Make Java problem matcher opt-in (#1326)

Default the problem-matcher input to false so setup-java no longer
registers Java compiler and uncaught-exception annotations unless
explicitly enabled with problem-matcher: true.

Fixes #1322

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/copilot-instructions.md

@@ -0,0 +1,43 @@
+# Copilot instructions
+
+## Build, test, and lint
+
+Use Node.js 24 or later (`package.json` declares `>=24.0.0`).
+
+- `npm ci` installs the locked dependencies.
+- `npm test` runs Jest serially with coverage.
+- `npm test -- --runTestsByPath __tests__/setup-java.test.ts` runs one test file.
+- `npm test -- --runTestsByPath __tests__/setup-java.test.ts --testNamePattern="pattern"` filters that file to matching test names.
+- `npm run lint` runs ESLint on TypeScript files.
+- `npm run format-check` checks Prettier formatting; `npm run format` applies it.
+- `npm run build` bundles the setup and post-job entrypoints into `dist/`.
+- `npm run check` runs format check, lint, build, and the full test suite.
+
+## Architecture
+
+This repository implements a Node.js GitHub Action. `action.yml` defines its inputs and outputs and runs `dist/setup/index.js` as the main entrypoint and `dist/cleanup/index.js` as the post-job entrypoint. The TypeScript sources in `src/` are bundled with NCC; the committed `dist/` files are what the action executes.
+
+The setup entrypoint parses inputs, resolves versions, and configures the action's shared features. `src/distributions/distribution-factory.ts` lazily selects a vendor installer. Vendor installers implement metadata lookup and archive handling on top of `JavaBase` in `src/distributions/base-installer.ts`, which centralizes version resolution, tool-cache/JDK-cache use, download verification, and Java environment setup. Package support and OS/architecture support are validated centrally in `package-types.ts` and `platform-types.ts`.
+
+The setup flow also configures problem matchers, Maven authentication and arguments, and Maven toolchains. The post-job entrypoint removes any isolated GPG home and saves enabled caches when the job succeeds and cache saving is not read-only.
+
+## Repository-specific conventions
+
+- Keep TypeScript source imports ESM-compatible: relative imports include the `.js` extension, even when the source file is `.ts`.
+- Distribution-specific download and metadata logic belongs in its installer under `src/distributions/`; reuse `JavaBase` rather than duplicating common resolution, caching, verification, or environment behavior.
+- When adding or changing distribution support, keep the distribution enum, factory, package-capability map, platform-capability map, README support documentation, unit tests, and relevant end-to-end workflow coverage consistent.
+- Unit tests live under `__tests__/` and use Jest/ts-jest. Distribution tests are grouped under `__tests__/distributors/`; use the corresponding test and fixture patterns when changing an installer. End-to-end coverage is defined in `.github/workflows/e2e-*.yml`.
+- Rebuild and commit generated `dist/` bundles for runtime-affecting source or dependency changes; do not make the bundles the source of truth. `npm run check` includes the build.
+- New npm dependencies need lockfile changes and corresponding license records under `.licenses/`, following `.licensed.yml` and the licensed workflow.
+
+## Action behavior principles
+
+- Treat `action.yml` inputs, outputs, defaults, and compatibility aliases as the public API. Keep implementation, README, and advanced-usage documentation aligned when behavior changes; preserve deprecated aliases unless a documented breaking change removes them.
+- Do not assume version syntax, package variants, or platform/architecture support is uniform across distributions. Keep capability checks and vendor resolution behavior consistent with the documented support matrix. `latest` means the newest stable GA release, not an early-access build.
+- Preserve selection semantics: a recognized vendor in a supported version file may supply the distribution; otherwise the caller must provide it. If both `java-version` and `java-version-file` are given, the explicit `java-version` takes precedence.
+- Preserve install-state behavior for multiple JDKs. The last installed JDK becomes the default unless `set-default: false`; all installed JDKs remain available through their version-specific environment variables and Maven toolchains. Toolchain entries accumulate non-destructively, and custom IDs must correspond one-for-one with requested versions.
+- Treat dependency, wrapper, and JDK caches as distinct features with distinct keys and save behavior. `cache` enables dependency caching and implicitly enables JDK caching unless `cache-jdk` overrides it; `cache-read-only` restores without saving. Keep changes to cache identity or lifecycle aligned with these documented contracts.
+- Preserve download-integrity guarantees: verify authoritative checksums when published. Signature verification is distribution-specific; explicit `verify-signature: true` must enforce verification where supported and fail clearly where unsupported. Do not silently weaken verification or imply that a cached install was downloaded and reverified.
+- Keep Maven credential inputs as environment-variable names, not secret values. Generated settings and custom repository behavior must respect the documented overwrite option, while toolchain merging remains non-destructive and independent of that option.
+
+See `docs/CONTRIBUTING.md` for contribution and validation guidance, `README.md` for the public contract, and `docs/advanced-usage.md` for detailed behavior and examples.

.github/workflows/e2e-publishing.yml

@@ -175,6 +175,94 @@ jobs:
             throw "settings.xml file is not found in expected location"
           }
 
+  test-maven-mirrors:
+    name: Maven mirrors (${{ matrix.mirror-of }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+        mirror-of: ['*', 'external:*']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Configure Maven mirrors without repository inputs
+        uses: $/
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+          settings-path: ${{ runner.temp }}/maven-mirror-test
+          mvn-server-credentials: |
+            private:PRIVATE_USERNAME:PRIVATE_TOKEN
+          mvn-mirrors: |
+            private:https://mirror.example.invalid/maven:${{ matrix.mirror-of }}
+      - name: Validate generated settings and Maven mirror selection
+        env:
+          MIRROR_OF: ${{ matrix.mirror-of }}
+          PRIVATE_USERNAME: mirror-test-user
+          PRIVATE_TOKEN: mirror-test-token
+        run: |
+          $directory = Join-Path $env:RUNNER_TEMP "maven-mirror-test"
+          $settingsPath = Join-Path $directory "settings.xml"
+          [xml]$settings = Get-Content -Path $settingsPath -Raw
+          $mirrors = @($settings.settings.mirrors.mirror)
+          if ($mirrors.Count -ne 1 -or $mirrors[0].id -ne "private" -or $mirrors[0].url -ne "https://mirror.example.invalid/maven" -or $mirrors[0].mirrorOf -ne $env:MIRROR_OF) {
+            throw "Incorrect generated mirror"
+          }
+          if ($settings.settings.profiles -or $settings.settings.activeProfiles) {
+            throw "Mirror-only settings must not add repository profiles"
+          }
+          $server = $settings.settings.servers.server
+          if ($server.id -ne "private" -or $server.username -ne '${env.PRIVATE_USERNAME}' -or $server.password -ne '${env.PRIVATE_TOKEN}') {
+            throw "Mirror credentials were not preserved"
+          }
+
+          $pomPath = Join-Path $directory "pom.xml"
+          @'
+          <project xmlns="http://maven.apache.org/POM/4.0.0">
+            <modelVersion>4.0.0</modelVersion>
+            <groupId>setup-java.test</groupId>
+            <artifactId>mirror-settings</artifactId>
+            <version>1.0</version>
+            <repositories>
+              <repository>
+                <id>pom-dependencies</id>
+                <url>https://dependencies.example.invalid/maven</url>
+              </repository>
+            </repositories>
+            <pluginRepositories>
+              <pluginRepository>
+                <id>pom-plugins</id>
+                <url>https://plugins.example.invalid/maven</url>
+              </pluginRepository>
+            </pluginRepositories>
+          </project>
+          '@ | Set-Content -Path $pomPath
+
+          # validate requires no plugins or dependencies, so mirror selection can
+          # be inspected offline without contacting the deliberately invalid URLs.
+          $output = & mvn --batch-mode --no-transfer-progress --offline --debug `
+            --settings $settingsPath --file $pomPath `
+            "-Dmaven.repo.local=$directory/repository" validate 2>&1
+          if ($LASTEXITCODE -ne 0) {
+            throw "Could not inspect Maven mirror selection: $output"
+          }
+          $log = $output -join "`n"
+          foreach ($id in @("central", "pom-dependencies")) {
+            $expected = "Using mirror private (https://mirror.example.invalid/maven) for $id ("
+            if (-not $log.Contains($expected)) {
+              throw "Maven did not select the mirror for ${id}: $log"
+            }
+          }
+          foreach ($type in @("dependencies", "plugins")) {
+            $pattern = 'Repositories \(' + $type + '\)\s*: \[private \(https://mirror\.example\.invalid/maven, [^\]]+\)\]'
+            if ($log -notmatch $pattern) {
+              throw "Maven did not redirect all $type repositories: $log"
+            }
+          }
+
   test-maven-repositories:
     name: Maven ${{ matrix.repositories }} repositories
     runs-on: ${{ matrix.os }}

.github/workflows/e2e-versions.yml

@@ -51,6 +51,15 @@ jobs:
           - distribution: microsoft
             os: macos-latest
             version: 25
+          - distribution: microsoft
+            os: windows-latest
+            version: '25.0.5+0.2'
+          - distribution: microsoft
+            os: ubuntu-latest
+            version: '25.0.5+0.2'
+          - distribution: microsoft
+            os: macos-latest
+            version: '25.0.5+0.2'
           - distribution: kona
             os: windows-latest
             version: 25

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 6.2.0
+version: 6.3.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@azure/core-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-client"
-version: 1.11.0
+version: 1.11.1
 type: npm
 summary: Core library for interfacing with AutoRest generated code
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-client/

.licenses/npm/@azure/core-rest-pipeline-1.23.0.dep.yml

@@ -0,0 +1,32 @@
+---
+name: "@azure/core-rest-pipeline"
+version: 1.23.0
+type: npm
+summary: Isomorphic client library for making HTTP requests in node.js and browser.
+homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-rest-pipeline/
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    Copyright (c) Microsoft Corporation.
+
+    MIT License
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/@azure/storage-blob.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-blob"
-version: 12.33.0
+version: 12.31.0
 type: npm
 summary: Microsoft Azure Storage SDK for JavaScript - Blob
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob/README.md
+homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/storage-common.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/storage-common"
-version: 12.4.1
+version: 12.5.0
 type: npm
 summary: Azure Storage Common Client Library for JavaScript
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-common/README.md

.licenses/npm/@nodable/entities.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@nodable/entities"
-version: 3.0.0
+version: 3.1.0
 type: npm
 summary: Entity parser for XML, HTML, External entites with security and NCR control
 homepage:

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.7
+version: 0.3.9
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/ts-http-runtime/README.md

.licenses/npm/fast-xml-builder.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-builder
-version: 1.3.0
+version: 1.3.1
 type: npm
 summary: Build XML from JSON without C/C++ based libraries
 homepage:

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.11.1
+version: 5.12.0
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/is-unsafe.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: is-unsafe
-version: 2.0.0
+version: 2.0.3
 type: npm
 summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
   HTML, XML, SVG, SQL, SHELL, and REGEX contexts

.licenses/npm/strnum.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.4.2
+version: 2.5.1
 type: npm
 summary: Parse String to Number based on configuration
 homepage:

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.29.0
+version: 6.29.1
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

README.md

@@ -59,7 +59,7 @@ steps:
 - Warm JDK-cached jobs can reuse cached release metadata, avoiding vendor API calls while retaining a stale-metadata fallback for vendor outages and rate limits.
 - Maven configuration now supports multiple server credentials and custom dependency-resolution repositories.
 - Maven signing keys are imported into an isolated temporary GPG home instead of the runner's default keyring.
-- Set `problem-matcher: false` to disable Java compiler and uncaught-exception annotations.
+- Java compiler and uncaught-exception annotations are now disabled by default. Set `problem-matcher: true` to enable them.
 - GraalVM distributions now set `GRAALVM_HOME` in addition to `JAVA_HOME`.
 - Invalid boolean values, unsupported distribution/package/platform combinations, and mismatched Maven toolchain ID counts now fail with targeted errors.
 - Renamed environment-variable-name inputs so they are not mistaken for secret values:
@@ -155,7 +155,7 @@ steps:
 | `check-latest` | Check remote metadata for the latest version satisfying the version spec before using the runner tool cache. | `false` |
 | `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
 | `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
-| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
+| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `false` |
 | `verify-signature` | Verify downloaded Java package signatures when supported. Explicitly setting this to `true` makes verification failures fatal. | Distribution-dependent; see [Download integrity and signatures](#download-integrity-and-signatures) |
 | `verify-signature-public-key` | One or more ASCII-armored GPG public keys used for signature verification. Concatenate multiple armored key blocks. Custom keys replace the bundled distribution keys. | |
 | `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
@@ -171,6 +171,7 @@ steps:
 | `mvn-server-repository-origins` | Multiline Maven credential origins in the format `server-id:repository-origin`. Each origin must belong to a configured server ID. Requires Maven 3.10+. | |
 | `mvn-repositories` | Multiline Maven dependency repositories in the format `repository-id:repository-url:snapshots-enabled`. | |
 | `mvn-plugin-repositories` | Multiline Maven plugin repositories in the format `repository-id:repository-url:snapshots-enabled`. Can be used independently of `mvn-repositories`. | |
+| `mvn-mirrors` | Multiline Maven mirrors in the format `mirror-id:mirror-url:mirror-of`. Redirect matching dependency and plugin repositories; use a matching server ID for authentication. | |
 | `mvn-repositories-include-central` | Include Maven Central for dependency and plugin repositories in the generated profile. When `false`, Central is disabled for both types unless that type explicitly declares `central`. Has no effect when neither repository list is configured. | `true` |
 | `mvn-repositories-prioritize-central` | Place Maven Central before custom dependency and plugin repositories. Has no effect when Central is excluded or neither repository list is configured. | `true` |
 | `settings-path` | Directory where `settings.xml` is written. | `~/.m2` |
@@ -224,6 +225,7 @@ Additional distribution notes:
 
 - Oracle OpenJDK builds are archived after a limited number of releases and no longer receive security updates. To continue receiving security patches, use Oracle JDK or another vendor.
 - Azul Zulu maps `arm64` to `aarch64` when querying the Azul Metadata API.
+- Microsoft Build of OpenJDK uses Microsoft's live version manifest, falling back to the bundled version list when no release matches. Version `25.0.5.0.2` can also be requested as `25.0.5+0.2`.
 - GraalVM Community is available as `distribution: graalvm-community` for stable JDK 17 and later releases.
 - On Ubuntu runners, commands executed with `sudo` do not inherit the `JAVA_HOME` and `PATH` set by `setup-java` and may fall back to the system-default JDK.
 
@@ -490,6 +492,11 @@ match `mvn-server-credentials` IDs when authentication is required.
 See [Resolving Maven dependencies from custom repositories](docs/advanced-usage.md#resolving-maven-dependencies-from-custom-repositories)
 and [Resolving Maven plugins from custom repositories](docs/advanced-usage.md#resolving-maven-plugins-from-custom-repositories).
 
+To redirect repositories, including Central and repositories declared in project
+or parent POMs, use [`mvn-mirrors`](docs/advanced-usage.md#redirecting-maven-repositories-with-mirrors).
+It works independently of the repository inputs; a `mirrorOf` pattern of `*`
+routes all dependency and plugin repositories through the configured mirror.
+
 > [!WARNING]
 > `mvn-repositories-include-central: false` now disables inherited Maven Central
 > for **both dependencies and plugins**, even in existing workflows that only

__tests__/auth.test.ts

@@ -882,6 +882,186 @@ describe('auth tests', () => {
     ]);
   });
 
+  it.each([
+    '*',
+    'central',
+    'external:*',
+    'external:http:*',
+    '*,!internal',
+    'external:*,!internal',
+    '!internal,external:http:*',
+    'external:*,!external:http:*'
+  ])('preserves the mirror selector %s and URL colons', mirrorOf => {
+    expect(
+      auth.parseMavenMirrors([
+        '',
+        ' \t ',
+        ` private : https://[2001:db8::1]:8443/maven : ${mirrorOf} `,
+        'public:https://repo.example.com:443/releases:central'
+      ])
+    ).toEqual([
+      {
+        id: 'private',
+        url: 'https://[2001:db8::1]:8443/maven',
+        mirrorOf
+      },
+      {
+        id: 'public',
+        url: 'https://repo.example.com:443/releases',
+        mirrorOf: 'central'
+      }
+    ]);
+  });
+
+  it.each([
+    'https://repo.example.com:8443',
+    'https://repo.example.com:8443/maven',
+    'https://[2001:db8::1]',
+    'https://[2001:db8::1]/maven',
+    'https://[2001:db8::1]:8443',
+    'https://[2001:db8::1]:8443/maven',
+    'https://repo.example.com/maven?redirect=https%3A//upstream.example.com%3A8443',
+    'https://repo.example.com/maven#urn%3Aartifact',
+    'https://repo.example.com/maven?redirect=https://upstream.example.com:8443',
+    'https://repo.example.com/maven#urn:artifact'
+  ])('preserves the complete mirror URL %s with an explicit selector', url => {
+    expect(
+      auth.parseMavenMirrors([`private:${url}:external:http:*,!internal`])
+    ).toEqual([{id: 'private', url, mirrorOf: 'external:http:*,!internal'}]);
+  });
+
+  it.each([
+    'private',
+    'private:https://repo.example.com',
+    'private:https://repo.example.com:8443',
+    'private:https://repo.example.com:8443/maven',
+    'private:https://[2001:db8::1]',
+    'private:https://[2001:db8::1]/maven',
+    'private:https://[2001:db8::1]:8443',
+    'private:https://[2001:db8::1]:8443/maven',
+    'private:repo.example.com:central',
+    ':https://repo.example.com:*',
+    'private::*',
+    'private:https://repo.example.com:',
+    'private: :*',
+    'private:https://repo.example.com: '
+  ])('rejects malformed mirror entry %s with a line number', entry => {
+    expect(() => auth.parseMavenMirrors(['', entry])).toThrow(
+      'Invalid mvn-mirrors entry at line 2.'
+    );
+  });
+
+  it('rejects duplicate mirror IDs after trimming', () => {
+    expect(() =>
+      auth.parseMavenMirrors([
+        'private:https://first.example.com:*',
+        ' private :https://second.example.com:central'
+      ])
+    ).toThrow("Duplicate mirror-id 'private' in mvn-mirrors input at line 2");
+  });
+
+  it('leaves settings unchanged for absent or blank mirrors', () => {
+    const servers = credentials('github', 'USERNAME', 'PASSWORD');
+    expect(auth.parseMavenMirrors(['', ' ', '\t'])).toEqual([]);
+    expect(auth.generate(servers, undefined, undefined, [])).toBe(
+      auth.generate(servers)
+    );
+    expect(auth.generate(servers)).not.toContain('<mirrors>');
+  });
+
+  it('generates public mirrors without credentials or repository profiles', () => {
+    const mirrors = auth.parseMavenMirrors([
+      'public:https://repo.example.com:external:*',
+      'fallback:https://other.example.com:central'
+    ]);
+    const xml = auth.generate([], undefined, undefined, mirrors);
+    expect(parseXmlObject(xml)).toMatchObject({
+      settings: {mirrors: {mirror: mirrors}}
+    });
+    expect(xml).not.toContain('<profiles>');
+    expect(xml).not.toContain('<activeProfiles>');
+  });
+
+  it('escapes all mirror fields as XML text', () => {
+    const mirror = {
+      id: 'private<&>',
+      url: 'https://repo.example.com/maven?a=1&b=<value>',
+      mirrorOf: '*,!internal<&>'
+    };
+    const xml = auth.generate([], undefined, undefined, [mirror]);
+    expect(xml).toContain('<id>private&lt;&amp;&gt;</id>');
+    expect(xml).toContain('a=1&amp;b=&lt;value&gt;');
+    expect(xml).toContain('<mirrorOf>*,!internal&lt;&amp;&gt;</mirrorOf>');
+    expect(parseXmlObject(xml)).toMatchObject({
+      settings: {mirrors: {mirror}}
+    });
+  });
+
+  it.each([
+    {combined: false, overwrite: true},
+    {combined: true, overwrite: true},
+    {combined: true, overwrite: false}
+  ])(
+    'configures mirrors with combined=$combined and overwrite=$overwrite',
+    async ({combined, overwrite}) => {
+      const directory = path.join(m2Dir, 'mirrors');
+      const location = path.join(directory, MVN_SETTINGS_FILE);
+      fs.mkdirSync(directory, {recursive: true});
+      fs.writeFileSync(location, 'EXISTING SETTINGS');
+      const url = 'https://maven.example.com/releases';
+      const inputs: Record<string, string> = {
+        'settings-path': directory,
+        'overwrite-settings': String(overwrite),
+        'mvn-repositories-include-central': 'false',
+        ...(combined ? {'gpg-passphrase-env-var': 'GPG_PASSPHRASE'} : {})
+      };
+      const multilineInputs: Record<string, string[]> = {
+        'mvn-server-credentials': ['private:PRIVATE_USERNAME:PRIVATE_TOKEN'],
+        'mvn-mirrors': [`private:${url}:*`],
+        ...(combined
+          ? {
+              'mvn-repositories': [`private:${url}:false`],
+              'mvn-plugin-repositories': [`private:${url}:false`]
+            }
+          : {})
+      };
+      jest.mocked(core.getInput).mockImplementation(name => inputs[name] ?? '');
+      jest
+        .mocked(core.getMultilineInput)
+        .mockImplementation(name => multilineInputs[name] ?? []);
+
+      await auth.configureAuthentication();
+
+      const xml = fs.readFileSync(location, 'utf8');
+      if (!overwrite) {
+        expect(xml).toBe('EXISTING SETTINGS');
+        return;
+      }
+      expect(parseXmlObject(xml)).toMatchObject({
+        settings: {
+          mirrors: {mirror: {id: 'private', url, mirrorOf: '*'}},
+          servers: {
+            server: {
+              id: 'private',
+              username: '${env.PRIVATE_USERNAME}',
+              password: '${env.PRIVATE_TOKEN}'
+            }
+          }
+        }
+      });
+      if (combined) {
+        expect(xml).toContain('<repositories>');
+        expect(xml).toContain('<pluginRepositories>');
+        expect(xml).toContain('<gpg.passphraseEnvName>GPG_PASSPHRASE');
+      } else {
+        expect(xml).not.toContain('<profiles>');
+        expect(core.getInput).not.toHaveBeenCalledWith(
+          'mvn-repositories-include-central'
+        );
+      }
+    }
+  );
+
   it.each(repositoryInputs)(
     'parses %s while preserving colons in URLs',
     inputName => {

__tests__/distributors/corretto-installer.test.ts

@@ -244,19 +244,282 @@ describe('getAvailableVersions', () => {
       ).rejects.toThrow('Early access versions are not supported');
     });
 
