[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-java	action	major	v3 → v6

---

Release Notes

actions/setup-java

v6.2.0

Compare Source

What's Changed

• Fix Liberica SDKMAN patch release resolution by @​brunoborges in #​1291
• Update Undici to 6.29.1 by @​brunoborges in #​1308
• chore(deps): bump the monthly-npm-updates group with 12 updates by @​dependabot[bot] in #​1309
• Fix Liberica Java 25 release resolution by @​brunoborges in #​1313
• Add repository-specific Copilot instructions by @​brunoborges in #​1312
• Support exact Corretto release versions by @​electrum in #​1310
• Support Maven mirrors in generated settings.xml by @​brunoborges in #​1289

New Contributors

• @​electrum made their first contribution in #​1310

Full Changelog: actions/setup-java@v6.1.0...v6.2.0

v6.1.0

Compare Source

What's Changed

• Preserve compound Liberica build versions from .sdkmanrc by @​brunoborges with @​Copilot in #​1268
• Support Temurin on Linux RISC-V by @​yawkat in #​1269
• Stop GPG agent before removing signature-verification home by @​brunoborges with @​Copilot in #​1273
• Prefer Zulu 4-segment hotfix builds when resolving version ranges by @​brunoborges in #​1278
• Support Temurin JEP 322 patch versions like 26.0.2.1+1 by @​brunoborges in #​1279
• chore(deps): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in #​1274
• chore(deps): bump the monthly-npm-updates group with 13 updates by @​dependabot[bot] in #​1276
• feat: support Maven server credential origins by @​YunaBraska in #​1282
• Support Maven plugin repositories in generated settings.xml by @​brunoborges in #​1286

New Contributors

• @​yawkat made their first contribution in #​1269
• @​YunaBraska made their first contribution in #​1282

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

v6.0.1

Compare Source

What's Changed

• Fix failing GitHub Actions job for temurin 17 by @​brunoborges with @​Copilot in #​1259
• Fix Temurin EA E2E signature verification by @​brunoborges with @​Copilot in #​1260
• Fix Alpine GPG verification failures and support multiple keys by @​brunoborges in #​1262
• Fix import-safe checks when scripts are run from a path with symlinks by @​otaconix in #​1265
• Avoid macOS GPG socket overflow on long runner paths by @​brunoborges with @​Copilot in #​1266
• Complete v6 release highlights in README by @​brunoborges in #​1254
• Group and slow routine Dependabot updates by @​brunoborges in #​1255
• chore(deps-dev): update eslint and globals by @​dependabot[bot] in #​1256

