix check dist error --------- Co-authored-by: mahabaleshwars <147705296+mahabaleshwars@users.noreply.github.com>	2025-11-25 13:36:29 -06:00
mahabaleshwars	46c56d6f92	Add GitHub Token Support for GraalVM and Refactor Code (#849) ... * Code updated to let code accept github token and refactored the code. * github token accept through environment variable * fix test error * audit fix commit * update package-lock.json * Update GraalVM Tests * Lint Issue Resolve * Update Test case for Windows * update with enhance code and test	2025-11-18 12:04:23 -06:00
aparnajyothi-y	ead9eaa3cf	Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File (#767) ... * Regex update to fix #719 * Check failures fix * npm run format, npm run format-check & npm run build * Regex update * regex update * fixed check failures * updated regex * regex update for all the versions * regex and docmentation update * Regex update * format and doc update * doc format update * npm audit fix * resolve conflicts * resolve conflicts * resolve conflicts * doc update * Java version upgrade	2025-09-16 13:23:22 -05:00
gowridurgad	e9343db97e	Bumps form-data (#887) ... Co-authored-by: “gowridurgad” <“hgowridurgad@github.com>	2025-07-30 14:34:56 -05:00
dependabot[bot]	ae2b61dbc6	Bump undici from 5.28.5 to 5.29.0 (#833) ... * Bump undici from 5.28.5 to 5.29.0 Bumps [undici](https://github.com/nodejs/undici) from 5.28.5 to 5.29.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v5.28.5...v5.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Fix CI failures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: HarithaVattikuti <73516759+HarithaVattikuti@users.noreply.github.com>	2025-07-15 12:32:37 -05:00
aparnajyothi-y	c5195efecf	actions/cache upgrade to 4.0.3 (#773)	2025-04-08 09:20:46 -05:00
dependabot[bot]	dd38875f93	Bump ts-jest from 29.1.2 to 29.2.5 (#743) ... * Bump ts-jest from 29.1.2 to 29.2.5 Bumps [ts-jest](https://github.com/kulshekhar/ts-jest) from 29.1.2 to 29.2.5. - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/kulshekhar/ts-jest/compare/v29.1.2...v29.2.5) --- updated-dependencies: - dependency-name: ts-jest dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * check failures fix --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2025-04-08 09:19:01 -05:00
dependabot[bot]	148017a9b0	Bump @actions/glob from 0.4.0 to 0.5.0 (#744) ... * Bump @actions/glob from 0.4.0 to 0.5.0 Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.5.0. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * check failures fix --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2025-04-01 12:02:03 -05:00
aparnajyothi-y	b8ebb8ba1d	upgrade @action/cache from 4.0.0 to 4.0.2 (#766) ... * actions/cache upgrade to 4.0.2 * check failures fix * fix for licensed check failure	2025-03-19 13:20:08 -05:00
dependabot[bot]	3a4f6e1af5	Bump @types/jest from 29.5.12 to 29.5.14 (#729) ... * Bump @types/jest from 29.5.12 to 29.5.14 Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 29.5.12 to 29.5.14. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) --- updated-dependencies: - dependency-name: "@types/jest" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix for check failures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2025-01-28 10:20:39 -06:00
dependabot[bot]	d4e4b6bbc1	Bump @actions/http-client from 2.2.1 to 2.2.3 (#728) ... * Bump @actions/http-client from 2.2.1 to 2.2.3 Bumps [@actions/http-client](https://github.com/actions/toolkit/tree/HEAD/packages/http-client) from 2.2.1 to 2.2.3. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/http-client/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/http-client) --- updated-dependencies: - dependency-name: "@actions/http-client" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix for check-dist and license failures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2025-01-28 09:27:56 -06:00
aparnajyothi-y	51ab6d2e30	Update cache from 3.2.4 to 4.0.0 (#724) ... * update package-lock.json * licensed update and cache upgrade * cache upgrade	2025-01-16 16:05:15 -06:00
John Wesley Walker III	8df1039502	Refine isGhes logic (#697)	2024-10-21 19:57:52 +02:00
Priya Gupta	83a06ff9d9	Fix Windows archives extraction issue (#689)	2024-10-10 16:32:25 -05:00
Zxilly	40b9536ce5	fix: add arch to cache key (#664)	2024-09-19 08:51:30 -05:00
dependabot[bot]	fd08b9c8dc	Bump undici from 5.28.3 to 5.28.4 (#616) ... * Bump undici from 5.28.3 to 5.28.4 Bumps [undici](https://github.com/nodejs/undici) from 5.28.3 to 5.28.4. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v5.28.3...v5.28.4) --- updated-dependencies: - dependency-name: undici dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Bump undici from 5.28.3 to 5.28.4 Bumps [undici](https://github.com/nodejs/undici) from 5.28.3 to 5.28.4. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v5.28.3...v5.28.4) --- updated-dependencies: - dependency-name: undici dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * bump braces from 3.0.2 to 3.0.3 * Added Semver link --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: HarithaVattikuti <73516759+HarithaVattikuti@users.noreply.github.com>	2024-06-27 18:34:36 -05:00
mahabaleshwars	99b8673ff6	Patch for java version file (#610) ... * patch to extract file from other location * patch to extract filename from other directories * removed code failing checks * changed the validation for .java-version type	2024-03-14 09:12:58 -05:00
mahabaleshwars	5896cecc08	Added .tool-versions file support (#606) ... * added support for tool version file * testing with one regex * working regex * Checked for the file extension * added e2e checks for tool version * removed error warning * updated regex to support early version * updated regex for early version support * updated regex for early version * updated regex to accept early versions * added coreinfo to analyze * updated the regex * updated regex * new regex for early version * updated regex to match the new version file format * new regex * changed the regex * redex updated * used java version regex * regex updated * regex modified * regex updated * regex updated * regex updated * updated regex to support early versions * Regex updated to support all java versions * Documentation updated to add tool version description * Documentation updated for the tool version file * update the advanced doc and readme file to specify tool version changes	2024-03-12 08:45:42 -05:00
HarithaVattikuti	80ae3c2885	Update httpclient version and other dependencies (#607) ... * test * fixed license issues * fix audit issue * fix license	2024-03-08 10:25:58 -06:00
Peter Murray	16ef37f8dd	HTTP errors when the token is undefined (#556) ... * Fixing issues with the handling of the token and avoiding error on when the token is undefined * chore: rebuild action --------- Co-authored-by: Ivan Zosimov <ivanzosimov@github.com>	2023-12-01 14:55:03 +01:00
aparnajyothi-y	387ac29b30	Upgrade Node to v20 (#558) ... * Build changes * 4.0.0 * node version update * changes * upgrade to v20 * Removing conflicts * Upgrade to v20 in the reusable workflows * Rebased index.js * Removing conflicts * Resolving conflicts * Fomat check * failed checks fix	2023-11-29 15:11:46 +01:00