-    it('with non major version expect to throw not supported error', async () => {
+    it.each(['18.0.1', '17.0.13.11', '17.0.13.11.1.1'])(
-      const version = '18.0.1';
+      'rejects partial or malformed release %s',
+      async version => {
+        const distribution = new CorrettoDistribution({
+          version,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: false
+        });
+        mockPlatform(distribution, 'linux');
+
+        await expect(
+          distribution['findPackageForDownload'](version)
+        ).rejects.toThrow(
+          'Specify a major version or a full Corretto release, such as 25.0.5.0.10'
+        );
+      }
+    );
+
+    it.each([
+      [
+        '25.0.5.0.10',
+        'linux',
+        'x64',
+        'jdk',
+        '25.0.5+0.10',
+        'https://corretto.aws/downloads/resources/25.0.5.0.10/amazon-corretto-25.0.5.0.10-linux-x64.tar.gz'
+      ],
+      [
+        '25.0.5+0.10',
+        'macos',
+        'arm64',
+        'jdk',
+        '25.0.5+0.10',
+        'https://corretto.aws/downloads/resources/25.0.5.0.10/amazon-corretto-25.0.5.0.10-macosx-aarch64.tar.gz'
+      ],
+      [
+        '17.0.2.8.1',
+        'windows',
+        'x64',
+        'jdk',
+        '17.0.2+8.1',
+        'https://corretto.aws/downloads/resources/17.0.2.8.1/amazon-corretto-17.0.2.8.1-windows-x64-jdk.zip'
+      ],
+      [
+        '25.0.5.0.10',
+        'alpine',
+        'aarch64',
+        'jdk',
+        '25.0.5+0.10',
+        'https://corretto.aws/downloads/resources/25.0.5.0.10/amazon-corretto-25.0.5.0.10-alpine-linux-aarch64.tar.gz'
+      ],
+      [
+        '11.0.14.10.1',
+        'linux',
+        'armv7',
+        'jdk',
+        '11.0.14+10.1',
+        'https://corretto.aws/downloads/resources/11.0.14.10.1/amazon-corretto-11.0.14.10.1-linux-armv7.tar.gz'
+      ],
+      [
+        '8.472.8+1',
+        'linux',
+        'x64',
+        'jdk',
+        '8.472.8+1',
+        'https://corretto.aws/downloads/resources/8.472.08.1/amazon-corretto-8.472.08.1-linux-x64.tar.gz'
+      ],
+      [
+        '8.472.08.1',
+        'linux',
+        'x64',
+        'jdk',
+        '8.472.8+1',
+        'https://corretto.aws/downloads/resources/8.472.08.1/amazon-corretto-8.472.08.1-linux-x64.tar.gz'
+      ],
+      [
+        '8.472.08.1',
+        'windows',
+        'x86',
+        'jre',
+        '8.472.8+1',
+        'https://corretto.aws/downloads/resources/8.472.08.1/amazon-corretto-8.472.08.1-windows-x86-jre.zip'
+      ]
+    ])(
+      'resolves exact release %s on %s/%s (%s)',
+      async (
+        requestedVersion,
+        platform,
+        architecture,
+        packageType,
+        expectedVersion,
+        url
+      ) => {
+        const checksum = 'a'.repeat(64);
+        spyHttpClient.mockResolvedValue({
+          statusCode: 200,
+          headers: {},
+          result: {
+            body: `|JDK|[archive](${url})|\`md5\` /<br /> \`${checksum}\`|`
+          }
+        });
+        const distribution = new CorrettoDistribution({
+          version: requestedVersion,
+          architecture,
+          packageType,
+          checkLatest: false
+        });
+        mockPlatform(distribution, platform);
+
+        const release = await distribution['findPackageForDownload'](
+          distribution['version']
+        );
+        const rawVersion = new URL(url).pathname.split('/')[3];
+        const source = `https://api.github.com/repos/corretto/corretto-${rawVersion.split('.')[0]}/releases/tags/${rawVersion}`;
+        expect(release).toEqual({
+          version: expectedVersion,
+          url,
+          checksum: {algorithm: 'sha256', value: checksum, source}
+        });
+        expect(spyHttpClient).toHaveBeenCalledTimes(1);
+        expect(spyHttpClient).toHaveBeenCalledWith(
+          source,
+          expect.objectContaining({accept: 'application/vnd.github+json'})
+        );
+      }
+    );
+
+    it('rejects exact releases without an archive for the requested platform', async () => {
+      spyHttpClient.mockResolvedValueOnce({
+        statusCode: 200,
+        headers: {},
+        result: {
+          body:
+            '|[other archive](https://example.com/archive)|`' +
+            'a'.repeat(64) +
+            '`|'
+        }
+      });
       const distribution = new CorrettoDistribution({
-        version,
+        version: '25.0.5.0.10',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      mockPlatform(distribution, 'linux');
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).rejects.toThrow(
+        'No linux/x64 jdk archive is listed for Corretto 25.0.5.0.10'
+      );
+    });
+
+    it('rejects historical archives with only an MD5 checksum', async () => {
+      spyHttpClient.mockResolvedValueOnce({
+        statusCode: 200,
+        headers: {},
+        result: {
+          body:
+            '|[archive](https://corretto.aws/downloads/resources/17.0.1.12.1/amazon-corretto-17.0.1.12.1-linux-x64.tar.gz)|`' +
+            'a'.repeat(32) +
+            '`|'
+        }
+      });
+      const distribution = new CorrettoDistribution({
+        version: '17.0.1.12.1',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      mockPlatform(distribution, 'linux');
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).rejects.toThrow(
+        'No SHA-256 checksum is published for Corretto 17.0.1.12.1 (linux, x64, jdk)'
+      );
+    });
+
+    it('does not substitute a JDK for an exact Linux JRE request', async () => {
+      const distribution = new CorrettoDistribution({
+        version: '25.0.5.0.10',
+        architecture: 'x64',
+        packageType: 'jre',
+        checkLatest: false
+      });
+      mockPlatform(distribution, 'linux');
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).rejects.toThrow('Corretto JRE archives are only available for Windows');
+      expect(spyHttpClient).not.toHaveBeenCalled();
+    });
+
+    it('resolves catalog-only releases without a GitHub release', async () => {
+      spyHttpClient.mockResolvedValueOnce({
+        statusCode: 404,
+        headers: {},
+        result: null
+      });
+      const distribution = new CorrettoDistribution({
+        version: '15.0.2.7.1',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      mockPlatform(distribution, 'linux');
+      expect(
+        await distribution['findPackageForDownload'](distribution['version'])
+      ).toEqual({
+        version: '15.0.2+7.1',
+        url: 'https://corretto.aws/downloads/resources/15.0.2.7.1/amazon-corretto-15.0.2.7.1-linux-x64.tar.gz',
+        checksum: {
+          algorithm: 'sha256',
+          value: manifestData.linux.x64.jdk['15']['tar.gz'].checksum_sha256,
+          source:
+            'https://corretto.github.io/corretto-downloads/latest_links/indexmap_with_checksum.json'
+        }
+      });
+    });
+
+    it('falls back to the catalog when the GitHub lookup fails', async () => {
+      spyHttpClient.mockRejectedValueOnce(new Error('GitHub rate limit'));
+      const distribution = new CorrettoDistribution({
+        version: '15.0.2.7.1',
         architecture: 'x64',
         packageType: 'jdk',
         checkLatest: false
       });
       mockPlatform(distribution, 'linux');
 
+      expect(
+        await distribution['findPackageForDownload'](distribution['version'])
+      ).toEqual({
+        version: '15.0.2+7.1',
+        url: 'https://corretto.aws/downloads/resources/15.0.2.7.1/amazon-corretto-15.0.2.7.1-linux-x64.tar.gz',
+        checksum: {
+          algorithm: 'sha256',
+          value: manifestData.linux.x64.jdk['15']['tar.gz'].checksum_sha256,
+          source:
+            'https://corretto.github.io/corretto-downloads/latest_links/indexmap_with_checksum.json'
+        }
+      });
+      expect(spyHttpClient).toHaveBeenCalledTimes(2);
+    });
+
+    it('reports missing release metadata without substituting the latest release', async () => {
+      spyHttpClient.mockResolvedValueOnce({
+        statusCode: 404,
+        headers: {},
+        result: null
+      });
+      const distribution = new CorrettoDistribution({
+        version: '17.0.0.0.999',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      mockPlatform(distribution, 'linux');
       await expect(
-        distribution['findPackageForDownload'](version)
+        distribution['findPackageForDownload'](distribution['version'])
-      ).rejects.toThrow('Only major versions are supported');
+      ).rejects.toThrow(
+        "Corretto release 17.0.0.0.999 was not found in Amazon's GitHub releases or current download catalog"
+      );
+    });
+
+    it('does not normalize zero-padded major-only inputs', () => {
+      expect(
+        () =>
+          new CorrettoDistribution({
+            version: '08',
+            architecture: 'x64',
+            packageType: 'jdk',
+            checkLatest: false
+          })
+      ).toThrow(
+        "The string '08' is not valid SemVer notation for a Java version"
+      );
     });
 
     it('with unfound version throw could not find error', async () => {

__tests__/distributors/jetbrains-installer.test.ts

@@ -9,6 +9,9 @@ import {
   afterAll
 } from '@jest/globals';
 import https from 'https';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
 import {HttpClient, HttpClientResponse} from '@actions/http-client';
 import type {IncomingMessage} from 'http';
 import {Readable} from 'stream';
@@ -476,6 +479,109 @@ describe('findPackageForDownload', () => {
     }
   );
 
+  describe('hotfix releases', () => {
+    beforeEach(() => {
+      jest.spyOn(HttpClient.prototype, 'getJson').mockResolvedValue({
+        statusCode: 200,
+        headers: {},
+        result: [
+          release('jbr-release-25.0.4b508.27', false),
+          release('jbr-release-25.0.4.1b635.9', false),
+          release('jbr-release-25.0.4.1b635.79', false),
+          release('jbr-release-25.0.3.2b1000.1', false)
+        ]
+      });
+      jest.spyOn(HttpClient.prototype, 'head').mockResolvedValue(response(200));
+    });
+
+    it.each(['linux', 'osx', 'windows'])(
+      'selects the patched JBR archive and checksum on %s',
+      async platform => {
+        const distribution = new JetBrainsDistribution({
+          version: '25',
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: true
+        });
+        distribution['getPlatformOption'] = () => platform;
+        const url = `https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-25.0.4.1-${platform}-x64-b635.79.tar.gz`;
+
+        const result = await distribution['findPackageForDownload']('25');
+
+        expect(result).toEqual({
+          version: '25.0.4+1.635.79',
+          url,
+          checksum: {
+            algorithm: 'sha512',
+            value: JETBRAINS_CHECKSUM,
+            source: `${url}.checksum`
+          }
+        });
+        expect(HttpClient.prototype.head).toHaveBeenCalledWith(url);
+        expect(spyHttpClientGet).toHaveBeenCalledTimes(1);
+        expect(spyHttpClientGet).toHaveBeenCalledWith(`${url}.checksum`);
+      }
+    );
+
+    it.each([
+      ['latest', '25.0.4+1.635.79'],
+      ['25.0.4', '25.0.4+1.635.79'],
+      ['25.0.4.0', '25.0.4+508.27'],
+      ['25.0.4.1', '25.0.4+1.635.79'],
+      ['25.0.4.1+635.79', '25.0.4+1.635.79'],
+      ['25.0.4+1.635.9', '25.0.4+1.635.9'],
+      ['25.0.4+508.27', '25.0.4+508.27']
+    ])('resolves %s to %s', async (input, expected) => {
+      const distribution = new JetBrainsDistribution({
+        version: input,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: true
+      });
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toMatchObject({version: expected});
+    });
+
+    it('resolves early-access hotfix releases separately', async () => {
+      jest.spyOn(HttpClient.prototype, 'getJson').mockResolvedValue({
+        statusCode: 200,
+        headers: {},
+        result: [
+          release('jbr-release-25.0.4.1b635.79', true),
+          release('jbr-release-25.0.4.2b636.1', false)
+        ]
+      });
+      const distribution = new JetBrainsDistribution({
+        version: '25.0.4.1-ea',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: true
+      });
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toMatchObject({version: '25.0.4+1.635.79'});
+    });
+
+    it.each(['25.0.4.2', '25.0.4.1+635.80'])(
+      'does not substitute another patch or build for %s',
+      async input => {
+        const distribution = new JetBrainsDistribution({
+          version: input,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: true
+        });
+
+        await expect(
+          distribution['findPackageForDownload'](distribution['version'])
+        ).rejects.toThrow(/No matching version found/);
+      }
+    );
+  });
+
   it('version is not found', async () => {
     const distribution = new JetBrainsDistribution({
       version: '8.0.452',
@@ -569,4 +675,84 @@ describe('findPackageForDownload', () => {
       source: `${result.url}.checksum`
     });
   });
+
+  describe('compareVersions', () => {
+    it.each([
+      ['25.0.4+1.635.79', '25.0.4+508.27', 1],
+      ['25.0.5+1.1', '25.0.4+1.635.79', 1],
+      ['25.0.4+10.1.1', '25.0.4+2.999.99', 1],
+      ['25.0.4+1.635.79', '25.0.4+1.635.9', 1],
+      ['25.0.4+1.636.1', '25.0.4+1.635.79', 1],
+      ['25.0.4+0.635.79', '25.0.4+635.79', 0],
+      ['11.0.11+1522', '11.0.11+1522.1', -1],
+      ['25.0.4', '25.0.4+508.27', -1]
+    ])('compares %s with %s', (first, second, expected) => {
+      const distribution = new JetBrainsDistribution({
+        version: '25',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+
+      expect(Math.sign(distribution['compareVersions'](first, second))).toBe(
+        expected
+      );
+      expect(
+        Math.sign(distribution['compareVersions'](second, first)) || 0
+      ).toBe(-expected || 0);
+    });
+  });
+
+  describe('hotfix releases in the tool cache', () => {
+    let cacheRoot: string;
+    const previousToolcache = process.env['RUNNER_TOOL_CACHE'];
+
+    beforeEach(async () => {
+      cacheRoot = await fs.promises.mkdtemp(
+        path.join(os.tmpdir(), 'jetbrains-')
+      );
+      process.env['RUNNER_TOOL_CACHE'] = cacheRoot;
+      for (const version of ['25.0.4-508.27', '25.0.4-1.635.79']) {
+        const javaPath = path.join(
+          cacheRoot,
+          'Java_JetBrains_jdk',
+          version,
+          'x64'
+        );
+        await fs.promises.mkdir(javaPath, {recursive: true});
+        await fs.promises.writeFile(`${javaPath}.complete`, '');
+      }
+    });
+
+    afterEach(async () => {
+      if (previousToolcache === undefined) {
+        delete process.env['RUNNER_TOOL_CACHE'];
+      } else {
+        process.env['RUNNER_TOOL_CACHE'] = previousToolcache;
+      }
+      await fs.promises.rm(cacheRoot, {recursive: true, force: true});
+    });
+
+    it.each(['25', '25.0.4.1', '25.0.4.1+635.79'])(
+      'reuses the patched JBR for %s',
+      input => {
+        const distribution = new JetBrainsDistribution({
+          version: input,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: false
+        });
+
+        expect(distribution['findInToolcache']()).toEqual({
+          version: '25.0.4+1.635.79',
+          path: path.join(
+            cacheRoot,
+            'Java_JetBrains_jdk',
+            '25.0.4-1.635.79',
+            'x64'
+          )
+        });
+      }
+    );
+  });
 });

__tests__/distributors/liberica-installer.test.ts

@@ -15,6 +15,7 @@ import type {
 } from '../../src/distributions/liberica/models.js';
 import {HttpClient} from '@actions/http-client';
 import os from 'os';
+import path from 'path';
 
 import manifestData from '../data/liberica.json' with {type: 'json'};
 
@@ -253,39 +254,126 @@ describe('findPackageForDownload', () => {
     expect(result.version).toBe(expected);
   });
 
-  describe('compound build versions', () => {
+  describe.each([
+    [17, 20],
+    [25, 4]
+  ])('patch releases for Java %s.0.%s', (featureVersion, updateVersion) => {
+    const mainVersion = `${featureVersion}.0.${updateVersion}`;
+
     beforeEach(() => {
       distribution['getAvailableVersions'] = async () =>
-        ['1', '1.1', '1.2', '1.10'].map(build => ({
+        ['+1', '+10', '.1+1', '.1+2', '.1+10', '.2+1', '.10+1'].map(suffix => ({
-          featureVersion: 25,
+          featureVersion,
           interimVersion: 0,
-          updateVersion: 4,
+          updateVersion,
-          buildVersion: 1,
+          buildVersion: Number(suffix.split('+')[1]),
-          version: `25.0.4+${build}`,
+          version: `${mainVersion}${suffix}`,
-          downloadUrl: `https://download.bell-sw.com/java/25.0.4+${build}/bellsoft-jdk25.0.4+${build}-macos-aarch64.tar.gz`
+          downloadUrl: `https://download.bell-sw.com/java/${mainVersion}${suffix}/bellsoft-jdk${mainVersion}${suffix}-macos-aarch64.tar.gz`
         }));
     });
 
     it.each([
-      ['25.0.4+1.1', '25.0.4+1.1'],
+      [`${mainVersion}+1.1`, `${mainVersion}+1.1`, '.1+1'],
-      ['25.0.4+1', '25.0.4+1'],
+      [`${mainVersion}+1.2`, `${mainVersion}+1.2`, '.1+2'],
-      ['25.0.4', '25.0.4+1.10'],
+      [`${mainVersion}+1.10`, `${mainVersion}+1.10`, '.1+10'],
-      ['25', '25.0.4+1.10']
+      [`${mainVersion}+1`, `${mainVersion}+1`, '+1'],
-    ])('version is %s -> %s', async (input, expected) => {
+      [mainVersion, `${mainVersion}+10.1`, '.10+1'],
+      [`${featureVersion}`, `${mainVersion}+10.1`, '.10+1']
+    ])('version is %s -> %s', async (input, expected, suffix) => {
       const result = await distribution['findPackageForDownload'](input);
       expect(result).toEqual({
         version: expected,
-        url: `https://download.bell-sw.com/java/${expected}/bellsoft-jdk${expected}-macos-aarch64.tar.gz`
+        url: `https://download.bell-sw.com/java/${mainVersion}${suffix}/bellsoft-jdk${mainVersion}${suffix}-macos-aarch64.tar.gz`
       });
     });
 
+    it('sorts builds within the same patch numerically', async () => {
+      const versions = await distribution['getAvailableVersions']();
+      distribution['getAvailableVersions'] = async () =>
+        versions.filter(item => item.version.startsWith(`${mainVersion}.1+`));
+
+      const result = await distribution['findPackageForDownload'](mainVersion);
+      expect(result.version).toBe(`${mainVersion}+1.10`);
+    });
+
+    it('selects the newest build for a four-component patch-only request', async () => {
+      const patchDistribution = new LibericaDistributions({
+        version: `${mainVersion}.1`,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      patchDistribution['getAvailableVersions'] =
+        distribution['getAvailableVersions'];
+
+      await expect(
+        patchDistribution['findPackageForDownload'](
+          patchDistribution['version']
+        )
+      ).resolves.toMatchObject({version: `${mainVersion}+1.10`});
+    });
+
     it('does not substitute a different compound build', async () => {
       await expect(
-        distribution['findPackageForDownload']('25.0.4+1.3')
+        distribution['findPackageForDownload'](`${mainVersion}+1.3`)
       ).rejects.toThrow(/No matching version found for SemVer/);
     });
   });
 
+  it('selects the latest multi-component patch release for Java 25', async () => {
+    const releases: LibericaVersion[] = [
+      '25.0.5+11',
+      '25.0.5.0.2+5',
+      '25.0.5.0.3+5'
+    ].map(version => {
+      const [versionWithoutBuild, buildVersion] = version.split('+');
+      const [featureVersion, interimVersion, updateVersion] =
+        versionWithoutBuild.split('.').map(Number);
+      return {
+        version,
+        featureVersion,
+        interimVersion,
+        updateVersion,
+        buildVersion: Number(buildVersion),
+        downloadUrl: `https://download.bell-sw.com/java/${version}/jdk.tar.gz`
+      };
+    });
+    distribution['getAvailableVersions'] = async () => releases;
+
+    await expect(distribution['findPackageForDownload']('25')).resolves.toEqual(
+      {
+        version: '25.0.5+0.3.5',
+        url: 'https://download.bell-sw.com/java/25.0.5.0.3+5/jdk.tar.gz'
+      }
+    );
+  });
+
+  it('compares patch components before build numbers when patch lengths differ', async () => {
+    const releases: LibericaVersion[] = ['25.0.5.1+10', '25.0.5.1.1+1'].map(
+      version => {
+        const [versionWithoutBuild, buildVersion] = version.split('+');
+        const [featureVersion, interimVersion, updateVersion] =
+          versionWithoutBuild.split('.').map(Number);
+        return {
+          version,
+          featureVersion,
+          interimVersion,
+          updateVersion,
+          buildVersion: Number(buildVersion),
+          downloadUrl: `https://download.bell-sw.com/java/${version}/jdk.tar.gz`
+        };
+      }
+    );
+    distribution['getAvailableVersions'] = async () => releases;
+
+    await expect(
+      distribution['findPackageForDownload']('25.0.5')
+    ).resolves.toEqual({
+      version: '25.0.5+1.1.1',
+      url: 'https://download.bell-sw.com/java/25.0.5.1.1+1/jdk.tar.gz'
+    });
+  });
+
   it('should throw an error', async () => {
     await expect(distribution['findPackageForDownload']('17')).rejects.toThrow(
       /No matching version found for SemVer/
@@ -293,6 +381,193 @@ describe('findPackageForDownload', () => {
   });
 });
 