New Contributors

• @​otaconix made their first contribution in #​1265

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

Compare Source

What's Changed

• dist: Migrate from Zulu Discovery API to Azul Metadata API by @​jameswald in #​1010
• feat: add .mvn/extensions.xml to Maven cache key pattern by @​brunoborges with @​Copilot in #​1041
• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1078
• Map Zulu x86 architecture to i686 for Azul Metadata API by @​brunoborges in #​1079
• Rename jdkFile input to jdk-file with deprecated alias by @​brunoborges in #​1083
• Infer distribution from asdf .tool-versions vendor prefix by @​brunoborges in #​1084
• Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1086
• feat: expose cache-primary-key output (#​597) by @​brunoborges in #​1088
• docs: clarify V6 ESM migration is not a user-facing breaking change by @​brunoborges in #​1090
• Support multi-field Java versions like 18.0.1.1 by @​brunoborges in #​1092
• docs: document seeding the Maven cache for plugin dependencies by @​brunoborges in #​1094
• docs: clarify Maven cache paths and key hash inputs by @​brunoborges in #​1096
• Support pinning java-version as "latest" by @​brunoborges in #​1093
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @​dependabot[bot] in #​1101
• chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @​dependabot[bot] in #​1103
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @​dependabot[bot] in #​1105
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1106
• chore(deps-dev): bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in #​1104
• dist: Cover Tencent Kona JDK 25 by @​johnshajiang in #​1108
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1102
• Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1111
• dist: Support Liberica NIK (#​878) by @​asm0dey in #​1112
• Fix template injection (zizmor alert #​118) in e2e-versions.yml by @​brunoborges with @​Copilot in #​1114
• Fix template injection in e2e-versions.yml (zizmor alert #​122) by @​brunoborges with @​Copilot in #​1120
• Disable persisted checkout credentials in e2e workflow by @​brunoborges with @​Copilot in #​1115
• feat: Update recommended configuration for GPG signing by @​wetneb in #​608
• Cache Maven and Gradle wrapper distributions separately from the dependency cache by @​brunoborges in #​1097
• Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @​brunoborges in #​1124
• Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @​brunoborges in #​1123
• Extract repeated directory-check assertions into check-dir.sh helper by @​brunoborges in #​1127
• Consolidate duplicate jobs in e2e-versions workflow by @​brunoborges in #​1125
• Use YAML anchors to reduce boilerplate in e2e-versions workflow by @​brunoborges in #​1126
• Updated msft json for now by @​jmjaffe37 in #​1129
• Document missing action inputs in README by @​brunoborges in #​1130
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​1128
• Add an option to disable Java problem matchers by @​brunoborges in #​1133
• docs: update setup-java examples by @​HarithaVattikuti in #​1131
• Clarify credential environment variable inputs by @​brunoborges in #​1134
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @​dependabot[bot] in #​1135
• chore(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​1143
• chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @​dependabot[bot] in #​1142
• chore(deps-dev): bump @​typescript-eslint/parser from 8.64.0 to 8.65.0 by @​dependabot[bot] in #​1138
• chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @​dependabot[bot] in #​1136
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1137
• chore(deps): fix npm audited vulnerabilities by @​mhoffrog in #​1140
• Fix formatting issues in README.md by @​brunoborges in #​1144
• Remediate npm audit findings and rebuild distributions by @​brunoborges with @​Copilot in #​1145
• Set GRAALVM_HOME for GraalVM distributions by @​brunoborges with @​Copilot in #​1146
• Add force-download option for reproducible JDK builds by @​brunoborges with @​Copilot in #​1148
• Add OpenJDK distribution by @​brunoborges with @​Copilot in #​1147
• Support Temurin JDKs with JMOD files by @​brunoborges with @​Copilot in #​1149
• Document Java package compatibility by distribution by @​brunoborges in #​1152
• Fix caching when wrapper distributions are absent by @​brunoborges in #​1151
• Reject invalid boolean input values by @​brunoborges in #​1160
• Fail on mismatched Maven toolchain ID counts by @​brunoborges in #​1161
• Consolidate JDK metadata retry handling by @​brunoborges in #​1162
• Add direct setup orchestration tests by @​brunoborges in #​1163
• Harden java-package validation across distributions by @​brunoborges in #​1165
• Verify JDK downloads with vendor checksums by @​brunoborges in #​1167
• Reduce change-time Java E2E matrix by @​brunoborges in #​1170
• Add read-only mode for dependency caching by @​brunoborges in #​1169
• Test Temurin 25 on hosted runners by @​brunoborges in #​1172
• Restore dependency and wrapper caches concurrently by @​brunoborges in #​1174
• Add dependency cache path overrides by @​brunoborges in #​1175
• Centralize OS/architecture capability validation by @​brunoborges in #​1178
• Optimize Temurin tool-cache fast path with lazy loading by @​brunoborges in #​1179
• Optimize Maven configuration warm path by @​brunoborges in #​1182
• Fix macOS e2e workflow assertions by @​brunoborges in #​1184
• Remove legacy Adopt distributions in v6 by @​brunoborges with @​Copilot in #​1185
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​1190
• Reimagine setup-java README by @​brunoborges in #​1192
• Document deprecation of setup-java v1 through v4 by @​brunoborges in #​1198
• Update setup-java README action from v6 to v5 by @​brunoborges in #​1199
• Highlight major changes in setup-java v5 by @​brunoborges in #​1200
• Highlight major changes in setup-java v6 by @​brunoborges in #​1203
• chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 by @​dependabot[bot] in #​1202
• Add conditional JDK caching by @​brunoborges in #​1201
• docs: fix README and advanced usage inconsistencies with actual behavior by @​brunoborges in #​1204
• Move the extracted JDK into the tool-cache instead of copying it by @​brunoborges in #​1206
• docs: drop benchmark numbers from the JDK caching section by @​brunoborges in #​1205
• docs: correct the mvn-toolchain-id default in README and action.yml by @​brunoborges in #​1207
• Cache resolved JDK releases to remove the vendor API from warm jobs by @​brunoborges in #​1208
• Report concrete versions for floating Oracle JDK downloads by @​jdubois in #​1213
• Import Maven signing keys into an isolated GPG home by @​jdubois in #​1214
• Reuse the tool cache for floating versions the resolution cache identified by @​brunoborges in #​1219
• Fix JetBrains Runtime release pagination by @​jdubois in #​1218
• Fix JDK resolution cache platform identity by @​jdubois in #​1210
• fix: select musl JDK artifacts on Alpine for Dragonwell, Corretto, Zulu and Liberica by @​brunoborges in #​1220
• Fix SapMachine early-access filtering by @​jdubois in #​1217
• Fix JetBrains GitHub token resolution by @​jdubois in #​1224
• Include gradle.properties in Gradle cache key by @​jdubois in #​1225
• Handle early dependency cache failures during Java setup by @​jdubois in #​1226
• Fix js-yaml audit vulnerability by @​brunoborges in #​1228
• Fix failing GitHub Actions job for graalvm 24-ea by @​brunoborges with @​Copilot in #​1227
• Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date by @​jmjaffe37 in #​1236
• chore(deps-dev): bump globals from 17.8.0 to 17.9.0 by @​dependabot[bot] in #​1233
• chore(deps-dev): bump @​types/semver from 7.7.1 to 7.8.0 by @​dependabot[bot] in #​1229
• chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 by @​dependabot[bot] in #​1231
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.65.0 to 8.67.0 by @​dependabot[bot] in #​1232
• Test JDK 26 installation from SDKMAN by @​brunoborges in #​1238
• Add support for multiple Maven servers by @​brunoborges in #​1239
• Add Maven dependency-resolution repositories by @​brunoborges in #​1240
• Add Red Hat Build of OpenJDK support by @​brunoborges in #​1241
• Fix Oracle macOS E2E version check by @​brunoborges in #​1243
• ci: constrain cache e2e job modes by @​philip-gai in #​1244
• Expose contributing guide to GitHub by @​brunoborges in #​1245
• Set default signature verification for supported distributions by @​johnoliver in #​1246
• chore(deps): combine open Dependabot npm updates by @​brunoborges in #​1252
• Prepare documentation for v6 release by @​brunoborges in #​1253