+describe('patch request resolution from the constructor', () => {
+  const releases: LibericaVersion[] = ['17.0.20+10', '17.0.20.1+1'].map(
+    version => ({
+      featureVersion: 17,
+      interimVersion: 0,
+      updateVersion: 20,
+      buildVersion: Number(version.split('+')[1]),
+      version,
+      downloadUrl: `https://download.bell-sw.com/java/${version}/jdk.tar.gz`
+    })
+  );
+  let cacheRoot: string;
+  let previousToolcache: string | undefined;
+
+  beforeEach(async () => {
+    previousToolcache = process.env['RUNNER_TOOL_CACHE'];
+    cacheRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'liberica-'));
+    process.env['RUNNER_TOOL_CACHE'] = cacheRoot;
+    for (const version of ['17.0.20-10', '17.0.20-1.1']) {
+      const javaPath = path.join(
+        cacheRoot,
+        'Java_Liberica_jdk',
+        version,
+        'x64'
+      );
+      await fs.promises.mkdir(javaPath, {recursive: true});
+      await fs.promises.writeFile(`${javaPath}.complete`, '');
+    }
+  });
+
+  afterEach(async () => {
+    if (previousToolcache === undefined) {
+      delete process.env['RUNNER_TOOL_CACHE'];
+    } else {
+      process.env['RUNNER_TOOL_CACHE'] = previousToolcache;
+    }
+    await fs.promises.rm(cacheRoot, {recursive: true, force: true});
+  });
+
+  it.each([
+    ['17', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20+10', '17.0.20+10', '17.0.20+10'],
+    ['17.0.20+1.1', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20.1', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20.1+1', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20.0', '17.0.20+10', '17.0.20+10']
+  ])(
+    'resolves %s consistently remotely and in cache',
+    async (input, expected, apiVersion) => {
+      const distribution = new LibericaDistributions({
+        version: input,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      distribution['getAvailableVersions'] = async () => releases;
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toEqual({
+        version: expected,
+        url: `https://download.bell-sw.com/java/${apiVersion}/jdk.tar.gz`
+      });
+      expect(distribution['findInToolcache']()).toEqual({
+        version: expected,
+        path: path.join(
+          cacheRoot,
+          'Java_Liberica_jdk',
+          expected.replace('+', '-'),
+          'x64'
+        )
+      });
+    }
+  );
+
+  it.each(['17.0.20.2', '17.0.20+1.2'])(
+    'does not substitute a different patch or exact build for %s',
+    async version => {
+      const distribution = new LibericaDistributions({
+        version,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      distribution['getAvailableVersions'] = async () => releases;
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).rejects.toThrow(/No matching version found/);
+      expect(distribution['findInToolcache']()).toBeNull();
+    }
+  );
+
+  it('keeps patch-only and exact-build resolution cache identities distinct', () => {
+    const distribution = new LibericaDistributions({
+      version: '17.0.20.1',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    expect(distribution['version']).toBe('17.0.20.1');
+  });
+
+  it('normalizes multi-component patch-only requests for exact matching', async () => {
+    const releases: LibericaVersion[] = ['25.0.5.0.2+5', '25.0.5.0.3+5'].map(
+      version => {
+        const [versionWithoutBuild, buildVersion] = version.split('+');
+        const [featureVersion, interimVersion, updateVersion] =
+          versionWithoutBuild.split('.').map(Number);
+        return {
+          version,
+          featureVersion,
+          interimVersion,
+          updateVersion,
+          buildVersion: Number(buildVersion),
+          downloadUrl: `https://download.bell-sw.com/java/${version}/jdk.tar.gz`
+        };
+      }
+    );
+    const distribution = new LibericaDistributions({
+      version: '25.0.5.0.3',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    distribution['getAvailableVersions'] = async () => releases;
+
+    expect(distribution['version']).toBe('25.0.5.0.3');
+    await expect(
+      distribution['findPackageForDownload'](distribution['version'])
+    ).resolves.toEqual({
+      version: '25.0.5+0.3.5',
+      url: 'https://download.bell-sw.com/java/25.0.5.0.3+5/jdk.tar.gz'
+    });
+  });
+
+  it('orders main versions, patches, and builds consistently in cache', async () => {
+    for (const version of ['17.0.20-1.2', '17.0.20-1.10', '17.0.21-1']) {
+      const javaPath = path.join(
+        cacheRoot,
+        'Java_Liberica_jdk',
+        version,
+        'x64'
+      );
+      await fs.promises.mkdir(javaPath, {recursive: true});
+      await fs.promises.writeFile(`${javaPath}.complete`, '');
+    }
+
+    for (const [version, expected] of [
+      ['17', '17.0.21+1'],
+      ['17.0.20', '17.0.20+1.10'],
+      ['17.0.20.1', '17.0.20+1.10']
+    ]) {
+      const distribution = new LibericaDistributions({
+        version,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      expect(distribution['findInToolcache']()?.version).toBe(expected);
+    }
+  });
+
+  it('preserves early-access handling for patch-only requests', async () => {
+    const javaPath = path.join(
+      cacheRoot,
+      'Java_Liberica_jdk',
+      '17.0.20-ea.1.2',
+      'x64'
+    );
+    await fs.promises.mkdir(javaPath, {recursive: true});
+    await fs.promises.writeFile(`${javaPath}.complete`, '');
+    const distribution = new LibericaDistributions({
+      version: '17.0.20.1-ea',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    expect(distribution['stable']).toBe(false);
+    expect(distribution['findInToolcache']()).toEqual({
+      version: '17.0.20+1.2',
+      path: javaPath
+    });
+  });
+});
+
 describe('getPlatformOption', () => {
   beforeEach(() => {
     // The linux row below is glibc, so pin the Alpine probe rather than
@@ -369,6 +644,46 @@ describe('convertVersionToSemver', () => {
       },
       '11.0.0+13'
     ],
+    [
+      {
+        version: '17.0.20.1+1',
+        featureVersion: 17,
+        interimVersion: 0,
+        updateVersion: 20,
+        buildVersion: 1
+      },
+      '17.0.20+1.1'
+    ],
+    [
+      {
+        version: '25.0.4.1+1',
+        featureVersion: 25,
+        interimVersion: 0,
+        updateVersion: 4,
+        buildVersion: 1
+      },
+      '25.0.4+1.1'
+    ],
+    [
+      {
+        version: '25.0.5.0.3+5',
+        featureVersion: 25,
+        interimVersion: 0,
+        updateVersion: 5,
+        buildVersion: 5
+      },
+      '25.0.5+0.3.5'
+    ],
+    [
+      {
+        version: '17.0.20.1+2',
+        featureVersion: 17,
+        interimVersion: 0,
+        updateVersion: 20,
+        buildVersion: 2
+      },
+      '17.0.20+1.2'
+    ],
     [
       {
         version: '25.0.4+1.1',

__tests__/distributors/microsoft-installer.test.ts

@@ -216,6 +216,172 @@ describe('findPackageForDownload', () => {
     expect(result.signatureUrl).toBe(`${url}.sig`);
   });
 
+  describe.each(['25.0.5.0.2', '25.0.5+0.2', '25.0.5'])(
+    'version %s missing from the live manifest',
+    version => {
+      it.each([
+        ['darwin', 'x64', 'macos', 'tar.gz'],
+        ['linux', 'x64', 'linux', 'tar.gz'],
+        ['win32', 'x64', 'windows', 'zip'],
+        ['darwin', 'aarch64', 'macos', 'tar.gz'],
+        ['linux', 'aarch64', 'linux', 'tar.gz'],
+        ['win32', 'aarch64', 'windows', 'zip']
+      ])(
+        'resolves the bundled release for %s/%s',
+        async (platform, architecture, osType, extension) => {
+          mockOsPlatform.mockReturnValue(platform);
+          const distro = new MicrosoftDistributions({
+            version,
+            architecture,
+            packageType: 'jdk',
+            checkLatest: false
+          });
+
+          const result = await distro['findPackageForDownload'](
+            distro['version']
+          );
+          const url = `https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-${osType}-${architecture}.${extension}`;
+
+          expect(result).toEqual({
+            version: '25.0.5+0.2',
+            url,
+            signatureUrl: `${url}.sig`,
+            checksum: {
+              algorithm: 'sha256',
+              value: MICROSOFT_CHECKSUM,
+              source: `${url}.sha256sum.txt`
+            }
+          });
+          expect(spyHttpClientGet).toHaveBeenCalledWith(`${url}.sha256sum.txt`);
+        }
+      );
+    }
+  );
+
+  it('prefers the live manifest when it contains the requested release', async () => {
+    mockOsPlatform.mockReturnValue('linux');
+    const url =
+      'https://example.test/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz';
+    spyGetManifestFromRepo.mockResolvedValue({
+      result: [
+        {
+          version: '25.0.5+0.2',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: url
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+
+    const result = await distribution['findPackageForDownload']('25.0.5+0.2');
+
+    expect(result.version).toBe('25.0.5+0.2');
+    expect(result.url).toBe(url);
+    expect(spyGetManifestFromRepo).toHaveBeenCalledWith(
+      'https://aka.ms/download-jdk/microsoft-openjdk-versions.json',
+      {accept: 'application/json'}
+    );
+  });
+
+  it('falls back to the bundled build when the live manifest has another build', async () => {
+    mockOsPlatform.mockReturnValue('linux');
+    spyGetManifestFromRepo.mockResolvedValue({
+      result: [
+        {
+          version: '25.0.5+0.3',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-25.0.5.0.3-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url:
+                'https://example.test/microsoft-jdk-25.0.5.0.3-linux-x64.tar.gz'
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+
+    const result = await distribution['findPackageForDownload']('25.0.5+0.2');
+
+    expect(result.version).toBe('25.0.5+0.2');
+    expect(result.url).toBe(
+      'https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz'
+    );
+  });
+
+  it('matches dotted Java versions without falling back to the base release', async () => {
+    mockOsPlatform.mockReturnValue('linux');
+    spyGetManifestFromRepo.mockResolvedValue({
+      result: [
+        {
+          version: '17.0.8',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-17.0.8-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: 'https://example.test/microsoft-jdk-17.0.8.tar.gz'
+            }
+          ]
+        },
+        {
+          version: '17.0.8.1',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-17.0.8.1-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: 'https://example.test/microsoft-jdk-17.0.8.1.tar.gz'
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+    distribution = new MicrosoftDistributions({
+      version: '17.0.8.1',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+
+    const result = await distribution['findPackageForDownload'](
+      distribution['version']
+    );
+
+    expect(result.version).toBe('17.0.8+1');
+    expect(result.url).toBe(
+      'https://example.test/microsoft-jdk-17.0.8.1.tar.gz'
+    );
+  });
+
+  it('preserves the error when the live manifest cannot be loaded', async () => {
+    spyGetManifestFromRepo.mockRejectedValue(new Error('Network error'));
+
+    await expect(
+      distribution['findPackageForDownload']('25.0.5+0.2')
+    ).rejects.toThrow('Could not load manifest for Microsoft Build of OpenJDK');
+  });
+
   it.each([
     ['amd64', 'x64'],
     ['arm64', 'aarch64']

__tests__/distributors/semeru-installer.test.ts

@@ -272,7 +272,7 @@ describe('findPackageForDownload', () => {
     }
   );
 
-  it.each(['zos', 'z/OS', 'z/os', 'test0987654321=', '++=++', 'myArch'])(
+  it.each(['zos', 'myArch'])(
     'incorrect Semeru `%s` architecture throws',
     async (arch: string) => {
       const distribution = new SemeruDistribution({

__tests__/java-platform-contract.test.ts

@@ -31,6 +31,36 @@ describe('Java platform capabilities', () => {
     expect(normalizeArchitecture(input)).toBe(expected);
   });
 
+  it.each(['constructor', 'Constructor'])(
+    'preserves custom architecture token %s for jdkfile',
+    architecture => {
+      expect(normalizeArchitecture(architecture)).toBe(architecture);
+      expect(validateJavaPlatform('jdkfile', 'linux', architecture, '17')).toBe(
+        architecture
+      );
+    }
+  );
+
+  it.each([
+    'x64<<end\nvalue\nend',
+    'z/OS',
+    'z/os',
+    'test0987654321=',
+    '++=++',
+    '../x64',
+    'x64\\other',
+    'x64 other',
+    '-x64',
+    '_x64'
+  ])('rejects invalid architecture token %s', architecture => {
+    const message = `Unsupported architecture value: ${JSON.stringify(architecture)}`;
+
+    expect(() => normalizeArchitecture(architecture)).toThrow(message);
+    expect(() =>
+      validateJavaPlatform('jdkfile', 'linux', architecture, '17')
+    ).toThrow(message);
+  });
+
   it.each([
     ['linux', false, 'linux-glibc'],
     ['linux', true, 'linux-musl'],

__tests__/problem-matcher.test.ts

@@ -27,7 +27,16 @@ describe('configureProblemMatcher', () => {
     jest.resetAllMocks();
   });
 
-  it('registers the Java problem matcher by default', () => {
+  it('does not register the Java problem matcher by default', () => {
+    configureProblemMatcher('/matchers/java.json');
+
+    expect(mockInfo).not.toHaveBeenCalled();
+    expect(mockDebug).toHaveBeenCalledWith('Java problem matcher is disabled');
+  });
+
+  it('registers the Java problem matcher when explicitly enabled', () => {
+    inputs[INPUT_PROBLEM_MATCHER] = 'true';
+
     configureProblemMatcher('/matchers/java.json');
 
     expect(mockInfo).toHaveBeenCalledWith('##[add-matcher]/matchers/java.json');

__tests__/util.test.ts

@@ -278,6 +278,28 @@ describe('validatePaginationUrl', () => {
 });
 
 describe('getVersionFromFileContent', () => {
+  it.each(['25.0.5.0.10', '8.472.08.1', '25.0.5+0.10'])(
+    'preserves full Corretto release %s in .java-version',
+    version => {
+      expect(
+        getVersionFromFileContent(version, 'corretto', '.java-version')
+      ).toEqual({version, distribution: undefined});
+    }
+  );
+
+  it.each([
+    ['17.0.3.1', '.java-version', '17'],
+    ['1.8.0.472.1', '.java-version', '8'],
+    ['8.0.472.08.1', '.java-version', '8'],
+    ['8.0.282+8', '.java-version', '8'],
+    ['java corretto-17.0.13.11.1-jre', '.tool-versions', '17'],
+    ['java corretto-17.0.13.11.1+1', '.tool-versions', '17']
+  ])('keeps the existing major selection for %s', (content, file, version) => {
+    expect(getVersionFromFileContent(content, 'corretto', file)?.version).toBe(
+      version
+    );
+  });
+
   describe('.sdkmanrc', () => {
     it.each([
       ['java=26-tem', '26', 'temurin'],
@@ -290,6 +312,8 @@ describe('getVersionFromFileContent', () => {
       ['java=21.0.5-zulu', '21.0.5', 'zulu'],
       ['java=17.0.13-albba', '17.0.13', 'dragonwell'],
       ['java=17.0.13-amzn', '17', 'corretto'],
+      ['java=25.0.5.0.10-amzn', '25.0.5.0.10', 'corretto'],
+      ['java=8.472.08.1-amzn', '8.472.08.1', 'corretto'],
       ['java=21.0.5-graal', '21.0.5', 'graalvm'],
       ['java=17.0.9-graalce', '17.0.9', 'graalvm'],
       ['java=11.0.25-librca', '11.0.25', 'liberica'],
@@ -368,7 +392,8 @@ describe('getVersionFromFileContent', () => {
       ['java adoptopenjdk-11.0.16+8', '11.0.16+8', 'temurin'],
       ['java adoptopenjdk-openj9-11.0.16+8', '11.0.16+8', 'temurin'],
       ['java zulu-11.56.19', '11.56.19', 'zulu'],
-      ['java corretto-17.0.13.11.1', '17', 'corretto'], // corretto -> major only
+      ['java corretto-17.0.13.11.1', '17.0.13.11.1', 'corretto'],
+      ['java corretto-8.472.08.1', '8.472.08.1', 'corretto'],
       ['java liberica-11.0.15+10', '11.0.15+10', 'liberica'],
       ['java microsoft-11.0.13.8.1', '11.0.13', 'microsoft'],
       ['java semeru-openj9-11.0.25+9', '11.0.25+9', 'semeru'],

__tests__/verify-java.sh

@@ -15,6 +15,13 @@ EXPECTED_PATH=$2
 SETUP_JAVA_VERSION=$3
 REQUIRE_CONCRETE_VERSION=$4
 
+if [[ $EXPECTED_JAVA_VERSION == *"+"* ]] && [ "$SETUP_JAVA_VERSION" != "$EXPECTED_JAVA_VERSION" ]; then
+  echo "::error::The version output does not match the requested build"
+  echo "Requested version: $EXPECTED_JAVA_VERSION"
+  echo "Version output: $SETUP_JAVA_VERSION"
+  exit 1
+fi
+
 EXPECTED_JAVA_VERSION=$(echo $EXPECTED_JAVA_VERSION | cut -d'+' -f1)
 if [[ $EXPECTED_JAVA_VERSION == 8 ]] || [[ $EXPECTED_JAVA_VERSION == 8.* ]]; then
   EXPECTED_JAVA_VERSION="1.${EXPECTED_JAVA_VERSION}"

action.yml

@@ -75,6 +75,9 @@ inputs:
   mvn-plugin-repositories:
     description: 'Multiline list of Maven plugin repositories in the format `repository-id:repository-url:snapshots-enabled`.'
     required: false
+  mvn-mirrors:
+    description: 'Multiline list of Maven mirrors in the format `mirror-id:mirror-url:mirror-of`. The URL must include a scheme; percent-encode colons in its path, query, or fragment. Use a matching server ID for authentication. Can be used independently of repository inputs.'
+    required: false
   mvn-repositories-include-central:
     description: 'Include Maven Central for dependency and plugin repositories in the generated profile. When false, Central is disabled for both types unless that type explicitly declares ID `central`. Has no effect when neither repository list is configured.'
     required: false
@@ -135,9 +138,9 @@ inputs:
     required: false
     default: false
   problem-matcher:
-    description: 'Whether to register the Java problem matcher (compiler errors/warnings and uncaught exceptions). Set to "false" to disable annotations.'
+    description: 'Whether to register the Java problem matcher (compiler errors/warnings and uncaught exceptions). Disabled by default; set to "true" to enable annotations.'
     required: false
-    default: true
+    default: false
 outputs:
   distribution:
     description: 'Distribution of Java that has been installed'

dist/cleanup/314.index.js

@@ -21,8 +21,8 @@ var external_fs_default = /*#__PURE__*/__webpack_require__.n(external_fs_);
 // EXTERNAL MODULE: external "path"
 var external_path_ = __webpack_require__(6928);
 var external_path_default = /*#__PURE__*/__webpack_require__.n(external_path_);
-// EXTERNAL MODULE: ./node_modules/@actions/cache/lib/cache.js + 291 modules
+// EXTERNAL MODULE: ./node_modules/@actions/cache/lib/cache.js + 323 modules
-var lib_cache = __webpack_require__(5767);
+var lib_cache = __webpack_require__(8230);
 // EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js + 7 modules
 var lib_core = __webpack_require__(3838);
 // EXTERNAL MODULE: ./src/util.ts

dist/cleanup/348.index.js

@@ -15,7 +15,7 @@ export const modules = {
 /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_1__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5767);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8230);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(3838);
 
 

dist/cleanup/377.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_0__);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(5767);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8230);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3838);
 /* harmony import */ var _actions_glob__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(2377);
 /**

dist/cleanup/index.js

@@ -7217,7 +7217,7 @@ function defaultFactory (origin, opts) {
 }
 
 class Agent extends DispatcherBase {
-  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, ...options } = {}) {
+  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, tls, ...options } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
@@ -7236,11 +7236,15 @@ class Agent extends DispatcherBase {
       connect = { ...connect }
     }
 
+    if (tls && typeof tls !== 'function') {
+      tls = { ...tls }
+    }
+
     this[kInterceptors] = options.interceptors?.Agent && Array.isArray(options.interceptors.Agent)
       ? options.interceptors.Agent
       : [createRedirectInterceptor({ maxRedirections })]
 
-    this[kOptions] = { ...util.deepClone(options), connect }
+    this[kOptions] = { ...util.deepClone(options), connect, tls }
     this[kOptions].interceptors = options.interceptors
       ? { ...options.interceptors }
       : undefined
@@ -8273,8 +8277,6 @@ async function connectH1 (client, socket) {
   socket[kParser] = new Parser(client, socket, llhttpInstance)
 
   addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     const parser = this[kParser]
 
     // On Mac OS, we get an ECONNRESET even if there is a full body to be forwarded
@@ -9204,8 +9206,6 @@ async function connectH2 (client, socket) {
   socket[kHTTP2Session] = session
 
   util.addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     this[kError] = err
 
     this[kClient][kOnError](err)
@@ -9279,8 +9279,6 @@ function resumeH2 (client) {
 }
 
 function onHttp2SessionError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   this[kSocket][kError] = err
   this[kClient][kOnError](err)
 }
@@ -9978,9 +9976,10 @@ class Client extends DispatcherBase {
     // h2
     maxConcurrentStreams,
     allowH2,
-    webSocket
+    webSocket,
+    eventSource
   } = {}) {
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -10501,6 +10500,7 @@ module.exports = Client
 
 
 
+const buffer = __nccwpck_require__(4573)
 const Dispatcher = __nccwpck_require__(883)
 const {
   ClientDestroyedError,
@@ -10513,6 +10513,7 @@ const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kInterceptedDispatch = Symbol('Intercepted Dispatch')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   constructor (opts) {
@@ -10523,6 +10524,7 @@ class DispatcherBase extends Dispatcher {
     this[kClosed] = false
     this[kOnClosed] = []
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   get webSocketOptions () {
@@ -10532,6 +10534,12 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   get destroyed () {
     return this[kDestroyed]
   }
@@ -16890,6 +16898,7 @@ module.exports = {
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 
+const buffer = __nccwpck_require__(4573)
 const { Transform } = __nccwpck_require__(7075)
 const { isASCIINumber, isValidLastEventId } = __nccwpck_require__(4811)
 
@@ -16914,11 +16923,19 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
 const RETRY = Buffer.from('retry')
 
+// Each data field creates a string node, and each unconsumed input chunk keeps
+// a Buffer wrapper. The absolute ceiling protects the large default byte limit.
+const minParserItems = 1024
+const maxParserItems = 131072
+const bytesPerParserItem = 128
+
 function isASCIINumberBytes (buffer, start) {
   if (start >= buffer.length) {
     return false
@@ -16957,6 +16974,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -17005,6 +17028,13 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  lineLength = 0
+  eventSize = 0
+  eventFieldSizes = { data: 0, event: 0, id: 0, retry: 0 }
+  dataLineCount = 0
+  maxEventSize
+  maxDataLines
+  maxBufferedChunks
 
   event = {
     data: undefined,
@@ -17015,6 +17045,7 @@ class EventSourceStream extends Transform {
 
   /**
    * @param {object} options
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} options.eventSourceSettings
    * @param {Function} [options.push]
    */
@@ -17026,6 +17057,12 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
+    const parserItemLimit = this.maxEventSize > 0
+      ? Math.min(maxParserItems, Math.max(minParserItems, Math.floor(this.maxEventSize / bytesPerParserItem)))
+      : 0
+    this.maxDataLines = parserItemLimit
+    this.maxBufferedChunks = parserItemLimit
     if (options.push) {
       this.push = options.push
     }
@@ -17043,6 +17080,14 @@ class EventSourceStream extends Transform {
       return
     }
 
+    // A leading line ending can immediately release the currently buffered
+    // line, even when it uses the final allowed chunk slot.
+    if (this.maxEventSize > 0 &&
+        this.chunks.length >= this.maxBufferedChunks &&
+        chunk[0] !== LF && chunk[0] !== CR) {
+      callback(createMaxEventSizeExceededError())
+      return
+    }
     this.chunks.push(chunk)
 
     // Strip leading byte-order-mark if we opened the stream and started
@@ -17121,7 +17166,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
-        this.parseLine(this.readLine(), this.event)
+        try {
+          this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -17130,15 +17180,28 @@ class EventSourceStream extends Transform {
         continue
       }
 
+      // readLine() is only called after CR or LF. Reject an unfinished line
+      // before it can retain an unbounded number of decoded chunks. The seven
+      // extra bytes allow the longest field prefix ("event: " or "retry: ").
+      if (this.maxEventSize > 0 && ++this.lineLength > this.maxEventSize + 7) {
+        callback(createMaxEventSizeExceededError())
+        return
+      }
       this.advanceCursor()
     }
 
     callback()
   }
 
+  _destroy (error, callback) {
+    this.chunks.length = 0
+    this.clearEvent()
+    super._destroy(error, callback)
+  }
+
   /**
    * @param {Buffer} line
-   * @param {EventStreamEvent} event
+   * @param {EventSourceStreamEvent} event
    */
   parseLine (line, event) {
     // If the line is empty (a blank line)
@@ -17172,6 +17235,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      if (this.maxEventSize > 0 && this.dataLineCount >= this.maxDataLines) {
+        throw createMaxEventSizeExceededError()
+      }
+      const valueBytes = line.length - valueStart
+      const dataSize = this.eventFieldSizes.data + (event.data === undefined ? 0 : 1) + valueBytes
+      this.setEventFieldSize('data', dataSize)
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -17179,11 +17249,13 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.dataLineCount++
       return
     }
 
     if (isFieldName(line, fieldLength, RETRY)) {
       if (isASCIINumberBytes(line, valueStart)) {
+        this.setEventFieldSize('retry', line.length - valueStart)
         event.retry = line.toString('utf8', valueStart)
       }
       return
@@ -17191,20 +17263,29 @@ class EventSourceStream extends Transform {
 
     if (isFieldName(line, fieldLength, ID)) {
       if (isValidLastEventIdBytes(line, valueStart)) {
+        this.setEventFieldSize('id', line.length - valueStart)
         event.id = line.toString('utf8', valueStart)
       }
       return
     }
 
     if (isFieldName(line, fieldLength, EVENT)) {
-      const value = line.toString('utf8', valueStart)
+      if (valueStart < line.length) {
-
+        this.setEventFieldSize('event', line.length - valueStart)
-      if (value.length > 0) {
+        event.event = line.toString('utf8', valueStart)
-        event.event = value
       }
     }
   }
 
+  setEventFieldSize (field, size) {
+    const eventSize = this.eventSize - this.eventFieldSizes[field] + size
+    if (this.maxEventSize > 0 && eventSize > this.maxEventSize) {
+      throw createMaxEventSizeExceededError()
+    }
+    this.eventSize = eventSize
+    this.eventFieldSizes[field] = size
+  }
+
   /**
    * @param {EventSourceStreamEvent} event
    */
@@ -17235,6 +17316,12 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventSize = 0
+    this.dataLineCount = 0
+    this.eventFieldSizes.data = 0
+    this.eventFieldSizes.event = 0
+    this.eventFieldSizes.id = 0
+    this.eventFieldSizes.retry = 0
   }
 
   hasPendingEvent () {
@@ -17270,14 +17357,16 @@ class EventSourceStream extends Transform {
   syncLineStartToCursor () {
     this.lineChunkIndex = this.chunkIndex
     this.linePos = this.pos
+    this.lineLength = 0
     this.dropConsumedChunks()
   }
 
   dropConsumedChunks () {
-    while (this.lineChunkIndex > 0) {
+    if (this.lineChunkIndex > 0) {
-      this.chunks.shift()
+      const consumed = this.lineChunkIndex
-      this.lineChunkIndex--
+      this.chunks.splice(0, consumed)
-      this.chunkIndex--
+      this.lineChunkIndex = 0
+      this.chunkIndex -= consumed
     }
 
     if (this.chunkIndex === this.chunks.length) {
@@ -17402,6 +17491,7 @@ const { isNetworkError } = __nccwpck_require__(9051)
 const { delay } = __nccwpck_require__(4811)
 const { kEnumerableProperty } = __nccwpck_require__(3440)
 const { environmentSettingsObject } = __nccwpck_require__(3168)
+const { getGlobalDispatcher } = __nccwpck_require__(2581)
 
 let experimentalWarned = false
 
@@ -17683,6 +17773,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -17861,7 +17952,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   }
 ])
 
@@ -22957,8 +23049,10 @@ async function httpNetworkFetch (
   // 19. Run these steps in parallel:
 
   //    1. Run these steps, but abort when fetchParams is canceled:
-  fetchParams.controller.onAborted = onAborted
+  if (!fetchParams.controller.resume) {
-  fetchParams.controller.on('terminated', onAborted)
+    fetchParams.controller.on('terminated', onAborted)
+  }
+
   fetchParams.controller.resume = async () => {
     // 1. While true
     while (true) {
@@ -23127,8 +23221,6 @@ async function httpNetworkFetch (
           }
           location = headersList.get('location', true)
 
-          this.body = new Readable({ read: resume })
-
           const decoders = []
 
           const willFollow = location && request.redirect === 'follow' &&
@@ -23146,7 +23238,7 @@ async function httpNetworkFetch (
             // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
             const maxContentEncodings = 5
             if (codings.length > maxContentEncodings) {
-              reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+              this.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
               return true
             }
 
@@ -23179,6 +23271,8 @@ async function httpNetworkFetch (
             }
           }
 
+          this.body = new Readable({ read: resume })
+
           const onError = this.onError.bind(this)
 
           resolve({
@@ -23225,10 +23319,6 @@ async function httpNetworkFetch (
             fetchParams.controller.off('terminated', this.abort)
           }
 
-          if (fetchParams.controller.onAborted) {
-            fetchParams.controller.off('terminated', fetchParams.controller.onAborted)
-          }
-
           fetchParams.controller.ended = true
 
           this.body.push(null)
@@ -29703,6 +29793,20 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          const socket = this.ws[kResponse].socket
+          if (this.#loop && socket.writableNeedDrain) {
+            this.#loop = false
+            socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {
@@ -31040,7 +31144,7 @@ module.exports = {
 /* harmony export */   gk: () => (/* binding */ INPUT_CACHE),
 /* harmony export */   wG: () => (/* binding */ INPUT_JOB_STATUS)
 /* harmony export */ });
-/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, SIGNATURE_VERIFICATION_DOCUMENTATION_URL, SIGNATURE_VERIFICATION_FAILURE_HELP, INPUT_MVN_SERVER_CREDENTIALS, INPUT_MVN_SERVER_REPOSITORY_ORIGINS, INPUT_MVN_REPOSITORIES, INPUT_MVN_PLUGIN_REPOSITORIES, INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL, INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, MAVEN_REPOSITORIES_PROFILE_ID, MAVEN_CENTRAL_REPOSITORY_ID, MAVEN_CENTRAL_REPOSITORY_URL, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
+/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, SIGNATURE_VERIFICATION_DOCUMENTATION_URL, SIGNATURE_VERIFICATION_FAILURE_HELP, INPUT_MVN_SERVER_CREDENTIALS, INPUT_MVN_SERVER_REPOSITORY_ORIGINS, INPUT_MVN_REPOSITORIES, INPUT_MVN_PLUGIN_REPOSITORIES, INPUT_MVN_MIRRORS, INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL, INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, MAVEN_REPOSITORIES_PROFILE_ID, MAVEN_CENTRAL_REPOSITORY_ID, MAVEN_CENTRAL_REPOSITORY_URL, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
 const MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
 const INPUT_JAVA_VERSION = 'java-version';
 const INPUT_JAVA_VERSION_FILE = 'java-version-file';
@@ -31061,6 +31165,7 @@ const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
 const INPUT_MVN_SERVER_REPOSITORY_ORIGINS = 'mvn-server-repository-origins';
 const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
 const INPUT_MVN_PLUGIN_REPOSITORIES = 'mvn-plugin-repositories';
+const INPUT_MVN_MIRRORS = 'mvn-mirrors';
 const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL = 'mvn-repositories-include-central';
 const INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL = 'mvn-repositories-prioritize-central';
 const INPUT_SERVER_ID = 'server-id';
@@ -31116,7 +31221,7 @@ const DISTRIBUTIONS_ONLY_MAJOR_VERSION = (/* unused pure expression or super */
 /* harmony export */   Vt: () => (/* binding */ getBooleanInput),
 /* harmony export */   lN: () => (/* binding */ isJdkCacheEnabled)
 /* harmony export */ });
-/* unused harmony exports getVersionFromToolcachePath, extractJdkFile, cacheJdkDir, getJavaVersionFromReleaseFile, getDownloadArchiveExtension, isVersionSatisfies, getToolcachePath, isGhes, getVersionFromFileContent, convertVersionToSemver, normalizeJavaVersionToSemver, getArtifactFingerprint, getGitHubToken, getGitHubHttpHeaders, MAX_PAGINATION_PAGES, getNextPageUrlFromLinkHeader, validatePaginationUrl, renameWinArchive, getLatestMajorVersion */
+/* unused harmony exports getVersionFromToolcachePath, extractJdkFile, cacheJdkDir, getJavaVersionFromReleaseFile, getDownloadArchiveExtension, isVersionSatisfies, getToolcachePath, isGhes, getVersionFromFileContent, isExactCorrettoVersion, convertVersionToSemver, normalizeJavaVersionToSemver, getArtifactFingerprint, getGitHubToken, getGitHubHttpHeaders, MAX_PAGINATION_PAGES, getNextPageUrlFromLinkHeader, validatePaginationUrl, renameWinArchive, getLatestMajorVersion */
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(857);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__nccwpck_require__.n(os__WEBPACK_IMPORTED_MODULE_0__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6928);
@@ -31423,6 +31528,15 @@ function getVersionFromFileContent(content, distributionName, versionFile) {
     }
     const tentativeVersion = avoidOldNotation(capturedVersion);
     const rawVersion = tentativeVersion.split('-')[0];
+    // Preserve Corretto's full vendor release before generic coercion drops its extra numeric fields.
+    if ((extractedDistribution || distributionName) === 'corretto' &&
+        capturedVersion === tentativeVersion &&
+        isExactCorrettoVersion(tentativeVersion)) {
+        return {
+            version: tentativeVersion,
+            distribution: extractedDistribution
+        };
+    }
     let version = semver.validRange(rawVersion)
         ? tentativeVersion
         : semver.coerce(tentativeVersion);
@@ -31506,6 +31620,10 @@ function mapAsdfDistribution(asdfDist) {
 function avoidOldNotation(content) {
     return content.startsWith('1.') ? content.substring(2) : content;
 }
+function isExactCorrettoVersion(version) {
+    // Java 8 releases have a nonzero update field; later releases use five numeric fields.
+    return /^(?:8\.(?!0+(?:\.|$))\d+(?:\.\d+){2}|(?!8\.)\d+(?:\.\d+){4})$/.test(version.replace('+', '.'));
+}
 function convertVersionToSemver(version) {
     // Some distributions may use semver-like notation (12.10.2.1, 12.10.2.1.1)
     const versionArray = Array.isArray(version) ? version : version.split('.');
@@ -31790,13 +31908,6 @@ module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:https")
 
 /***/ }),
 
-/***/ 8995:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:module");
-
-/***/ }),
-
 /***/ 7030:
 /***/ ((module) => {
 
@@ -31811,13 +31922,6 @@ module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:os");
 
 /***/ }),
 
-/***/ 6760:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
-
-/***/ }),
-
 /***/ 643:
 /***/ ((module) => {
 
@@ -36239,12 +36343,12 @@ async function saveCaches() {
     }
     const saves = [];
     if (cache) {
-        const { save } = await Promise.all(/* import() */[__nccwpck_require__.e(767), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
+        const { save } = await Promise.all(/* import() */[__nccwpck_require__.e(230), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
         saves.push(save(cache));
     }
     if (cacheJdk) {
-        const { saveJdkCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(767), __nccwpck_require__.e(314)]).then(__nccwpck_require__.bind(__nccwpck_require__, 2314));
+        const { saveJdkCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(230), __nccwpck_require__.e(314)]).then(__nccwpck_require__.bind(__nccwpck_require__, 2314));
-        const { saveJdkResolutionCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(767), __nccwpck_require__.e(348)]).then(__nccwpck_require__.bind(__nccwpck_require__, 967));
+        const { saveJdkResolutionCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(230), __nccwpck_require__.e(348)]).then(__nccwpck_require__.bind(__nccwpck_require__, 967));
         saves.push(saveJdkCaches());
         saves.push(saveJdkResolutionCaches());
     }

dist/setup/126.index.js

@@ -13,9 +13,11 @@ export const modules = {
 /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_1__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4527);
+/* harmony import */ var _actions_http_client__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4942);
-/* harmony import */ var _base_installer_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(6242);
+/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(4527);
-/* harmony import */ var _platform_types_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(7444);
+/* harmony import */ var _base_installer_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(6242);
+/* harmony import */ var _platform_types_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(7444);
+
 
 
 
@@ -23,29 +25,42 @@ export const modules = {
 
 
 const CORRETTO_VERSIONS_URL = 'https://corretto.github.io/corretto-downloads/latest_links/indexmap_with_checksum.json';
-class CorrettoDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4__/* .JavaBase */ .O {
+class CorrettoDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_5__/* .JavaBase */ .O {
+    requestedVersion;
     constructor(installerOptions) {
-        super('Corretto', installerOptions);
+        super('Corretto', {
+            ...installerOptions,
+            // Java 8 releases use zero-padded fields, e.g. 8.472.08.1.
+            version: (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .isExactCorrettoVersion */ .kI)(installerOptions.version)
+                ? installerOptions.version.replace(/(^|\.)0+(?=\d)/g, '$1')
+                : installerOptions.version
+        });
+        this.requestedVersion = installerOptions.version
+            .replace('+', '.')
+            .replace(/^8\.(\d+)\.(\d)\./, '8.$1.0$2.');
     }
     async downloadTool(javaRelease) {
         _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
         let javaArchivePath = await this.downloadAndVerify(javaRelease);
         _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Extracting Java archive...`);
-        const extension = (0,_util_js__WEBPACK_IMPORTED_MODULE_3__/* .getDownloadArchiveExtension */ .ag)();
+        const extension = (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .getDownloadArchiveExtension */ .ag)();
         if (process.platform === 'win32') {
-            javaArchivePath = (0,_util_js__WEBPACK_IMPORTED_MODULE_3__/* .renameWinArchive */ .n2)(javaArchivePath);
+            javaArchivePath = (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .renameWinArchive */ .n2)(javaArchivePath);
         }
-        const extractedJavaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_3__/* .extractJdkFile */ .PE)(javaArchivePath, extension);
+        const extractedJavaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .extractJdkFile */ .PE)(javaArchivePath, extension);
         const archiveName = fs__WEBPACK_IMPORTED_MODULE_1___default().readdirSync(extractedJavaPath)[0];
         const archivePath = path__WEBPACK_IMPORTED_MODULE_2___default().join(extractedJavaPath, archiveName);
         const version = this.getToolcacheVersionName(javaRelease.version);
-        const javaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_3__/* .cacheJdkDir */ .Vj)(archivePath, this.toolcacheFolderName, version, this.architecture);
+        const javaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .cacheJdkDir */ .Vj)(archivePath, this.toolcacheFolderName, version, this.architecture);
         return { version: javaRelease.version, path: javaPath };
     }
     async findPackageForDownload(version) {
         if (!this.stable) {
             throw new Error('Early access versions are not supported');
         }
+        if ((0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .isExactCorrettoVersion */ .kI)(this.requestedVersion)) {
+            return this.findExactRelease();
+        }
         const availableVersions = await this.getAvailableVersions();
         // The `latest` alias is normalized to the SemVer wildcard, but Corretto
         // matches on an exact major version, so resolve it to the newest available
@@ -60,13 +75,13 @@ class CorrettoDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4
             version = Math.max(...majors).toString();
         }
         if (version.includes('.')) {
-            throw new Error('Only major versions are supported');
+            throw new Error('Specify a major version or a full Corretto release, such as 25.0.5.0.10');
         }
         const matchingVersions = availableVersions
             .filter(item => item.version == version)
             .map(item => {
             return {
-                version: (0,_util_js__WEBPACK_IMPORTED_MODULE_3__/* .convertVersionToSemver */ .ZY)(item.correttoVersion),
+                version: (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .convertVersionToSemver */ .ZY)(item.correttoVersion),
                 url: item.downloadLink,
                 checksum: {
                     algorithm: 'sha256',
@@ -82,6 +97,76 @@ class CorrettoDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4
         }
         return resolvedVersion;
     }
+    async findExactRelease() {
+        const version = this.requestedVersion;
+        const major = version.split('.')[0];
+        const platform = this.getPlatformOption();
+        const arch = this.architecture;
+        if (platform !== 'windows' && this.packageType !== 'jdk') {
+            throw new Error('Corretto JRE archives are only available for Windows');
+        }
+        const os = platform === 'macos'
+            ? 'macosx'
+            : platform === 'alpine'
+                ? 'alpine-linux'
+                : platform;
+        const suffix = platform === 'windows' ? `-${this.packageType}.zip` : '.tar.gz';
+        const url = `https://corretto.aws/downloads/resources/${version}/amazon-corretto-${version}-${os}-${arch}${suffix}`;
+        // Versioned archives have no checksum sidecar; Amazon publishes their SHA-256s in the release notes.
+        const source = `https://api.github.com/repos/corretto/corretto-${major}/releases/tags/${version}`;
+        const findCatalogRelease = async () => {
+            const archive = (await this.getAvailableVersions()).find(item => item.downloadLink === url);
+            if (!archive) {
+                return undefined;
+            }
+            return {
+                version: this.version,
+                url,
+                checksum: {
+                    algorithm: 'sha256',
+                    value: archive.checksum_sha256,
+                    source: CORRETTO_VERSIONS_URL
+                }
+            };
+        };
+        let response;
+        try {
+            response = await this.http.getJson(source, {
+                ...(0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .getGitHubHttpHeaders */ .U_)(),
+                accept: 'application/vnd.github+json'
+            });
+        }
+        catch (error) {
+            const catalogRelease = await findCatalogRelease();
+            if (catalogRelease) {
+                return catalogRelease;
+            }
+            throw error;
+        }
+        const row = response.result?.body
+            ?.split(/\r?\n/)
+            .find(line => line.includes(`](${url})`));
+        const checksum = row?.match(/`([a-fA-F0-9]{64})`/)?.[1];
+        if (checksum) {
+            return {
+                version: this.version,
+                url,
+                checksum: { algorithm: 'sha256', value: checksum, source }
+            };
+        }
+        // The current catalog also covers releases missing from GitHub, such as Corretto 15 and 16.
+        const catalogRelease = await findCatalogRelease();
+        if (catalogRelease) {
+            return catalogRelease;
+        }
+        if (response.statusCode === _actions_http_client__WEBPACK_IMPORTED_MODULE_3__/* .HttpCodes */ .Hv.NotFound) {
+            throw new Error(`Corretto release ${version} was not found in Amazon's GitHub releases or current download catalog`);
+        }
+        if (!row) {
+            throw new Error(`No ${platform}/${arch} ${this.packageType} archive is listed for Corretto ${version}`);
+        }
+        throw new Error(`No SHA-256 checksum is published for Corretto ${version} (${platform}, ${arch}, ${this.packageType})`);
+    }
     async getAvailableVersions() {
         const platform = this.getPlatformOption();
         const arch = this.distributionArchitecture();
@@ -112,7 +197,7 @@ class CorrettoDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4
         for (const version in eligibleVersions) {
             const availableVersion = eligibleVersions[version];
             for (const fileType in availableVersion) {
-                const skipNonExtractableBinaries = fileType != (0,_util_js__WEBPACK_IMPORTED_MODULE_3__/* .getDownloadArchiveExtension */ .ag)();
+                const skipNonExtractableBinaries = fileType != (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .getDownloadArchiveExtension */ .ag)();
                 if (skipNonExtractableBinaries) {
                     continue;
                 }
@@ -139,7 +224,7 @@ class CorrettoDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4
             case 'win32':
                 return 'windows';
             case 'linux':
-                return (0,_platform_types_js__WEBPACK_IMPORTED_MODULE_5__/* .isAlpineLinux */ .G6)() ? 'alpine' : 'linux';
+                return (0,_platform_types_js__WEBPACK_IMPORTED_MODULE_6__/* .isAlpineLinux */ .G6)() ? 'alpine' : 'linux';
             default:
                 return process.platform;
         }

dist/setup/19.index.js

@@ -56,7 +56,7 @@ class LocalDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/
             let jdkCache;
             if (this.cacheJdk) {
                 const [{ getJdkVerificationIdentity }, source] = await Promise.all([
-                    Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779)),
+                    Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779)),
                     hashFile(jdkFilePath)
                 ]);
                 jdkCache = {
@@ -70,7 +70,7 @@ class LocalDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/
                 };
             }
             if (!this.forceDownload && jdkCache) {
-                const { restoreJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
+                const { restoreJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
                 const restored = await restoreJdk(jdkCache);
                 const restoredPath = restored
                     ? this.getRestoredJdkPath(this.version)
@@ -94,7 +94,7 @@ class LocalDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/
                     path: javaPath
                 };
                 if (jdkCache) {
-                    const { registerJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
+                    const { registerJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
                     registerJdk(jdkCache);
                 }
             }