New Contributors

• @​jameswald made their first contribution in #​1010
• @​asm0dey made their first contribution in #​1112
• @​wetneb made their first contribution in #​608
• @​philip-gai made their first contribution in #​1128

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

v5.7.0

Compare Source

What's Changed

• Fix npm audit failures on releases/v5 by @​brunoborges in #​1154
• Backport #​1151: Fix missing wrapper cache distributions by @​brunoborges in #​1153
• Deprecate legacy Adopt distributions in v5 by @​brunoborges in #​1186

Full Changelog: actions/setup-java@v5.6.0...v5.7.0

v5.6.0

Compare Source

What's Changed

• Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1087
• feat: expose cache-primary-key output (#​597) [v5 backport] by @​brunoborges in #​1089
• dist: Cover Tencent Kona JDK 25 (#​1108) [v5 backport] by @​brunoborges in #​1110
• Backport #​1111: Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1113
• Backport #​1097/#​1098 to v5: cache Maven and Gradle wrapper distributions separately by @​brunoborges in #​1122

Full Changelog: actions/setup-java@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

• chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by @​brunoborges in #​1061
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​1069
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1068
• Bump actions/setup-python from 5 to 6 by @​dependabot[bot] in #​1067
• Bump @​typescript-eslint/parser from 8.61.1 to 8.62.0 by @​dependabot[bot] in #​1062
• feat: Add verify-signature plumbing and Temurin+Microsoft verification support by @​johnoliver in #​1060
• Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by @​jmjaffe37 in #​1070
• Fix arm64 e2e workflow tests mislabeled as x64 by @​brunoborges with @​Copilot in #​1073
• feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by @​brunoborges in #​1053
• feat: Disable interactiveMode in generated Maven settings.xml by @​brunoborges with @​Copilot in #​1052
• Bump prettier from 3.6.2 to 3.9.1 by @​dependabot[bot] in #​1066
• chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by @​dependabot[bot] in #​1074
• fix: Maven Toolchains grows unexpectedly by @​Okeanos in #​534
• dist: Support Tencent Kona JDK by @​johnshajiang in #​672
• feat: Add set-default option by @​gsmet in #​1017
• docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by @​brunoborges in #​1075
• feat: Add distribution detection support to .sdkmanrc file by @​lukaszgyg in #​975