dist/setup/220.index.js

@@ -1,330 +0,0 @@
-export const id = 220;
-export const ids = [220];
-export const modules = {
-
-/***/ 3220:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
-
-
-// EXPORTS
-__webpack_require__.d(__webpack_exports__, {
-  MicrosoftDistributions: () => (/* binding */ MicrosoftDistributions)
-});
-
-// UNUSED EXPORTS: MICROSOFT_PUBLIC_KEY
-
-// EXTERNAL MODULE: ./src/distributions/base-installer.ts + 2 modules
-var base_installer = __webpack_require__(6242);
-// EXTERNAL MODULE: ./src/util.ts
-var util = __webpack_require__(4527);
-// EXTERNAL MODULE: ./src/gpg.ts
-var gpg = __webpack_require__(8343);
-;// CONCATENATED MODULE: ./src/distributions/microsoft/microsoft-key.ts
-// Microsoft Build of OpenJDK GPG signing key
-// Retrieved from: https://download.visualstudio.microsoft.com/download/pr/b90071e2-e0cf-4411-98be-dbeb09d67bf0/8622862bcd54206e158c5abca0582c9b/464279_464280_aoc_20210208.asc
-const MICROSOFT_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: BSN Pgp v1.1.0.0
-
-mQENBGAhlWcBCADCQjj6huLTenvZSLej35e9YKEHm4lix2uvPOONexMaU8V2v7KL
-RGdoXF7jwHci7efnPZ+9zpS2+g3rhvv8M7yWy9E/1psEtGzvmp1IL/qIabMEQqi+
-UlhPGh7MQ/BkXAlic8Dyl3XYqr0EXS11iCiTr6Zkxs9Ee4V54gxL4gogRn4wk9sl
-/nrjgDzMsUwla0pynoQQvYpqCdiAr3gKKllT1skCDqgVOMMyZxsx9HjZxg/3AJz6
-r5i512L2R+3Hkv+XmxT+mnGBCFcny0DM7PjNXEmIK3ZSkro1tQML90zx3Fyh5esx
-fpVvuIXGFV75o35VVCBZoiD3hcfOnIJsPQ9nABEBAAG0OE1pY3Jvc29mdCBKYXZh
-IEVuZ2luZWVyaW5nIDxqYXZhcGxhdGluZnJhQG1pY3Jvc29mdC5jb20+iQE4BBMB
-CAAiBQJgIZVnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRA1Ux0xWyHB
-icwTCACJO2FGNocNvdUtAb+eDKuGwt0chAJdCES2ZtgBScwrwDyWpxpRznoXWBHL
-MJeLyxJoKsCG3vVlY4uh48psCzVm3OKvi7MCPT955t8W6TzfSBxTpjR8zRgJkjPJ
-EGhHTlusUfz7TtM5etJF0qscSJH1grcNsgtee97mk4QyEzT8Di83NQmYxKcBrliq
-yK/SWWt8VkTyYAEO6L5PoB4L9r8ka27uQs+jgCw+/Z0JMtNmmhyNGY3+a1YtPeoy
-JdQaI9LphfKGbVaz6SK2aol7vj+c2TG3TLUYdOYGMH1OZlri2GTkCVjwna2GC7p4
-Fa133tP85xzJEq1XeXm8WeLFo2wV
-=rHCS
------END PGP PUBLIC KEY BLOCK-----`;
-
-// EXTERNAL MODULE: ./src/constants.ts
-var constants = __webpack_require__(7242);
-// EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js + 7 modules
-var core = __webpack_require__(3838);
-// EXTERNAL MODULE: ./node_modules/@actions/tool-cache/lib/tool-cache.js + 2 modules
-var tool_cache = __webpack_require__(9805);
-// EXTERNAL MODULE: external "fs"
-var external_fs_ = __webpack_require__(9896);
-var external_fs_default = /*#__PURE__*/__webpack_require__.n(external_fs_);
-// EXTERNAL MODULE: external "path"
-var external_path_ = __webpack_require__(6928);
-var external_path_default = /*#__PURE__*/__webpack_require__.n(external_path_);
-;// CONCATENATED MODULE: ./src/distributions/microsoft/installer.ts
-
-
-
-
-
-
-
-
-
-
-class MicrosoftDistributions extends base_installer/* JavaBase */.O {
-    constructor(installerOptions) {
-        super('Microsoft', installerOptions);
-    }
-    async downloadTool(javaRelease) {
-        core/* info */.pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
-        let javaArchivePath = await this.downloadAndVerify(javaRelease);
-        if (this.verifySignature) {
-            try {
-                if (!javaRelease.signatureUrl) {
-                    throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.`);
-                }
-                core/* info */.pq(`Verifying Java package signature...`);
-                try {
-                    await gpg/* verifyPackageSignature */.Yi(javaArchivePath, javaRelease.signatureUrl, this.verifySignaturePublicKey ?? MICROSOFT_PUBLIC_KEY);
-                }
-                catch (error) {
-                    throw new Error(`Failed to verify signature for Microsoft Build of OpenJDK version ${javaRelease.version}. Signature URL: ${javaRelease.signatureUrl}. Error: ${error.message} ${constants/* SIGNATURE_VERIFICATION_FAILURE_HELP */.kQ}`, { cause: error });
-                }
-            }
-            catch (error) {
-                if (this.verifySignatureExplicitlyRequested) {
-                    throw error;
-                }
-                core/* warning */.$e(error instanceof Error ? error.message : `Unknown error: ${error}`);
-            }
-        }
-        core/* info */.pq(`Extracting Java archive...`);
-        const extension = (0,util/* getDownloadArchiveExtension */.ag)();
-        if (process.platform === 'win32') {
-            javaArchivePath = (0,util/* renameWinArchive */.n2)(javaArchivePath);
-        }
-        const extractedJavaPath = await (0,util/* extractJdkFile */.PE)(javaArchivePath, extension);
-        const archiveName = external_fs_default().readdirSync(extractedJavaPath)[0];
-        const archivePath = external_path_default().join(extractedJavaPath, archiveName);
-        const javaPath = await (0,util/* cacheJdkDir */.Vj)(archivePath, this.toolcacheFolderName, this.getToolcacheVersionName(javaRelease.version), this.architecture);
-        return { version: javaRelease.version, path: javaPath };
-    }
-    async findPackageForDownload(range) {
-        const arch = this.distributionArchitecture();
-        if (arch !== 'x64' && arch !== 'aarch64') {
-            throw new Error(`Unsupported architecture: ${this.architecture}`);
-        }
-        if (!this.stable) {
-            throw new Error('Early access versions are not supported');
-        }
-        if (this.packageType !== 'jdk') {
-            throw new Error('Microsoft Build of OpenJDK provides only the `jdk` package type');
-        }
-        const manifest = await this.getAvailableVersions();
-        if (!manifest) {
-            throw new Error('Could not load manifest for Microsoft Build of OpenJDK');
-        }
-        const foundRelease = await tool_cache/* findFromManifest */.DC(range, true, manifest, arch);
-        if (!foundRelease) {
-            const availableVersionStrings = manifest.map(item => item.version);
-            throw this.createVersionNotFoundError(range, availableVersionStrings);
-        }
-        const file = foundRelease.files[0];
-        const signatureUrl = file.signature_url ?? `${file.download_url}.sig`;
-        return {
-            url: file.download_url,
-            signatureUrl,
-            version: foundRelease.version,
-            checksum: await this.fetchChecksum(`${file.download_url}.sha256sum.txt`, 'sha256')
-        };
-    }
-    supportsSignatureVerification() {
-        return true;
-    }
-    async getAvailableVersions() {
-        let releases = null;
-        const fileUrl = `https://aka.ms/download-jdk/microsoft-openjdk-versions.json`;
-        // Avoid leaking the GitHub token to a non-GitHub host (aka.ms redirects to a CDN).
-        const headers = { accept: 'application/json' };
-        let response = null;
-        if (core/* isDebug */._o()) {
-            console.time('Retrieving available versions for Microsoft took'); // eslint-disable-line no-console
-        }
-        try {
-            response = await this.http.getJson(fileUrl, headers);
-            if (!response.result) {
-                return null;
-            }
-        }
-        catch (err) {
-            core/* debug */.Yz(`Http request for microsoft-openjdk-versions.json failed with status code: ${response?.statusCode}. Error: ${err}`);
-            return null;
-        }
-        if (response.result) {
-            releases = response.result;
-        }
-        if (core/* isDebug */._o() && releases) {
-            core/* startGroup */.Oh('Print information about available versions');
-            console.timeEnd('Retrieving available versions for Microsoft took'); // eslint-disable-line no-console
-            core/* debug */.Yz(`Available versions: [${releases.length}]`);
-            core/* debug */.Yz(releases.map(item => item.version).join(', '));
-            core/* endGroup */.N4();
-        }
-        return releases;
-    }
-}
-
-
-/***/ }),
-
-/***/ 8343:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   Fh: () => (/* binding */ importKey),
-/* harmony export */   Yi: () => (/* binding */ verifyPackageSignature),
-/* harmony export */   mS: () => (/* binding */ removeGpgHome),
-/* harmony export */   nY: () => (/* binding */ toGpgPath),
-/* harmony export */   o6: () => (/* binding */ isGpgAvailable)
-/* harmony export */ });
-/* unused harmony export GPG_HOME_PREFIX */
-/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
-/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
-/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
-/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
-/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
-/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
-
-
-
-
-
-
-
-const GPG_HOME_PREFIX = 'setup-java-gpg-';
-const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
-async function isGpgAvailable() {
-    return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
-}
-// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
-// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
-// internally. Passing Windows paths with backslashes can cause fatal GPG errors
-// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
-function toGpgPath(p) {
-    if (process.platform !== 'win32')
-        return p;
-    return p
-        .replace(/\\/g, '/')
-        .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
-}
-function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) {
-    const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix));
-    if (process.platform !== 'win32') {
-        fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
-    }
-    return gpgHome;
-}
-async function importKey(privateKey) {
-    const gpgHome = createGpgHome(GPG_HOME_PREFIX);
-    const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
-    try {
-        fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
-            encoding: 'utf-8',
-            flag: 'wx',
-            mode: 0o600
-        });
-        try {
-            await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
-                '--homedir',
-                toGpgPath(gpgHome),
-                '--batch',
-                '--import',
-                toGpgPath(privateKeyFile)
-            ], { silent: true });
-        }
-        finally {
-            fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(privateKeyFile, { force: true });
-        }
-        return gpgHome;
-    }
-    catch (error) {
-        await removeGpgHome(gpgHome);
-        throw error;
-    }
-}
-async function removeGpgHome(gpgHome) {
-    if (!gpgHome) {
-        return;
-    }
-    const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
-    const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
-    if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
-        !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
-        throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
-    }
-    if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
-        return;
-    }
-    await stopGpgAgent(resolvedGpgHome);
-    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
-}
-async function stopGpgAgent(gpgHome) {
-    try {
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
-    }
-    catch {
-        // gpgconf may be unavailable, but directory removal must still be attempted.
-    }
-}
-async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
-    const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
-    let gpgHome;
-    try {
-        // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
-        const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4();
-        gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
-    }
-    catch (error) {
-        try {
-            await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
-        }
-        catch {
-            // ignore cleanup failures
-        }
-        throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`, { cause: error });
-    }
-    try {
-        const publicKeys = Array.isArray(publicKeyContent)
-            ? publicKeyContent
-            : [publicKeyContent];
-        const publicKeyFiles = publicKeys.map((publicKey, index) => {
-            const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
-            fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
-            return toGpgPath(publicKeyFile);
-        });
-        const options = { silent: true };
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
-            '--homedir',
-            toGpgPath(gpgHome),
-            '--batch',
-            '--import',
-            ...publicKeyFiles
-        ], options);
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
-            '--homedir',
-            toGpgPath(gpgHome),
-            '--batch',
-            '--verify',
-            toGpgPath(signaturePath),
-            toGpgPath(archivePath)
-        ], options);
-    }
-    finally {
-        await stopGpgAgent(gpgHome);
-        await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
-        await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
-    }
-}
-
-
-/***/ })
-
-};

dist/setup/242.index.js

@@ -360,7 +360,7 @@ class JavaBase {
                         ? await this.createJdkCache(javaRelease)
                         : undefined;
                     if (!this.forceDownload && jdkCache) {
-                        const { restoreJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
+                        const { restoreJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
                         const restored = await restoreJdk(jdkCache);
                         if (restored) {
                             const restoredPath = this.getRestoredJdkPath(javaRelease.version);
@@ -378,7 +378,7 @@ class JavaBase {
                         core/* info */.pq(`Java ${foundJava.version} was downloaded`);
                         if (javaRelease.floating) {
                             if (!semver_default().valid(foundJava.version) ||
-                                !(0,util/* isVersionSatisfies */.y)(this.version, foundJava.version)) {
+                                !this.isVersionSatisfied(this.version, foundJava.version)) {
                                 throw new Error(`The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`);
                             }
                             javaRelease = { ...javaRelease, version: foundJava.version };
@@ -392,7 +392,7 @@ class JavaBase {
                             // Register after the installation exists so its identity is
                             // captured; the post-job save refuses to upload a path whose
                             // installation was replaced afterwards.
-                            const { registerJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
+                            const { registerJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
                             registerJdk(jdkCache);
                         }
                     }
@@ -441,7 +441,7 @@ class JavaBase {
             const release = await this.findPackageForDownload(this.version);
             return this.restoreFloatingResolution(release);
         }
-        const { restoreJdkResolution, registerJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
+        const { restoreJdkResolution, registerJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
         const request = {
             distribution: this.distribution,
             packageType: this.packageType,
@@ -477,7 +477,7 @@ class JavaBase {
         return false;
     }
     async createJdkCache(javaRelease) {
-        const { getJdkVerificationIdentity } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
+        const { getJdkVerificationIdentity } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
         return {
             distribution: this.distribution,
             packageType: this.packageType,
@@ -495,13 +495,13 @@ class JavaBase {
             this.forceDownload) {
             return javaRelease;
         }
-        const { restoreJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
+        const { restoreJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
         const restored = await restoreJdkResolution(this.getFloatingResolutionRequest(javaRelease));
         if (!restored) {
             return javaRelease;
         }
         if (!semver_default().valid(restored.release.version) ||
-            !(0,util/* isVersionSatisfies */.y)(this.version, restored.release.version)) {
+            !this.isVersionSatisfied(this.version, restored.release.version)) {
             core/* debug */.Yz(`Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`);
             return javaRelease;
         }
@@ -515,7 +515,7 @@ class JavaBase {
             this.forceDownload) {
             return;
         }
-        const { registerJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
+        const { registerJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(219), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
         registerJdkResolution(this.getFloatingResolutionRequest(javaRelease), javaRelease);
     }
     getFloatingResolutionRequest(javaRelease) {
@@ -684,10 +684,10 @@ class JavaBase {
         })
             .filter(item => item.stable === this.stable);
         const satisfiedVersions = availableVersions
-            .filter(item => (0,util/* isVersionSatisfies */.y)(this.version, item.version))
+            .filter(item => this.isVersionSatisfied(this.version, item.version))
             .filter(item => item.path)
             .sort((a, b) => {
-            return -semver_default().compareBuild(a.version, b.version);
+            return -this.compareVersions(a.version, b.version);
         });
         if (!satisfiedVersions || satisfiedVersions.length === 0) {
             return null;
@@ -697,6 +697,12 @@ class JavaBase {
             path: satisfiedVersions[0].path
         };
     }
+    isVersionSatisfied(range, version) {
+        return (0,util/* isVersionSatisfies */.y)(range, version);
+    }
+    compareVersions(a, b) {
+        return semver_default().compareBuild(a, b);
+    }
     normalizeVersion(version) {
         let stable = true;
         const latest = false;

dist/setup/282.index.js

@@ -34,16 +34,16 @@ class JetBrainsDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
     async findPackageForDownload(range) {
         const versionsRaw = await this.getAvailableVersions();
         const versions = versionsRaw.map(v => {
-            const formattedVersion = `${v.semver}+${v.build}`;
+            const formattedVersion = (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .normalizeJavaVersionToSemver */ .zZ)(`${v.semver}+${v.build}`);
             return {
                 version: formattedVersion,
                 url: v.url
             };
         });
         const satisfiedVersions = versions
-            .filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .isVersionSatisfies */ .y)(range, item.version))
+            .filter(item => this.isVersionSatisfied(range, item.version))
             .sort((a, b) => {
-            return -semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(a.version, b.version);
+            return -this.compareVersions(a.version, b.version);
         });
         const resolvedFullVersion = satisfiedVersions.length > 0 ? satisfiedVersions[0] : null;
         if (!resolvedFullVersion) {
@@ -59,6 +59,44 @@ class JetBrainsDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
             checksum: await this.fetchChecksum(`${resolvedFullVersion.url}.checksum`, ['sha512', 'sha256'])
         };
     }
+    normalizeVersion(version) {
+        const normalized = super.normalizeVersion(version);
+        if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+            // A patch-only request must match any JBR build of that patch.
+            normalized.version = version.replace(/-ea$/, '');
+        }
+        return normalized;
+    }
+    isVersionSatisfied(range, version) {
+        const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+        if (patchRequest) {
+            const candidate = semver__WEBPACK_IMPORTED_MODULE_3___default().parse(version);
+            return (candidate !== null &&
+                semver__WEBPACK_IMPORTED_MODULE_3___default().eq(patchRequest[1], candidate) &&
+                (candidate.build.slice(0, -2).join('.') || '0') ===
+                    patchRequest[2].slice(1));
+        }
+        return super.isVersionSatisfied(range, version);
+    }
+    compareVersions(a, b) {
+        const mainComparison = semver__WEBPACK_IMPORTED_MODULE_3___default().compare(a, b);
+        if (mainComparison !== 0) {
+            return mainComparison;
+        }
+        // JBR builds have two components (one in older releases). Any preceding
+        // metadata components are Java patch fields and take priority over builds.
+        const first = new (semver__WEBPACK_IMPORTED_MODULE_3___default().SemVer)(a).build;
+        const second = new (semver__WEBPACK_IMPORTED_MODULE_3___default().SemVer)(b).build;
+        const firstPatch = first.slice(0, -2);
+        const secondPatch = second.slice(0, -2);
+        for (let index = 0; index < Math.max(firstPatch.length, secondPatch.length); index++) {
+            const patchComparison = semver__WEBPACK_IMPORTED_MODULE_3___default().compareIdentifiers(firstPatch[index] ?? '0', secondPatch[index] ?? '0');
+            if (patchComparison !== 0) {
+                return patchComparison;
+            }
+        }
+        return semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(first.length ? `0.0.0+${first.slice(-2).join('.')}` : '0.0.0', second.length ? `0.0.0+${second.slice(-2).join('.')}` : '0.0.0');
+    }
     async downloadTool(javaRelease) {
         _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
         const javaArchivePath = await this.downloadAndVerify(javaRelease);

dist/setup/348.index.js

@@ -16,7 +16,7 @@ export const modules = {
 /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_1__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6971);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4219);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(3838);
 
 

dist/setup/377.index.js

@@ -14,7 +14,7 @@ export const modules = {
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_0__);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6971);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(4219);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3838);
 /* harmony import */ var _actions_glob__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(2377);
 /**

dist/setup/394.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   isCacheFeatureAvailable: () => (/* binding */ isCacheFeatureAvailable)
 /* harmony export */ });
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(6971);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4219);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3838);
 /* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(4527);
 

dist/setup/63.index.js

@@ -52,14 +52,58 @@ class LibericaDistributions extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
             version: this.convertVersionToSemver(item)
         }));
         const satisfiedVersion = availableVersions
-            .filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_2__/* .isVersionSatisfies */ .y)(range, item.version))
+            .filter(item => this.isVersionSatisfied(range, item.version))
-            .sort((a, b) => -semver__WEBPACK_IMPORTED_MODULE_1___default().compareBuild(a.version, b.version))[0];
+            .sort((a, b) => -this.compareVersions(a.version, b.version))[0];
         if (!satisfiedVersion) {
             const availableVersionStrings = availableVersions.map(item => item.version);
             throw this.createVersionNotFoundError(range, availableVersionStrings);
         }
         return satisfiedVersion;
     }
+    normalizeVersion(version) {
+        const normalized = super.normalizeVersion(version);
+        if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+            // Keep patch-only requests distinct from exact SDKMAN build requests.
+            normalized.version = version.replace(/-ea$/, '');
+        }
+        return normalized;
+    }
+    isVersionSatisfied(range, version) {
+        const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+        if (patchRequest) {
+            const candidate = semver__WEBPACK_IMPORTED_MODULE_1___default().parse(version);
+            if (!candidate || !semver__WEBPACK_IMPORTED_MODULE_1___default().eq(patchRequest[1], candidate)) {
+                return false;
+            }
+            const patch = candidate.build.length > 1
+                ? candidate.build.slice(0, -1).join('.')
+                : '0';
+            return patch === patchRequest[2].slice(1);
+        }
+        return super.isVersionSatisfied(range, version);
+    }
+    compareVersions(a, b) {
+        const mainComparison = semver__WEBPACK_IMPORTED_MODULE_1___default().compare(a, b);
+        if (mainComparison !== 0) {
+            return mainComparison;
+        }
+        const getPatchAndBuild = (version) => {
+            const build = new (semver__WEBPACK_IMPORTED_MODULE_1___default().SemVer)(version).build;
+            return build.length > 1
+                ? { patch: build.slice(0, -1), build: build[build.length - 1] }
+                : { patch: [], build: build[0] ?? '0' };
+        };
+        const first = getPatchAndBuild(a);
+        const second = getPatchAndBuild(b);
+        const compareNumericIdentifiers = (left, right) => semver__WEBPACK_IMPORTED_MODULE_1___default().compareBuild(`0.0.0+${left}`, `0.0.0+${right}`);
+        for (let index = 0; index < Math.max(first.patch.length, second.patch.length); index++) {
+            const patchComparison = compareNumericIdentifiers(first.patch[index] ?? '0', second.patch[index] ?? '0');
+            if (patchComparison !== 0) {
+                return patchComparison;
+            }
+        }
+        return compareNumericIdentifiers(first.build, second.build);
+    }
     async getAvailableVersions() {
         if (_actions_core__WEBPACK_IMPORTED_MODULE_3__/* .isDebug */ ._o()) {
             console.time('Retrieving available versions for Liberica took'); // eslint-disable-line no-console
@@ -131,6 +175,14 @@ class LibericaDistributions extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
         const { featureVersion, interimVersion, updateVersion } = version;
         const buildVersion = version.version.split('+')[1] || version.buildVersion;
         const mainVersion = [featureVersion, interimVersion, updateVersion].join('.');
+        const patchVersion = version.version
+            .split('+')[0]
+            .split('.')
+            .slice(3)
+            .join('.');
+        if (patchVersion) {
+            return `${mainVersion}+${patchVersion}.${buildVersion}`;
+        }
         if (buildVersion != 0) {
             return `${mainVersion}+${buildVersion}`;
         }

dist/setup/779.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   isCacheFeatureAvailable: () => (/* binding */ isCacheFeatureAvailable)
 /* harmony export */ });
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(6971);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4219);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3838);
 /* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(4527);
 
@@ -46,7 +46,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_1__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6971);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4219);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(3838);
 /* harmony import */ var _cache_feature_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(1394);
 

dist/setup/81.index.js

@@ -14,6 +14,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   getInputWithDeprecatedAlias: () => (/* binding */ getInputWithDeprecatedAlias),
 /* harmony export */   getMavenRepositorySettings: () => (/* binding */ getMavenRepositorySettings),
 /* harmony export */   getMavenServerSettings: () => (/* binding */ getMavenServerSettings),
+/* harmony export */   parseMavenMirrors: () => (/* binding */ parseMavenMirrors),
 /* harmony export */   parseMavenRepositories: () => (/* binding */ parseMavenRepositories),
 /* harmony export */   parseMavenServerCredentials: () => (/* binding */ parseMavenServerCredentials)
 /* harmony export */ });
@@ -42,6 +43,7 @@ const MAVEN_REPOSITORY_ORIGIN = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]+\/?$/;
 async function configureAuthentication() {
     const servers = getMavenServerSettings();
     const repositorySettings = getMavenRepositorySettings();
+    const mirrors = parseMavenMirrors(_actions_core__WEBPACK_IMPORTED_MODULE_1__/* .getMultilineInput */ .q3(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_MIRRORS */ .K));
     const settingsDirectory = _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .getInput */ .V4(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_SETTINGS_PATH */ .Xh) ||
         path__WEBPACK_IMPORTED_MODULE_0__.join(os__WEBPACK_IMPORTED_MODULE_4__.homedir(), _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .M2_DIR */ .iT);
     const overwriteSettings = (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getBooleanInput */ .Vt)(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_OVERWRITE_SETTINGS */ .TS, true);
@@ -51,7 +53,7 @@ async function configureAuthentication() {
     if (gpgPrivateKey) {
         _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .setSecret */ .Pq(gpgPrivateKey);
     }
-    await createAuthenticationSettings(servers, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar, repositorySettings);
+    await createAuthenticationSettings(servers, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar, repositorySettings, mirrors);
     if (gpgPrivateKey) {
         _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .info */ .pq('Importing private gpg key');
         const gpgHome = await _gpg_js__WEBPACK_IMPORTED_MODULE_5__/* .importKey */ .Fh(gpgPrivateKey);
@@ -222,6 +224,37 @@ function parseMavenRepositories(entries, includeCentral, inputName = _constants_
     });
     return repositories;
 }
+// only exported for testing purposes
+function parseMavenMirrors(entries) {
+    const mirrors = [];
+    const mirrorIds = new Set();
+    entries.forEach((entry, index) => {
+        if (!entry.trim()) {
+            return;
+        }
+        const separator = entry.indexOf(':');
+        const remainder = entry.slice(separator + 1).trim();
+        // Protect scheme/authority colons (including IPv6 and ports) before
+        // finding the selector, which may itself contain external:http:*.
+        const urlPrefix = /^[A-Za-z][A-Za-z0-9+.-]*:(?:\/\/(?:[^/?#@\s]*@)?(?:\[[^\]]+\]|[^:/?#\s]+)(?::\d+(?=[/?#:\s]|$))?)?/.exec(remainder)?.[0] ?? '';
+        const fields = /^(.*?):((?:\s*!?external:(?:http:)?\*\s*|[^:,]*)(?:,(?:\s*!?external:(?:http:)?\*\s*|[^:,]*))*)$/.exec(remainder.slice(urlPrefix.length));
+        if (separator < 0 || !fields) {
+            throw new Error(`Invalid mvn-mirrors entry at line ${index + 1}. Expected format: mirror-id:mirror-url:mirror-of`);
+        }
+        const id = entry.slice(0, separator).trim();
+        const url = `${urlPrefix}${fields[1]}`.trim();
+        const mirrorOf = fields[2].trim();
+        if (!id || !url || !mirrorOf) {
+            throw new Error(`Invalid mvn-mirrors entry at line ${index + 1}. mirror-id, mirror URL, and mirror-of are required`);
+        }
+        if (mirrorIds.has(id)) {
+            throw new Error(`Duplicate mirror-id '${id}' in mvn-mirrors input at line ${index + 1}`);
+        }
+        mirrorIds.add(id);
+        mirrors.push({ id, url, mirrorOf });
+    });
+    return mirrors;
+}
 function generateRepositorySection(customRepositories, settings, element) {
     if (!customRepositories.length && settings.includeCentral) {
         return [];
@@ -253,15 +286,15 @@ function generateRepositorySection(customRepositories, settings, element) {
     lines.push(`      </${container}>`);
     return lines;
 }
-async function createAuthenticationSettings(servers, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar = undefined, repositorySettings = undefined) {
+async function createAuthenticationSettings(servers, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar = undefined, repositorySettings = undefined, mirrors = []) {
     _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .info */ .pq(`Creating ${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MVN_SETTINGS_FILE */ .vO} with server-id: ${servers.map(server => server.id).join(', ')}`);
     // when an alternate m2 location is specified use only that location (no .m2 directory)
     // otherwise use the home/.m2/ path
     await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .mkdirP */ .U$(settingsDirectory);
-    await write(settingsDirectory, generate(servers, gpgPassphraseEnvVar, repositorySettings), overwriteSettings);
+    await write(settingsDirectory, generate(servers, gpgPassphraseEnvVar, repositorySettings, mirrors), overwriteSettings);
 }
 // only exported for testing purposes
-function generate(servers, gpgPassphraseEnvVar, repositorySettings) {
+function generate(servers, gpgPassphraseEnvVar, repositorySettings, mirrors = []) {
     // The maven-gpg-plugin reads the passphrase from the environment variable
     // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE).
     // Only configure it when the requested env var name differs from that default;
@@ -289,6 +322,13 @@ function generate(servers, gpgPassphraseEnvVar, repositorySettings) {
         lines.push('    </server>');
     }
     lines.push('  </servers>');
+    if (mirrors.length) {
+        lines.push('  <mirrors>');
+        for (const mirror of mirrors) {
+            lines.push('    <mirror>', `      <id>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(mirror.id)}</id>`, `      <url>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(mirror.url)}</url>`, `      <mirrorOf>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(mirror.mirrorOf)}</mirrorOf>`, '    </mirror>');
+        }
+        lines.push('  </mirrors>');
+    }
     if (repositorySettings || includeGpgPassphraseProfile) {
         lines.push('  <profiles>');
         if (repositorySettings) {

dist/setup/824.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */   i: () => (/* binding */ XMLValidator)
 /* harmony export */ });
 /* harmony import */ var _validator_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1176);
-/* harmony import */ var _xmlparser_XMLParser_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6009);
+/* harmony import */ var _xmlparser_XMLParser_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1143);
 
 
 
@@ -627,7 +627,7 @@ function getPositionFromMatch(match) {
 
 /***/ }),
 
-/***/ 6009:
+/***/ 1143:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -1582,8 +1582,10 @@ function toNumber(str, options = {}) {
         return parse_int(trimmedStr, 2);
     } else if (options.octal && octRegex.test(trimmedStr)) {
         return parse_int(trimmedStr, 8);
-    } else if (!isFinite(trimmedStr)) { //Infinity
+    } else if (!isFinite(trimmedStr)) { //Infinity or not a number
-        return handleInfinity(str, Number(trimmedStr), options);
+        const num = Number(trimmedStr);
+        if (Number.isNaN(num)) return str; //not a number: always the original string
+        return handleInfinity(str, num, options); //only +/-Infinity reaches here
     } else if (trimmedStr.includes('e') || trimmedStr.includes('E')) { //eNotation
         return resolveEnotation(str, trimmedStr, options);
     } else {
@@ -1595,8 +1597,8 @@ function toNumber(str, options = {}) {
             const leadingZeros = match[2];
             let numTrimmedByZeros = trimZeros(match[3]); //complete num without leading zeros
             const decimalAdjacentToLeadingZeros = sign ? // 0., -00., 000.
-                str[leadingZeros.length + 1] === "."
+                trimmedStr[leadingZeros.length + 1] === "."
-                : str[leadingZeros.length] === ".";
+                : trimmedStr[leadingZeros.length] === ".";
 
             //trim ending zeros for floating number
             if (!options.leadingZeros //leading zeros are not allowed
@@ -1644,8 +1646,8 @@ function resolveEnotation(str, trimmedStr, options) {
         const eChar = notation[3].indexOf("e") === -1 ? "E" : "e";
         const leadingZeros = notation[2];
         const eAdjacentToLeadingZeros = sign ? // 0E.
-            str[leadingZeros.length + 1] === eChar
+            trimmedStr[leadingZeros.length + 1] === eChar
-            : str[leadingZeros.length] === eChar;
+            : trimmedStr[leadingZeros.length] === eChar;
 
         if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str;
         else if (leadingZeros.length === 1
@@ -1654,8 +1656,7 @@ function resolveEnotation(str, trimmedStr, options) {
         } else if (leadingZeros.length > 0) {
             // Has leading zeros — only accept if leadingZeros option allows it
             if (options.leadingZeros && !eAdjacentToLeadingZeros) {
-                trimmedStr = (notation[1] || "") + notation[3];
+                return Number(trimmedStr); // Number() accepts leading zeros; stripping can leave a mantissa-less ".e0"
-                return Number(trimmedStr);
             } else return str;
         } else {
             // No leading zeros — always valid e-notation, parse it
@@ -1718,6 +1719,7 @@ function handleInfinity(str, num, options) {
             return str; // Return original string like "1e1000"
     }
 }
+
 ;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/ignoreAttributes.js
 function getIgnoreAttributesFn(ignoreAttributes) {
     if (typeof ignoreAttributes === 'function') {
@@ -3899,6 +3901,56 @@ const SQL_STRICT_PATTERNS = [...sql, ...SQL_STRICT_EXTRA];
 
 /* harmony default export */ const sql_strict = (SQL_STRICT_PATTERNS);
 
+;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/util/decode-entities.js
+/**
+ * Decode the HTML character references that matter for markup-context
+ * detection.
+ *
+ * Browsers decode character references in attribute values before they
+ * interpret a URL, so `javascript:alert(1)` in an href is the
+ * `javascript:` scheme. The HTML/XML/SVG rules match literal characters, so
+ * without this step such payloads slip through.
+ *
+ * Deliberately NOT a full entity decoder. It decodes only:
+ *   - decimal refs  :  :  :  &#58   (any leading zeros,
+ *                   trailing ; optional — browsers accept both)
+ *   - hex refs      : : : &#x3a   (same)
+ *   - named refs    :  	  

+ *       Named refs are CASE-SENSITIVE and REQUIRE the trailing ';', exactly
+ *       like a browser (so `:` and `&colon` are not decoded).
+ *       	 / 
 matter because the URL parser strips tab/newline,
+ *       so `java	script:` is still a javascript: URL.
+ *
+ * It does NOT decode & (single pass only), so double-encoded text such as
+ * "<script>" stays literal — a browser renders that as text.
+ *
+ * All quantifiers are bounded; no ReDoS risk.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+const NAMED = Object.freeze({
+  colon: ':',
+  Tab: '\t',
+  NewLine: '\n',
+});
+
+const ENTITY_RE =
+  /&(?:#[xX]0*([0-9a-fA-F]{1,6});?|#0*([0-9]{1,7});?|([a-zA-Z][a-zA-Z0-9]{1,15});)/g;
+
+function decodeEntities(input) {
+  if (input.indexOf('&') === -1) return input;
+
+  return input.replace(ENTITY_RE, (match, hex, dec, name) => {
+    if (name !== undefined) {
+      return Object.prototype.hasOwnProperty.call(NAMED, name) ? NAMED[name] : match;
+    }
+    const cp = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);
+    if (!Number.isFinite(cp) || cp > 0x10ffff) return match;
+    return String.fromCodePoint(cp);
+  });
+}
+
 ;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/html.js
 /**
  * HTML context patterns.
@@ -4062,7 +4114,8 @@ const XML_PATTERNS = [
   {
     id: 'xml-namespace-confusion',
     description: 'xmlns: attribute injection — can redefine namespaces to confuse parsers',
-    pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    // pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    pattern: /\bxmlns(?::\w{1,40})?\s*=/i,
   },
   {
     id: 'xml-comment-injection',
@@ -4581,6 +4634,11 @@ const LOG_PATTERNS = [
 
 
 
+// Markup contexts are also matched against an entity-decoded copy of the input,
+// because browsers decode HTML character references before interpreting a URL
+// scheme (e.g. javascript:… is a javascript: URL).
+
+
 // ─── VALID_CONTEXTS convenience re-export ─────────────────────────────────
 // Importing this pulls in ALL contexts. Use it only when you need all of them
 // (e.g. for validation UI, tooling, or exhaustive audits).
@@ -4603,6 +4661,12 @@ const LOG_PATTERNS = [
 html.label       = 'HTML';
 xml.label        = 'XML';
 svg.label        = 'SVG';
+
+// Markup contexts: also test an entity-decoded copy (see util/decode-entities.js).
+// Non-markup contexts (SQL, SHELL, LOG, …) are matched byte-for-byte as supplied.
+html.decodeEntities = true;
+xml.decodeEntities  = true;
+svg.decodeEntities  = true;
 sql.label        = 'SQL';
 sql_strict.label = 'SQL-STRICT';
 shell.label      = 'SHELL';
@@ -4697,6 +4761,20 @@ function normalise(context) {
   return { lists: [context], regex: null };
 }
 
+/**
+ * For markup contexts, return an entity-decoded copy of `value` to test
+ * alongside the raw input, or null when there is nothing extra to test.
+ *
+ * @param {string} value
+ * @param {Rule[]} list
+ * @returns {string|null}
+ */
+function decodedCopy(value, list) {
+  if (!list.decodeEntities) return null;
+  const decoded = decodeEntities(value);
+  return decoded === value ? null : decoded;
+}
+
 /**
  * Test value against a single PatternList. Returns the first MatchResult or null.
  *
@@ -4706,8 +4784,9 @@ function normalise(context) {
  */
 function matchList(value, list) {
   const label = list.label ?? 'CUSTOM';
+  const decoded = decodedCopy(value, list);
   for (const rule of list) {
-    if (rule.pattern.test(value)) {
+    if (rule.pattern.test(value) || (decoded !== null && rule.pattern.test(decoded))) {
       return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern };
     }
   }
@@ -4805,8 +4884,9 @@ function allUnsafe(value, context) {
 
   for (const list of lists) {
     const label = list.label ?? 'CUSTOM';
+    const decoded = decodedCopy(value, list);
     for (const rule of list) {
-      if (rule.pattern.test(value)) {
+      if (rule.pattern.test(value) || (decoded !== null && rule.pattern.test(decoded))) {
         results.push({ context: label, id: rule.id, description: rule.description, pattern: rule.pattern });
       }
     }
@@ -5104,7 +5184,15 @@ function buildAttributesMap(attrStr, jPath, tagName, force = false) {
   }
 }
 const parseXml = function (xmlData) {
-  xmlData = xmlData.replace(/\r\n?/g, "\n"); //TODO: remove this line
+  const options = this.options;
+  const crlfPositions = options.captureMetaData ? [] : undefined;
+  xmlData = xmlData.replace(/\r\n?/g, options.captureMetaData ? (newline, index) => {
+    if (newline.length === 2) {
+      // Store the position after earlier CRLF pairs have been normalized.
+      crlfPositions.push(index - crlfPositions.length);
+    }
+    return "\n";
+  } : "\n");
   const xmlObj = new XmlNode('!xml');
   let currentNode = xmlObj;
   let textData = "";
@@ -5117,7 +5205,6 @@ const parseXml = function (xmlData) {
   this.entityExpansionCount = 0;
   this.currentExpandedLength = 0;
   this.doctypefound = false;
-  const options = this.options;
   const docTypeReader = new DocTypeReader(options.processEntities);
   const xmlLen = xmlData.length;
   for (let i = 0; i < xmlLen; i++) {//for each char in XML data
@@ -5161,7 +5248,7 @@ const parseXml = function (xmlData) {
         currentNode = this.tagsNodeStack.pop() || xmlObj;//avoid recursion, set the parent tag scope
 
         if (options.captureMetaData && currentNode) {
-          currentNode.addEndIndex(closeIndex + 1);
+          currentNode.addEndIndex(getOriginalIndex(closeIndex + 1, crlfPositions));
         }
         textData = "";
         i = closeIndex;
@@ -5187,11 +5274,12 @@ const parseXml = function (xmlData) {
           if (tagData.tagName !== tagData.tagExp && tagData.attrExpPresent && options.ignoreAttributes !== true) {
             childNode[":@"] = attsMap
           }
-          this.addChild(currentNode, childNode, this.readonlyMatcher, i);
+          const startIndex = options.captureMetaData ? getOriginalIndex(i, crlfPositions) : i;
+          this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
           if (options.captureMetaData) {
             // closeIndex points at '?' of the closing '?>'
-            currentNode.addEndIndex(tagData.closeIndex + 2);
+            currentNode.addEndIndex(getOriginalIndex(tagData.closeIndex + 2, crlfPositions));
           }
         }
 
@@ -5323,7 +5411,7 @@ const parseXml = function (xmlData) {
           this.isCurrentNodeStopNode = this.isItStopNode();
         }
 
-        const startIndex = i;
+        const startIndex = options.captureMetaData ? getOriginalIndex(i, crlfPositions) : i;
         if (this.isCurrentNodeStopNode) {
           let tagContent = "";
 
@@ -5359,7 +5447,7 @@ const parseXml = function (xmlData) {
           this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
           if (options.captureMetaData) {
-            currentNode.addEndIndex(i + 1);
+            currentNode.addEndIndex(getOriginalIndex(i + 1, crlfPositions));
           }
         } else {
           //selfClosing tag
@@ -5373,7 +5461,7 @@ const parseXml = function (xmlData) {
             this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
             if (options.captureMetaData) {
-              currentNode.addEndIndex(closeIndex + 1);
+              currentNode.addEndIndex(getOriginalIndex(closeIndex + 1, crlfPositions));
             }
             this.matcher.pop(); // Pop self-closing tag
             this.isCurrentNodeStopNode = false; // Reset flag
@@ -5386,7 +5474,7 @@ const parseXml = function (xmlData) {
             this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
             if (options.captureMetaData) {
-              currentNode.addEndIndex(result.closeIndex + 1);
+              currentNode.addEndIndex(getOriginalIndex(result.closeIndex + 1, crlfPositions));
             }
             this.matcher.pop(); // Pop unpaired tag
             this.isCurrentNodeStopNode = false; // Reset flag
@@ -5419,6 +5507,17 @@ const parseXml = function (xmlData) {
   return xmlObj.child;
 }
 
+function getOriginalIndex(index, crlfPositions) {
+  let low = 0;
+  let high = crlfPositions.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if (crlfPositions[middle] < index) low = middle + 1;
+    else high = middle;
+  }
+  return index + low;
+}
+
 function addChild(currentNode, childNode, matcher, startIndex) {
   // unset startIndex if not requested
   if (!this.options.captureMetaData) startIndex = undefined;
@@ -5597,6 +5696,8 @@ function readStopNodeData(xmlData, tagName, i) {
   const startIndex = i;
   // Starting at 1 since we already have an open tag
   let openTagCount = 1;
+  let lenient = false; // set once a quote-aware tag scan fails
+  let nextGt = -1; // cached index of the next '>'
 
   const xmllen = xmlData.length;
   for (; i < xmllen; i++) {
@@ -5628,14 +5729,29 @@ function readStopNodeData(xmlData, tagName, i) {
         const closeIndex = findClosingIndex(xmlData, "]]>", i, "StopNode is not closed.") - 2;
         i = closeIndex;
       } else {
-        const tagData = readTagExp(xmlData, i, false)
+        const tagData = lenient ? undefined : readTagExp(xmlData, i, false);
 
         if (tagData) {
-          const openTagName = tagData && tagData.tagName;
+          const openTagName = tagData.tagName;
           if (openTagName === tagName && tagData.tagExp[tagData.tagExp.length - 1] !== "/") {
             openTagCount++;
           }
           i = tagData.closeIndex;
+        } else {
+          // no closing '>'. use lenient approach to find '<' instead of readTagExp, to avoid repeated rescans.
+          lenient = true;
+          if (nextGt < i) {
+            nextGt = xmlData.indexOf(">", i);
+            if (nextGt === -1) return; // no '>' left, so no closing tag can follow
+          }
+          const nextLt = xmlData.indexOf("<", i + 1);
+          if (nextLt === -1 || nextLt > nextGt) { // looks like a real tag
+            const exp = xmlData.substring(i + 1, nextGt);
+            const sep = exp.search(/\s/);
+            const name = sep === -1 ? exp : exp.substring(0, sep);
+            if (name === tagName && exp[exp.length - 1] !== "/") openTagCount++;
+            i = nextGt;
+          } // else: treat this '<' as plain text
         }
       }
     }
@@ -5871,6 +5987,7 @@ function isLeafTag(obj, options) {
 // EXTERNAL MODULE: ./node_modules/fast-xml-parser/src/validator.js
 var validator = __webpack_require__(1176);
 ;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/XMLParser.js
+/* global Uint8Array */
 
 
 
@@ -5891,7 +6008,12 @@ class XMLParser {
      */
     parse(xmlData, validationOption) {
         if (typeof xmlData !== "string" && xmlData.toString) {
-            xmlData = xmlData.toString();
+            if (xmlData instanceof Uint8Array &&
+                !(typeof Buffer !== "undefined" && Buffer.isBuffer(xmlData))) {
+                xmlData = new TextDecoder("utf-8", { ignoreBOM: true }).decode(xmlData);
+            } else {
+                xmlData = xmlData.toString();
+            }
         } else if (typeof xmlData !== "string") {
             throw new Error("XML data is accepted in String or Bytes[] form.")
         }

dist/setup/index.js

@@ -7217,7 +7217,7 @@ function defaultFactory (origin, opts) {
 }
 
 class Agent extends DispatcherBase {
-  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, ...options } = {}) {
+  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, tls, ...options } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
@@ -7236,11 +7236,15 @@ class Agent extends DispatcherBase {
       connect = { ...connect }
     }
 
+    if (tls && typeof tls !== 'function') {
+      tls = { ...tls }
+    }
+
     this[kInterceptors] = options.interceptors?.Agent && Array.isArray(options.interceptors.Agent)
       ? options.interceptors.Agent
       : [createRedirectInterceptor({ maxRedirections })]
 
-    this[kOptions] = { ...util.deepClone(options), connect }
+    this[kOptions] = { ...util.deepClone(options), connect, tls }
     this[kOptions].interceptors = options.interceptors
       ? { ...options.interceptors }
       : undefined
@@ -8273,8 +8277,6 @@ async function connectH1 (client, socket) {
   socket[kParser] = new Parser(client, socket, llhttpInstance)
 
   addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     const parser = this[kParser]
 
     // On Mac OS, we get an ECONNRESET even if there is a full body to be forwarded
@@ -9204,8 +9206,6 @@ async function connectH2 (client, socket) {
   socket[kHTTP2Session] = session
 
   util.addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     this[kError] = err
 
     this[kClient][kOnError](err)
@@ -9279,8 +9279,6 @@ function resumeH2 (client) {
 }
 
 function onHttp2SessionError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   this[kSocket][kError] = err
   this[kClient][kOnError](err)
 }
@@ -9978,9 +9976,10 @@ class Client extends DispatcherBase {
     // h2
     maxConcurrentStreams,
     allowH2,
-    webSocket
+    webSocket,
+    eventSource
   } = {}) {
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -10501,6 +10500,7 @@ module.exports = Client
 
 
 
+const buffer = __nccwpck_require__(4573)
 const Dispatcher = __nccwpck_require__(883)
 const {
   ClientDestroyedError,
@@ -10513,6 +10513,7 @@ const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kInterceptedDispatch = Symbol('Intercepted Dispatch')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   constructor (opts) {
@@ -10523,6 +10524,7 @@ class DispatcherBase extends Dispatcher {
     this[kClosed] = false
     this[kOnClosed] = []
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   get webSocketOptions () {
@@ -10532,6 +10534,12 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   get destroyed () {
     return this[kDestroyed]
   }
@@ -16890,6 +16898,7 @@ module.exports = {
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 
+const buffer = __nccwpck_require__(4573)
 const { Transform } = __nccwpck_require__(7075)
 const { isASCIINumber, isValidLastEventId } = __nccwpck_require__(4811)
 
@@ -16914,11 +16923,19 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
 const RETRY = Buffer.from('retry')
 
+// Each data field creates a string node, and each unconsumed input chunk keeps
+// a Buffer wrapper. The absolute ceiling protects the large default byte limit.
+const minParserItems = 1024
+const maxParserItems = 131072
+const bytesPerParserItem = 128
+
 function isASCIINumberBytes (buffer, start) {
   if (start >= buffer.length) {
     return false
@@ -16957,6 +16974,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -17005,6 +17028,13 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  lineLength = 0
+  eventSize = 0
+  eventFieldSizes = { data: 0, event: 0, id: 0, retry: 0 }
+  dataLineCount = 0
+  maxEventSize
+  maxDataLines
+  maxBufferedChunks
 
   event = {
     data: undefined,
@@ -17015,6 +17045,7 @@ class EventSourceStream extends Transform {
 