New Contributors

• @​jmjaffe37 made their first contribution in #​1070
• @​gsmet made their first contribution in #​1017
• @​lukaszgyg made their first contribution in #​975

Full Changelog: actions/setup-java@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

• Bump @​typescript-eslint/parser from 8.48.0 to 8.61.1 by @​dependabot[bot] in #​1021
• Fix codeql workflow permissions by @​jsoref in #​993
• fix CodeQL permissions by @​gdams in #​1025
• fix: reject non-semver candidate versions in isVersionSatisfies by @​sproctor in #​1009
• Bump @​actions/cache to 5.1.0, handle cache write denied by @​jasongin in #​1026
• Add Maven Wrapper cache feature by @​mahabaleshwars in #​1027
• Spelling by @​jsoref in #​713
• add link to advanced configuration for JetBrains by @​robstoll in #​850
• docs(action): fix missing required or default fields by @​kranthipoturaju in #​1007
• feat: add microsoft openjdk 17.0.18 by @​al-kau in #​1002
• Update README.md - use "alert syntax for Markdown" for notes by @​mhoffrog in #​924
• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​1033
• Update contributor guide with emoji for clarity by @​brunoborges in #​1028
• add javac problem matcher by @​Trass3r in #​562
• Clarify README version syntax and migration guidance by @​brunoborges with @​Copilot in #​1038
• Update undici artifacts to 6.27.0 (license cache + dist) by @​brunoborges in #​1040
• docs: enhance custom jdk file installation by @​stephanabel in #​996
• Templates for new Java distributions by @​panticmilos in #​429
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1032
• Bump @​types/node from 25.9.3 to 26.0.0 by @​dependabot[bot] in #​1031
• docs: replace non-existent HelloWorldApp references with java --version by @​brunoborges with @​Copilot in #​1043
• docs: add JavaFX Maven project configuration instructions by @​brunoborges with @​Copilot in #​1044
• docs: self-signed certificate / internal CA handling for GitHub Enterprise by @​brunoborges in #​1050
• docs: document importing an internal CA into the installed JDK (cacerts) by @​brunoborges in #​1051
• chore: Harden workflows: least-privilege permissions + zizmor integration by @​brunoborges in #​1039
• dist: Add GraalVM Community distribution support by @​brunoborges with @​Copilot in #​1042
• docs: note jdkfile approach for Early Access / unreleased JDK builds by @​brunoborges in #​1058
• dist: Apply Copilot review suggestions from PR #​1042 (GraalVM Community) by @​brunoborges in #​1059

New Contributors

• @​jsoref made their first contribution in #​993
• @​sproctor made their first contribution in #​1009
• @​jasongin made their first contribution in #​1026
• @​robstoll made their first contribution in #​850
• @​kranthipoturaju made their first contribution in #​1007
• @​al-kau made their first contribution in #​1002
• @​mhoffrog made their first contribution in #​924
• @​brunoborges made their first contribution in #​1028
• @​Trass3r made their first contribution in #​562
• @​stephanabel made their first contribution in #​996

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in #​969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in #​989
• chore: upgrade dependencies (@​actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @​Copilot in #​999
• Add Oracle JDK 17 licensing limitation note by @​mahabaleshwars in #​1001
• Update readme for ubuntu sudo java_home behavior by @​mahabaleshwars in #​1013
• temurin: add support for Alpine Linux by @​gdams in #​674
• fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @​gdams in #​1015
• Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @​dependabot[bot] in #​952
• Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot[bot] in #​881
• Bump picomatch, @​types/jest, jest, jest-circus and ts-jest by @​dependabot[bot] in #​1016
• Bump @​types/node from 24.1.0 to 25.9.3 by @​dependabot[bot] in #​950
• Implement pagination with link headers for Adoptium based apis by @​johnoliver in #​1014
• Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @​johnoliver in #​522
• Bump @​vercel/ncc from 0.38.1 to 0.44.0 by @​dependabot[bot] in #​1018

New Contributors

• @​alaahong made their first contribution in #​969
• @​Copilot made their first contribution in #​999
• [@&CID-3512: Fix Snyk vulnerabilities #82

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

LeanIX GitHub Agent Code Coverage

Overall Project	64.09%	🍏

There is no coverage information present for the Files changed