   /**
    * @param {object} options
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} options.eventSourceSettings
    * @param {Function} [options.push]
    */
@@ -17026,6 +17057,12 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
+    const parserItemLimit = this.maxEventSize > 0
+      ? Math.min(maxParserItems, Math.max(minParserItems, Math.floor(this.maxEventSize / bytesPerParserItem)))
+      : 0
+    this.maxDataLines = parserItemLimit
+    this.maxBufferedChunks = parserItemLimit
     if (options.push) {
       this.push = options.push
     }
@@ -17043,6 +17080,14 @@ class EventSourceStream extends Transform {
       return
     }
 
+    // A leading line ending can immediately release the currently buffered
+    // line, even when it uses the final allowed chunk slot.
+    if (this.maxEventSize > 0 &&
+        this.chunks.length >= this.maxBufferedChunks &&
+        chunk[0] !== LF && chunk[0] !== CR) {
+      callback(createMaxEventSizeExceededError())
+      return
+    }
     this.chunks.push(chunk)
 
     // Strip leading byte-order-mark if we opened the stream and started
@@ -17121,7 +17166,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
-        this.parseLine(this.readLine(), this.event)
+        try {
+          this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -17130,15 +17180,28 @@ class EventSourceStream extends Transform {
         continue
       }
 
+      // readLine() is only called after CR or LF. Reject an unfinished line
+      // before it can retain an unbounded number of decoded chunks. The seven
+      // extra bytes allow the longest field prefix ("event: " or "retry: ").
+      if (this.maxEventSize > 0 && ++this.lineLength > this.maxEventSize + 7) {
+        callback(createMaxEventSizeExceededError())
+        return
+      }
       this.advanceCursor()
     }
 
     callback()
   }
 
+  _destroy (error, callback) {
+    this.chunks.length = 0
+    this.clearEvent()
+    super._destroy(error, callback)
+  }
+
   /**
    * @param {Buffer} line
-   * @param {EventStreamEvent} event
+   * @param {EventSourceStreamEvent} event
    */
   parseLine (line, event) {
     // If the line is empty (a blank line)
@@ -17172,6 +17235,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      if (this.maxEventSize > 0 && this.dataLineCount >= this.maxDataLines) {
+        throw createMaxEventSizeExceededError()
+      }
+      const valueBytes = line.length - valueStart
+      const dataSize = this.eventFieldSizes.data + (event.data === undefined ? 0 : 1) + valueBytes
+      this.setEventFieldSize('data', dataSize)
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -17179,11 +17249,13 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.dataLineCount++
       return
     }
 
     if (isFieldName(line, fieldLength, RETRY)) {
       if (isASCIINumberBytes(line, valueStart)) {
+        this.setEventFieldSize('retry', line.length - valueStart)
         event.retry = line.toString('utf8', valueStart)
       }
       return
@@ -17191,20 +17263,29 @@ class EventSourceStream extends Transform {
 
     if (isFieldName(line, fieldLength, ID)) {
       if (isValidLastEventIdBytes(line, valueStart)) {
+        this.setEventFieldSize('id', line.length - valueStart)
         event.id = line.toString('utf8', valueStart)
       }
       return
     }
 
     if (isFieldName(line, fieldLength, EVENT)) {
-      const value = line.toString('utf8', valueStart)
+      if (valueStart < line.length) {
-
+        this.setEventFieldSize('event', line.length - valueStart)
-      if (value.length > 0) {
+        event.event = line.toString('utf8', valueStart)
-        event.event = value
       }
     }
   }
 
+  setEventFieldSize (field, size) {
+    const eventSize = this.eventSize - this.eventFieldSizes[field] + size
+    if (this.maxEventSize > 0 && eventSize > this.maxEventSize) {
+      throw createMaxEventSizeExceededError()
+    }
+    this.eventSize = eventSize
+    this.eventFieldSizes[field] = size
+  }
+
   /**
    * @param {EventSourceStreamEvent} event
    */
@@ -17235,6 +17316,12 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventSize = 0
+    this.dataLineCount = 0
+    this.eventFieldSizes.data = 0
+    this.eventFieldSizes.event = 0
+    this.eventFieldSizes.id = 0
+    this.eventFieldSizes.retry = 0
   }
 
   hasPendingEvent () {
@@ -17270,14 +17357,16 @@ class EventSourceStream extends Transform {
   syncLineStartToCursor () {
     this.lineChunkIndex = this.chunkIndex
     this.linePos = this.pos
+    this.lineLength = 0
     this.dropConsumedChunks()
   }
 
   dropConsumedChunks () {
-    while (this.lineChunkIndex > 0) {
+    if (this.lineChunkIndex > 0) {
-      this.chunks.shift()
+      const consumed = this.lineChunkIndex
-      this.lineChunkIndex--
+      this.chunks.splice(0, consumed)
-      this.chunkIndex--
+      this.lineChunkIndex = 0
+      this.chunkIndex -= consumed
     }
 
     if (this.chunkIndex === this.chunks.length) {
@@ -17402,6 +17491,7 @@ const { isNetworkError } = __nccwpck_require__(9051)
 const { delay } = __nccwpck_require__(4811)
 const { kEnumerableProperty } = __nccwpck_require__(3440)
 const { environmentSettingsObject } = __nccwpck_require__(3168)
+const { getGlobalDispatcher } = __nccwpck_require__(2581)
 
 let experimentalWarned = false
 
@@ -17683,6 +17773,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -17861,7 +17952,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   }
 ])
 
@@ -22957,8 +23049,10 @@ async function httpNetworkFetch (
   // 19. Run these steps in parallel:
 
   //    1. Run these steps, but abort when fetchParams is canceled:
-  fetchParams.controller.onAborted = onAborted
+  if (!fetchParams.controller.resume) {
-  fetchParams.controller.on('terminated', onAborted)
+    fetchParams.controller.on('terminated', onAborted)
+  }
+
   fetchParams.controller.resume = async () => {
     // 1. While true
     while (true) {
@@ -23127,8 +23221,6 @@ async function httpNetworkFetch (
           }
           location = headersList.get('location', true)
 
-          this.body = new Readable({ read: resume })
-
           const decoders = []
 
           const willFollow = location && request.redirect === 'follow' &&
@@ -23146,7 +23238,7 @@ async function httpNetworkFetch (
             // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
             const maxContentEncodings = 5
             if (codings.length > maxContentEncodings) {
-              reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+              this.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
               return true
             }
 
@@ -23179,6 +23271,8 @@ async function httpNetworkFetch (
             }
           }
 
+          this.body = new Readable({ read: resume })
+
           const onError = this.onError.bind(this)
 
           resolve({
@@ -23225,10 +23319,6 @@ async function httpNetworkFetch (
             fetchParams.controller.off('terminated', this.abort)
           }
 
-          if (fetchParams.controller.onAborted) {
-            fetchParams.controller.off('terminated', fetchParams.controller.onAborted)
-          }
-
           fetchParams.controller.ended = true
 
           this.body.push(null)
@@ -29703,6 +29793,20 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          const socket = this.ws[kResponse].socket
+          if (this.#loop && socket.writableNeedDrain) {
+            this.#loop = false
+            socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {
@@ -31040,6 +31144,7 @@ module.exports = {
 /* harmony export */   GL: () => (/* binding */ INPUT_CACHE_JDK),
 /* harmony export */   H5: () => (/* binding */ INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL),
 /* harmony export */   I9: () => (/* binding */ INPUT_FORCE_DOWNLOAD),
+/* harmony export */   K: () => (/* binding */ INPUT_MVN_MIRRORS),
 /* harmony export */   K$: () => (/* binding */ GPG_PASSPHRASE_PROFILE_ID),
 /* harmony export */   LS: () => (/* binding */ INPUT_ARCHITECTURE),
 /* harmony export */   MM: () => (/* binding */ INPUT_MVN_SERVER_CREDENTIALS),
@@ -31111,6 +31216,7 @@ const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
 const INPUT_MVN_SERVER_REPOSITORY_ORIGINS = 'mvn-server-repository-origins';
 const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
 const INPUT_MVN_PLUGIN_REPOSITORIES = 'mvn-plugin-repositories';
+const INPUT_MVN_MIRRORS = 'mvn-mirrors';
 const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL = 'mvn-repositories-include-central';
 const INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL = 'mvn-repositories-prioritize-central';
 const INPUT_SERVER_ID = 'server-id';
@@ -31439,6 +31545,8 @@ const CANONICAL_ARCHITECTURES = [
     'riscv64',
     's390x'
 ];
+// Used in environment-variable names and tool-cache paths.
+const ARCHITECTURE_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 const PLATFORM_ALIASES = {
     darwin: 'macos',
     linux: 'linux',
@@ -31448,10 +31556,17 @@ const PLATFORM_ALIASES = {
 function normalizeArchitecture(architecture) {
     const trimmedArchitecture = architecture.trim();
     const normalizedArchitecture = trimmedArchitecture.toLowerCase();
-    return (ARCHITECTURE_ALIASES[normalizedArchitecture] ??
+    const alias = Object.prototype.hasOwnProperty.call(ARCHITECTURE_ALIASES, normalizedArchitecture)
+        ? ARCHITECTURE_ALIASES[normalizedArchitecture]
+        : undefined;
+    const result = alias ??
         (CANONICAL_ARCHITECTURES.includes(normalizedArchitecture)
             ? normalizedArchitecture
-            : trimmedArchitecture));
+            : trimmedArchitecture);
+    if (!ARCHITECTURE_TOKEN.test(result)) {
+        throw new Error(`Unsupported architecture value: ${JSON.stringify(architecture)}`);
+    }
+    return result;
 }
 function normalizePlatform(platform) {
     return PLATFORM_ALIASES[platform];
@@ -31570,6 +31685,7 @@ function validateToolchainIds(versions, versionFile, toolchainIds) {
 /* harmony export */   ZY: () => (/* binding */ convertVersionToSemver),
 /* harmony export */   aT: () => (/* binding */ isGhes),
 /* harmony export */   ag: () => (/* binding */ getDownloadArchiveExtension),
+/* harmony export */   kI: () => (/* binding */ isExactCorrettoVersion),
 /* harmony export */   lK: () => (/* binding */ getGitHubToken),
 /* harmony export */   lN: () => (/* binding */ isJdkCacheEnabled),
 /* harmony export */   n2: () => (/* binding */ renameWinArchive),
@@ -31886,6 +32002,15 @@ function getVersionFromFileContent(content, distributionName, versionFile) {
     }
     const tentativeVersion = avoidOldNotation(capturedVersion);
     const rawVersion = tentativeVersion.split('-')[0];
+    // Preserve Corretto's full vendor release before generic coercion drops its extra numeric fields.
+    if ((extractedDistribution || distributionName) === 'corretto' &&
+        capturedVersion === tentativeVersion &&
+        isExactCorrettoVersion(tentativeVersion)) {
+        return {
+            version: tentativeVersion,
+            distribution: extractedDistribution
+        };
+    }
     let version = semver__WEBPACK_IMPORTED_MODULE_3__.validRange(rawVersion)
         ? tentativeVersion
         : semver__WEBPACK_IMPORTED_MODULE_3__.coerce(tentativeVersion);
@@ -31969,6 +32094,10 @@ function mapAsdfDistribution(asdfDist) {
 function avoidOldNotation(content) {
     return content.startsWith('1.') ? content.substring(2) : content;
 }
+function isExactCorrettoVersion(version) {
+    // Java 8 releases have a nonzero update field; later releases use five numeric fields.
+    return /^(?:8\.(?!0+(?:\.|$))\d+(?:\.\d+){2}|(?!8\.)\d+(?:\.\d+){4})$/.test(version.replace('+', '.'));
+}
 function convertVersionToSemver(version) {
     // Some distributions may use semver-like notation (12.10.2.1, 12.10.2.1.1)
     const versionArray = Array.isArray(version) ? version : version.split('.');
@@ -32253,13 +32382,6 @@ module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:https")
 
 /***/ }),
 
-/***/ 8995:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:module");
-
-/***/ }),
-
 /***/ 7030:
 /***/ ((module) => {
 
@@ -32274,13 +32396,6 @@ module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:os");
 
 /***/ }),
 
-/***/ 6760:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
-
-/***/ }),
-
 /***/ 643:
 /***/ ((module) => {
 
@@ -36575,7 +36690,7 @@ async function getJavaDistribution(distributionName, installerOptions, jdkFile)
             return new LibericaNikDistributions(normalizedInstallerOptions);
         }
         case package_types/* JavaDistribution */.zS.Microsoft: {
-            const { MicrosoftDistributions } = await Promise.all(/* import() */[__nccwpck_require__.e(242), __nccwpck_require__.e(220)]).then(__nccwpck_require__.bind(__nccwpck_require__, 3220));
+            const { MicrosoftDistributions } = await Promise.all(/* import() */[__nccwpck_require__.e(242), __nccwpck_require__.e(772)]).then(__nccwpck_require__.bind(__nccwpck_require__, 4772));
             return new MicrosoftDistributions(normalizedInstallerOptions);
         }
         case package_types/* JavaDistribution */.zS.Semeru: {
@@ -36632,7 +36747,7 @@ async function getJavaDistribution(distributionName, installerOptions, jdkFile)
 
 
 function configureProblemMatcher(matcherPath) {
-    const problemMatcherEnabled = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_PROBLEM_MATCHER */.Wt, true);
+    const problemMatcherEnabled = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_PROBLEM_MATCHER */.Wt, false);
     if (!problemMatcherEnabled) {
         setup_java_core/* debug */.Yz('Java problem matcher is disabled');
         return;
@@ -36787,7 +36902,7 @@ async function validateCacheInput(cache) {
     if (!cache) {
         return;
     }
-    const { validatePackageManager } = await Promise.all(/* import() */[__nccwpck_require__.e(824), __nccwpck_require__.e(971), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
+    const { validatePackageManager } = await Promise.all(/* import() */[__nccwpck_require__.e(824), __nccwpck_require__.e(219), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
     validatePackageManager(cache);
 }
 function settle(promise) {
@@ -36866,11 +36981,11 @@ async function configureInstalledToolchains(toolchainConfigurations) {
     }
 }
 async function startCacheRestore(cache, cacheDependencyPath, cachePath) {
-    const { isCacheFeatureAvailable } = await Promise.all(/* import() */[__nccwpck_require__.e(824), __nccwpck_require__.e(971), __nccwpck_require__.e(394)]).then(__nccwpck_require__.bind(__nccwpck_require__, 1394));
+    const { isCacheFeatureAvailable } = await Promise.all(/* import() */[__nccwpck_require__.e(824), __nccwpck_require__.e(219), __nccwpck_require__.e(394)]).then(__nccwpck_require__.bind(__nccwpck_require__, 1394));
     if (!isCacheFeatureAvailable()) {
         return;
     }
-    const { restore } = await Promise.all(/* import() */[__nccwpck_require__.e(824), __nccwpck_require__.e(971), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
+    const { restore } = await Promise.all(/* import() */[__nccwpck_require__.e(824), __nccwpck_require__.e(219), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
     await restore(cache, cacheDependencyPath, cachePath);
 }
 

docs/advanced-usage.md

@@ -28,6 +28,7 @@
 - [Testing against different platforms](#Testing-against-different-platforms)
 - [Publishing using Apache Maven](#Publishing-using-Apache-Maven)
 - [Publishing to multiple Maven servers](#publishing-to-multiple-maven-servers)
+- [Redirecting Maven repositories with mirrors](#redirecting-maven-repositories-with-mirrors)
 - [Apache Maven with a settings path](#apache-maven-with-a-settings-path)
 - [Maven transfer progress (download logs)](#Maven-transfer-progress-download-logs)
 - [Java problem matcher (compiler annotations)](#java-problem-matcher-compiler-annotations)
@@ -83,6 +84,12 @@ steps:
 
 ### Liberica
 
+Exact patch releases use SDKMAN's `X.Y.Z+P.B` notation, including in `.sdkmanrc`.
+For example, `java=17.0.20+1.1-librca` selects BellSoft's `17.0.20.1+1` release.
+Alternatively, `java-version: '17.0.20.1'` selects the newest build of patch 1,
+whereas `java-version: '17.0.20+1'` selects the exact unpatched build 1.
+Floating versions such as `17` prefer newer patches before comparing build numbers.
+
 ```yaml
 steps:
   - uses: actions/checkout@v7
@@ -151,7 +158,16 @@ steps:
 ```
 
 ### Amazon Corretto
-**NOTE:** Amazon Corretto only supports the major version specification.
+Amazon Corretto supports major versions (for example, `25`) and full release numbers
+(for example, `25.0.5.0.10`). Full release numbers select the versioned archive directly,
+including older releases no longer listed in the latest-version feed. SHA-256 checksums
+for exact releases come from Amazon's current download catalog or GitHub release notes.
+Historical releases without a published SHA-256 cannot be downloaded.
+
+Full Corretto release numbers supplied through `java-version-file` now select that exact
+release; previously they selected the latest matching major. Update MD5-only file pins
+to a release with a published SHA-256. Partial version-file values keep their existing
+major-version behavior.
 
 ```yaml
 steps:
@@ -159,7 +175,7 @@ steps:
   - uses: actions/setup-java@v6
     with:
       distribution: 'corretto'
-      java-version: '25'
+      java-version: '25.0.5.0.10'
   - run: java --version
 ```
 
@@ -330,7 +346,7 @@ The package types have these meanings:
 | `liberica-nik` | `jdk`, `jdk+fx` | `java-version` selects the embedded JDK version, not the NIK/GraalVM release number. BellSoft currently publishes matching standard and JavaFX "full" bundles for JDK 11 and later, with gaps between feature releases. Any other `java-package` value is rejected. |
 | `microsoft` | `jdk` | Stable builds only. The bundled manifest contains Java 11, 16, 17, 21, and 25 releases; platform availability varies by release. |
 | `semeru` | `jdk`, `jre` | Stable OpenJ9 builds only. IBM publishes both image types for the supported release lines (currently 8, 11, 17, 21, and 25), subject to platform availability. |
-| `corretto` | `jdk`, `jre` | Accepts major versions only. JDK availability follows Amazon's platform catalog. For the operating systems directly selected by `setup-java`, JRE downloads are limited to Java 8 on Windows; Linux and macOS use `jdk`. |
+| `corretto` | `jdk`, `jre` | Accepts major versions and full Corretto release numbers. JDK availability follows Amazon's platform catalog. For the operating systems directly selected by `setup-java`, JRE downloads are limited to Java 8 on Windows; Linux and macOS use `jdk`. |
 | `oracle` | `jdk` | Stable Oracle JDK 17 and later only. |
 | `oracle-openjdk` | `jdk` | Installs the GA or early-access JDK builds currently listed or archived on `jdk.java.net`; use a `-ea` version such as `27-ea` for early access. |
 | `redhat` | `jdk`, `jre` | Stable builds only. Version availability follows the Foojay Disco catalog for Red Hat Build of OpenJDK and can lag Red Hat's downloads page. |
@@ -643,9 +659,10 @@ runner, distribution, JDK size, network, and cache eviction pressure.
 
 The `architecture` input is normalized before setup-java checks the tool cache
 or contacts a vendor. `amd64`, `ia32`, `arm`, and `arm64` are accepted aliases
-for `x64`, `x86`, `armv7`, and `aarch64`. The table lists the combinations
+for `x64`, `x86`, `armv7`, and `aarch64`. Every value must be one token that
-setup-java validates up front; an individual Java patch release can still be
+starts with a letter or digit and contains only letters, digits, `_`, or `-`.
-absent from a vendor catalog.
+The table lists the combinations setup-java validates up front; an individual
+Java patch release can still be absent from a vendor catalog.
 
 | Distribution | Linux | macOS | Windows | Other / version restrictions |
 | --- | --- | --- | --- | --- |
@@ -1090,6 +1107,76 @@ default; `mvn-repositories-prioritize-central: false` places it after them.
 All repository generation respects `settings-path` and `overwrite-settings`;
 an existing settings file is left untouched when `overwrite-settings: false`.
 
+### Redirecting Maven repositories with mirrors
+
+Use `mvn-mirrors` to redirect matching dependency and plugin repositories,
+including Maven Central and repositories declared in project or parent POMs.
+Unlike repository profiles, mirrors replace the destination Maven contacts.
+The Central controls described above do not redirect arbitrary POM repositories.
+
+Each nonblank line has the format `mirror-id:mirror-url:mirror-of`. IDs must be
+unique within this input. `mirror-url` must be an absolute URL that includes a
+scheme, such as `https://`. URL schemes, ports, IPv6 addresses, and colons in
+`mirrorOf` selectors are preserved. An explicit `mirror-of` field is required
+after the complete URL, including any port. Percent-encode colons in the URL
+path, query, or fragment as `%3A`. Otherwise, text after the last unencoded
+colon may be read as the `mirror-of` value. For example:
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v6
+    with:
+      distribution: 'temurin'
+      java-version: '21'
+      mvn-server-credentials: |
+        private:PRIVATE_REPOSITORY_USERNAME:PRIVATE_REPOSITORY_TOKEN
+      mvn-mirrors: |
+        private:https://maven.example.com/releases:*
+  - run: mvn --batch-mode verify
+    env:
+      PRIVATE_REPOSITORY_USERNAME: ${{ secrets.PRIVATE_REPOSITORY_USERNAME }}
+      PRIVATE_REPOSITORY_TOKEN: ${{ secrets.PRIVATE_REPOSITORY_TOKEN }}
+```
+
+This adds the following directly under `<settings>`, not inside a profile:
+
+```xml
+<mirrors>
+  <mirror>
+    <id>private</id>
+    <url>https://maven.example.com/releases</url>
+    <mirrorOf>*</mirrorOf>
+  </mirror>
+</mirrors>
+```
+
+For authentication, the mirror ID must match a server ID configured through
+`mvn-server-credentials` or the single-server inputs. Public mirrors do not need
+matching credentials. Credentials remain environment-variable references in the
+generated settings; do not put credential values in `mvn-mirrors`.
+
+Mirrors can be used alone, as above, or alongside `mvn-repositories` and
+`mvn-plugin-repositories`. They do not change those inputs or the Central
+controls. Omitting `mvn-mirrors`, or supplying only blank lines, adds no
+`<mirrors>` section or repository profile.
+
+Maven interprets `mirrorOf`: `*` matches every repository, `central` matches
+only that repository ID, `external:*` matches external repositories, and
+`external:http:*` matches external HTTP repositories. Comma-separated patterns
+such as `external:*,!internal` exclude specific IDs. Selector text and mirror
+order are retained; Maven applies its own matching and precedence rules.
+For example, a public mirror needs no additional repository or credential input:
+
+```yaml
+mvn-mirrors: |
+  public:https://mirror.example.com:8443/maven:external:*,!internal
+```
+
+Mirror generation respects `settings-path` and `overwrite-settings`. An existing
+settings file is left untouched when `overwrite-settings: false`; this input
+does not merge mirrors into that file.
+
 ### GPG
 
 The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).
@@ -1223,7 +1310,7 @@ jobs:
 
 ## Java problem matcher (compiler annotations)
 
-By default, `setup-java` registers a [problem matcher](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) for Java after installing the JDK. It scans the log output of subsequent steps and turns Java diagnostics into GitHub [annotations](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-a-warning-message) that appear in the run summary and inline on the affected files. It matches three kinds of lines:
+Java [problem matcher](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) registration is disabled by default. Set `problem-matcher: true` to have `setup-java` register the matcher after installing the JDK. When enabled, it scans the log output of subsequent steps and turns Java diagnostics into GitHub [annotations](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-a-warning-message) that appear in the run summary and inline on the affected files. It matches three kinds of lines:
 
 - Compiler errors and warnings, e.g. `App.java:12: error: cannot find symbol` (owner `javac`).
 - Maven compiler errors and warnings, e.g. `[ERROR] /path/App.java:[12,5] cannot find symbol` (owner `maven-javac`).
@@ -1231,9 +1318,9 @@ By default, `setup-java` registers a [problem matcher](https://github.com/action
 
 GitHub Actions limits problem matcher annotations to 10 of each severity per step and 50 annotations per job. Additional diagnostics remain available in the build log. Log grouping does not change these limits because every matched diagnostic still counts as an annotation.
 
-### Disabling the problem matcher
+### Enabling the problem matcher
 
-Set `problem-matcher` to `false` to prevent the matcher from being registered:
+Set `problem-matcher` to `true` to enable annotations, including in workflows that previously relied on default registration:
 
 ```yaml
 jobs:
@@ -1246,13 +1333,13 @@ jobs:
         with:
           distribution: '<distribution>'
           java-version: '21'
-          problem-matcher: false
+          problem-matcher: true
 
       - name: Build with Maven
         run: mvn package --file pom.xml
 ```
 
-Disabling the matcher only stops annotations from being created. Compiler output remains in the log, and compilation errors still fail the build step.
+Omit `problem-matcher` or set it to `false` to prevent this action invocation from registering the matcher. Compiler output remains in the log, and compilation errors still fail the build step. This does not unregister matchers already registered by other steps or earlier action invocations.
 
 ## Publishing using Gradle
 ```yaml

package-lock.json

@@ -9,34 +9,34 @@
       "version": "6.0.0",
       "license": "MIT",
       "dependencies": {
-        "@actions/cache": "^6.2.0",
+        "@actions/cache": "^6.3.0",
         "@actions/core": "^3.0.1",
         "@actions/exec": "^3.0.0",
         "@actions/glob": "^0.7.0",
         "@actions/http-client": "^4.0.1",
         "@actions/io": "^3.0.2",
         "@actions/tool-cache": "^4.0.0",
-        "fast-xml-parser": "^5.11.1",
+        "fast-xml-parser": "^5.12.0",
         "semver": "^7.8.5"
       },
       "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@jest/globals": "^30.5.2",
-        "@types/node": "^26.6.2",
+        "@types/node": "^26.6.5",
         "@types/semver": "^7.8.0",
-        "@typescript-eslint/eslint-plugin": "^8.70.1",
+        "@typescript-eslint/eslint-plugin": "^8.72.0",
         "@typescript-eslint/parser": "^8.65.0",
         "@vercel/ncc": "^0.45.0",
-        "eslint": "^10.11.0",
+        "eslint": "^10.13.0",
         "eslint-config-prettier": "^10.1.8",
-        "eslint-plugin-jest": "^29.16.6",
+        "eslint-plugin-jest": "^29.17.0",
-        "eslint-plugin-n": "^18.3.0",
+        "eslint-plugin-n": "^18.5.0",
-        "globals": "^17.12.0",
+        "globals": "^17.13.0",
         "husky": "^9.1.7",
         "jest": "^30.5.2",
-        "lint-staged": "^17.5.1",
+        "lint-staged": "^17.6.0",
-        "prettier": "^3.9.9",
+        "prettier": "^3.9.10",
-        "ts-jest": "^29.4.13",
+        "ts-jest": "^29.4.15",
         "typescript": "^6.0.3"
       },
       "engines": {
@@ -44,20 +44,20 @@
       }
     },
     "node_modules/@actions/cache": {
-      "version": "6.2.0",
+      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.3.0.tgz",
-      "integrity": "sha512-Nv0xWRmbxfDbAn/70flO/F6tj2Nv4XTYMAsQHiDFSojCDfso/Zni+fRKa14ToI9hnmOW/rQcY1WYb6wsM7Pgwg==",
+      "integrity": "sha512-SJKaVMqTgetQgJF0wifi5N2+2mffCLy/D4w/3sJtRanBBGECdi1/OD0wswyLVmqEmPbYB/rVJk41Qn/xEbFjAw==",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",
         "@actions/exec": "^3.0.0",
-        "@actions/glob": "^0.6.1",
+        "@actions/glob": "^0.7.0",
         "@actions/http-client": "^4.0.1",
         "@actions/io": "^3.0.2",
-        "@azure/core-rest-pipeline": "^1.23.0",
+        "@azure/core-rest-pipeline": "~1.23.0",
-        "@azure/storage-blob": "^12.31.0",
+        "@azure/storage-blob": "~12.31.0",
         "@protobuf-ts/runtime-rpc": "^2.11.1",
-        "semver": "^7.7.4"
+        "semver": "^7.8.5"
       }
     },
     "node_modules/@actions/core": {
@@ -145,9 +145,9 @@
       }
     },
     "node_modules/@azure/core-client": {
-      "version": "1.11.0",
+      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.11.0.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.11.1.tgz",
-      "integrity": "sha512-JjQWO6akOck45PH/XBrxzsQGAiKrfFl4m5iggJ0ItMIz5omRufOXWpqCPpdjKN3vKDzlSUvFjaMb7Zwf0gvAdA==",
+      "integrity": "sha512-2QygG2F76ZpMP2eMztiJvAiFMu71M9rDeU7vO/QKg5Css7MgM4frUOslFjhVjRhbGaCNPtz/S8M6y46/fFKVuQ==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -206,9 +206,9 @@
       }
     },
     "node_modules/@azure/core-rest-pipeline": {
-      "version": "1.25.0",
+      "version": "1.23.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.23.0.tgz",
-      "integrity": "sha512-bMs8ekJLjX8wPV+9IPBges1SLPyuDtE9g5gLDWOpxzKcoOFQnpLGkbcT1tdw3FaAmDS1gnPmMmJ6y/T5B96kIA==",
+      "integrity": "sha512-Evs1INHo+jUjwHi1T6SG6Ua/LHOQBCLuKEEE6efIpt4ZOoNonaT1kP32GoOcdNDbfqsD2445CPri3MubBy5DEQ==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -220,7 +220,7 @@
         "tslib": "^2.6.2"
       },
       "engines": {
-        "node": ">=22.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@azure/core-tracing": {
@@ -276,9 +276,9 @@
       }
     },
     "node_modules/@azure/storage-blob": {
-      "version": "12.33.0",
+      "version": "12.31.0",
-      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.33.0.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.31.0.tgz",
-      "integrity": "sha512-2SX8oP8PyblUcAFZSg39c8Ls+tFjavM6sBeV+qpw33mRzRhI/5hrFJmJ/x0H9xx5l6ECPvgSP8uPxqTeVbHNIA==",
+      "integrity": "sha512-DBgNv10aCSxopt92DkTDD0o9xScXeBqPKGmR50FPZQaEcH4JLQ+GEOGEDv19V5BMkB7kxr+m4h6il/cCDPvmHg==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -292,23 +292,23 @@
         "@azure/core-util": "^1.11.0",
         "@azure/core-xml": "^1.4.5",
         "@azure/logger": "^1.1.4",
-        "@azure/storage-common": "^12.4.1",
+        "@azure/storage-common": "^12.3.0",
         "events": "^3.0.0",
         "tslib": "^2.8.1"
       },
       "engines": {
-        "node": ">=22.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@azure/storage-common": {
-      "version": "12.4.1",
+      "version": "12.5.0",
-      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.4.1.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.5.0.tgz",
-      "integrity": "sha512-t14unw/WofGDUi7TKJrsyXyPsN+NLgRm7hMaq0llxNmTIzt7f257+6LE6FKIJPh88zLj6M7LPvzve0fEYg/L3A==",
+      "integrity": "sha512-bttzuhQiCIwrkzjPDA+AtAR7dg19L/CC6ztcqJ5LfvWpXuys9mHp0UQ0udYnoUvv9SCT9KTR5kqFvFr0e6k0lQ==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
         "@azure/core-auth": "^1.9.0",
-        "@azure/core-http-compat": "^2.2.0",
+        "@azure/core-http-compat": "^2.4.0",
         "@azure/core-rest-pipeline": "^1.24.0",
         "@azure/core-tracing": "^1.2.0",
         "@azure/core-util": "^1.11.0",
@@ -317,7 +317,25 @@
         "tslib": "^2.8.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@azure/storage-common/node_modules/@azure/core-rest-pipeline": {
+      "version": "1.25.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.25.0.tgz",
+      "integrity": "sha512-bMs8ekJLjX8wPV+9IPBges1SLPyuDtE9g5gLDWOpxzKcoOFQnpLGkbcT1tdw3FaAmDS1gnPmMmJ6y/T5B96kIA==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-auth": "^1.10.0",
+        "@azure/core-tracing": "^1.3.0",
+        "@azure/core-util": "^1.13.0",
+        "@azure/logger": "^1.3.0",
+        "@typespec/ts-http-runtime": "^0.3.4",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -1623,9 +1641,9 @@
       }
     },
     "node_modules/@nodable/entities": {
-      "version": "3.0.0",
+      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-3.1.0.tgz",
-      "integrity": "sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==",
+      "integrity": "sha512-LsS/DjHr+uDM647Gru/cA8+J3a3HfhttwCKLyuoyN7yXTFCxKBtSgMQBvrW9yNPa2/zDRUNuGPaH5QUFoa4arQ==",
       "funding": [
         {
           "type": "github",
@@ -2099,9 +2117,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.6.2",
+      "version": "26.6.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.5.tgz",
-      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "integrity": "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2140,17 +2158,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.70.1",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.1.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.72.0.tgz",
-      "integrity": "sha512-nDNrUQ/4ruSNYbu749TRY7cfrzPtoLHEXSNBI8aaNY32LlZCajixqRf3FqcKC4p5Cam4VOHYx/t+i5+nKXvrqA==",
+      "integrity": "sha512-aysKgysPX9XOv/dk95UkvUDe++Q3n3dJPG9CEWT3RUccxfkPJ+Qn6nhKPDhZXU6Ofo9kgwGWwKyQCnZIXTgngg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/type-utils": "8.70.1",
+        "@typescript-eslint/type-utils": "8.72.0",
-        "@typescript-eslint/utils": "8.70.1",
+        "@typescript-eslint/utils": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.72.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -2163,205 +2181,22 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.70.1",
+        "@typescript-eslint/parser": "^8.72.0",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.70.1.tgz",
-      "integrity": "sha512-7zKTnyvaVWqzLZHPFQtX1hVHqgkMC+WebPWakNCSyrQVbIP1AM0L0TlBZtACldIRb6PptI8Odk+jyZ5kP3B1VA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/typescript-estree": "8.70.1",
-        "@typescript-eslint/utils": "8.70.1",
-        "debug": "^4.4.3",
-        "ts-api-utils": "^2.5.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
-      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/project-service": "8.70.1",
-        "@typescript-eslint/tsconfig-utils": "8.70.1",
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/visitor-keys": "8.70.1",
-        "debug": "^4.4.3",
-        "minimatch": "^10.2.2",
-        "semver": "^7.7.3",
-        "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.5.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/project-service": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
-      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.70.1",
-        "@typescript-eslint/types": "^8.70.1",
-        "debug": "^4.4.3"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
-      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.1.tgz",
-      "integrity": "sha512-Esgul8MsnKnRLdYU2Eb2cRV9bS5HJYtKj1ByJnOzzG2M58DGdSUQ1jUuILxipqcpB2h9WLrbD5GijIWUjX/Tqw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.70.1",
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/typescript-estree": "8.70.1"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
-      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/project-service": "8.70.1",
-        "@typescript-eslint/tsconfig-utils": "8.70.1",
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/visitor-keys": "8.70.1",
-        "debug": "^4.4.3",
-        "minimatch": "^10.2.2",
-        "semver": "^7.7.3",
-        "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.5.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/project-service": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
-      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.70.1",
-        "@typescript-eslint/types": "^8.70.1",
-        "debug": "^4.4.3"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
-      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.70.1",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.1.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.72.0.tgz",
-      "integrity": "sha512-nO974WLllwhSFWQXnMLj6nDGa8f0khKEz1JzpPJ1u7Vm/4X1X6ZHajpoknU4bb41vJyMB0HHVyS2GqdhWfIXZw==",
+      "integrity": "sha512-0O+x3ynciD6zuXb1CKSu165haQV6ey53DKhHHUnujP7U+XlltJG+/keT0Xhd1HXCze+IHf7Tvt39ovyepX/LNw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.72.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2376,43 +2211,15 @@
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": {
+    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.70.1",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.72.0.tgz",
-      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
+      "integrity": "sha512-bzHngBbmIgzj6TsTjVUCntGx6FFLgE7mPjpO0PzHycOaZHXqS43XnrkFIHRS16LLr/xO6FHSXG3GJFo/F4bSBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.70.1",
+        "@typescript-eslint/tsconfig-utils": "^8.72.0",
-        "@typescript-eslint/tsconfig-utils": "8.70.1",
+        "@typescript-eslint/types": "^8.72.0",
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/visitor-keys": "8.70.1",
-        "debug": "^4.4.3",
-        "minimatch": "^10.2.2",
-        "semver": "^7.7.3",
-        "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.5.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/project-service": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
-      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.70.1",
-        "@typescript-eslint/types": "^8.70.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2426,32 +2233,15 @@
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
-      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.70.1",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.1.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.72.0.tgz",
-      "integrity": "sha512-Pa0EeSeAusQc1WbjQMac+YfenewYTBu0KjgYvkUKwhXaHUKbFog23Dm/rp0DX/6tyYOQ3Xl1a+3EcFNZynGHCw==",
+      "integrity": "sha512-JewPyJOYcXBSAS7PIgufscHOwZqhTGyBRiQJhhuDln66tMchxvvt7nJ90JKKIoOelmdHA3kAQbm9cEUHc4JSEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.70.1"
+        "@typescript-eslint/visitor-keys": "8.72.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2461,10 +2251,52 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.72.0.tgz",
+      "integrity": "sha512-0vbxCf7xLVPSjcOdm6eQbgViH8EDJ8xnl1laLT9yoqSz2YmcSfSg5Vdl0JUvZf6rcuJ0ZivJIuMD4edTg8obaA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.72.0.tgz",
+      "integrity": "sha512-gEXxmmbSTSOVTC37IYYvremOM31v+UN2W772bJxmVYPhAOPSUxtacyb7wkm1EhkYKU6KzFJsdU44DCV4to0LWw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.70.1",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.1.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.72.0.tgz",
-      "integrity": "sha512-Dm1ypdhhrGCTyyehxElhgJ6kgk8MVCv5qXdoOVqPr1uqk42jX8KjrZqhROvdShczA8qrDoYiOWn1ykWlx2k81Q==",
+      "integrity": "sha512-Adfoy59kxNEjT5E5fnyrp7GpHYuWs8ONbdohu4ez6IU46qDq8LltG90tLmkucZB2uhYL8mqBjtXqGd8yhfjXqQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2475,14 +2307,66 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
-    "node_modules/@typescript-eslint/visitor-keys": {
+    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.70.1",
+      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.1.tgz",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.72.0.tgz",
-      "integrity": "sha512-Vwj9lUIW5Xq3wQ9w6gv3R86g1hMK8f2zNOdGTAgeXUMMXFK78G9ruCjjqutHMNJc0+CH7LYRnHeUB9IT8wFmcw==",
+      "integrity": "sha512-gwLfFgWcw15tN2KXDCJvxEOQjPn+P3j/n3eSqkZ5sX4VpW9Cosodr+tWwBZRvJT3TcKx6HnPRGZMCNAiP1Xhug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/project-service": "8.72.0",
+        "@typescript-eslint/tsconfig-utils": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.72.0.tgz",
+      "integrity": "sha512-0up3oArJZBYnzOaEXKo8DmI43QvMZyPoFEt9LWzRJcyl/RcJjfKKPebknN1VbTgXBf3M/KggUh5uUMdURLnseg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.72.0.tgz",
+      "integrity": "sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.72.0",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -2507,9 +2391,9 @@
       }
     },
     "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.7",
+      "version": "0.3.9",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.7.tgz",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.9.tgz",
-      "integrity": "sha512-JVUD8X2tfDMWjcjLs4yVxxVrS8yR5vnh386GAXT9Qj79nBxxXSaHFQZg5FweLmT8HlPQ3kii6noUB+Z9RN7DvQ==",
+      "integrity": "sha512-edSdeAqkdxBVzA1yL1LrLCml1YjyCVvPMtMqJpbF+6K609tHe8V6sQUzFQSGcYNhcuhOceZtjvN32+mpIth30A==",
       "license": "MIT",
       "dependencies": {
         "http-proxy-agent": "^7.0.0",
@@ -3541,9 +3425,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.11.0",
+      "version": "10.13.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.11.0.tgz",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.13.0.tgz",
-      "integrity": "sha512-P7a6UEEqb9G95MYAtqkmsTbVXIYyzIfl6NGOIJk162PaahFxFyeGcrlXYFSiagECg4sEm8IseJdZBKR3rx6MsQ==",
+      "integrity": "sha512-UohDjD4zSzEwhf58M3O7vc/ycc8O1I7dNlhtD0WxE8Px8EHNJKtUwzBqrzeGhisRuv2ag4sAYswszCJRgKXYUg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -3654,9 +3538,9 @@
       }
     },
     "node_modules/eslint-plugin-jest": {
-      "version": "29.16.6",
+      "version": "29.17.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-29.16.6.tgz",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-29.17.0.tgz",
-      "integrity": "sha512-q8TVr0rlNvUD0XnafGWkwtPeX+tTl2llP86EDl3sJtwWrQA/JT9SIu2hLLZbhhX6fT5SDE4O0gIKyZUujKnkYA==",
+      "integrity": "sha512-6jtpU6MhYKbagkES02TupWAUUooJpZtKg94Ax0b8HhUorv3InSTBU8RRtlSBe0LocOcShXOpyec3PHzPDkJCSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3683,101 +3567,10 @@
         }
       }
     },
-    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.1.tgz",
-      "integrity": "sha512-Esgul8MsnKnRLdYU2Eb2cRV9bS5HJYtKj1ByJnOzzG2M58DGdSUQ1jUuILxipqcpB2h9WLrbD5GijIWUjX/Tqw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.70.1",
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/typescript-estree": "8.70.1"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
-      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/project-service": "8.70.1",
-        "@typescript-eslint/tsconfig-utils": "8.70.1",
-        "@typescript-eslint/types": "8.70.1",
-        "@typescript-eslint/visitor-keys": "8.70.1",
-        "debug": "^4.4.3",
-        "minimatch": "^10.2.2",
-        "semver": "^7.7.3",
-        "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.5.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/project-service": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
-      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.70.1",
-        "@typescript-eslint/types": "^8.70.1",
-        "debug": "^4.4.3"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
-    "node_modules/eslint-plugin-jest/node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree/node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.70.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
-      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
-      }
-    },
     "node_modules/eslint-plugin-n": {
-      "version": "18.3.0",
+      "version": "18.5.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.5.0.tgz",
-      "integrity": "sha512-cPVguuDe6DrIPb/qUXHf8P89MaVTUmiYWwpt5gX5AILsvRIiZAxMFXcFR6QHYBksqKJpjfUBlL/RleCJUWcD7w==",
+      "integrity": "sha512-M7uF6MTN/An+AXqvyIbXq7npJIZOkd5eKo8iMMvWrcDVNyZVdA6TF2lw01aKQfCEidRfpnR78GhAjZorlXNHiw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3788,6 +3581,7 @@
         "globals": "^15.11.0",
         "globrex": "^0.1.2",
         "ignore": "^5.3.2",
+        "js-yaml": "^5.4.1",
         "semver": "^7.6.3"
       },
       "engines": {
@@ -3810,6 +3604,23 @@
         }
       }
     },
+    "node_modules/eslint-plugin-n/node_modules/argparse": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.4.tgz",
+      "integrity": "sha512-fwWK3Zq22l4XJJjx5mcBHGikIk+hJqO+32dPm0Jur7+rtG5x1scOjSfdT9ZKeWHPpsya/l0HHK4tDImBkTrtvA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "PSF-2.0"
+    },
     "node_modules/eslint-plugin-n/node_modules/globals": {
       "version": "15.15.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-15.15.0.tgz",
@@ -3833,6 +3644,29 @@
         "node": ">= 4"
       }
     },
+    "node_modules/eslint-plugin-n/node_modules/js-yaml": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz",
+      "integrity": "sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^3.0.3"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.mjs"
+      }
+    },
     "node_modules/eslint-scope": {
       "version": "9.1.2",
       "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-9.1.2.tgz",
@@ -4069,9 +3903,9 @@
       "license": "MIT"
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.3.0",
+      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.1.tgz",
-      "integrity": "sha512-F74cZEdCvuw9P41GAC3rod4X04jjWGM1JPEv/GWSqFTWLsdyMSBMBMlm9Hk3GLBgLBbdBNY8yee0pQh2RBVESQ==",
+      "integrity": "sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==",
       "funding": [
         {
           "type": "github",
@@ -4085,9 +3919,9 @@
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.11.1",
+      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.11.1.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.12.0.tgz",
-      "integrity": "sha512-TBw6K/fxoQGGjCmZDw9w/ZwP3uDcnTM4YH/g+PFRWr8sbe5idXtxNN6vITh4+1ruCZaho6uBFurElsA7F0zzgw==",
+      "integrity": "sha512-/pXxRBtwxY9w8z7YbgsvIPPcPvFDsTbIkWwTQJhzNJPokj+TbN6ftmcv4j/pEQDvOCNnKGDzuk5Bo2oogIOiFg==",
       "funding": [
         {
           "type": "github",
@@ -4096,11 +3930,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@nodable/entities": "^3.0.0",
+        "@nodable/entities": "^3.1.0",
-        "fast-xml-builder": "^1.2.0",
+        "fast-xml-builder": "^1.3.1",
-        "is-unsafe": "^2.0.0",
+        "is-unsafe": "^2.0.3",
         "path-expression-matcher": "^1.6.2",
-        "strnum": "^2.4.2",
+        "strnum": "^2.5.1",
         "xml-naming": "^0.3.0"
       },
       "bin": {
@@ -4293,9 +4127,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.12.0",
+      "version": "17.13.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.12.0.tgz",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
-      "integrity": "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA==",
+      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4534,9 +4368,9 @@
       }
     },
     "node_modules/is-unsafe": {
-      "version": "2.0.0",
+      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.3.tgz",
-      "integrity": "sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA==",
+      "integrity": "sha512-ZBllczCCO267vgdFb6Tq3pv+LhHaCiGMdr+ZsuL+OopruAg7S+3ZDs1vD0RPC0uSrkjzbraxaGjtX1YBxjPeFQ==",
       "funding": [
         {
           "type": "github",
@@ -5311,9 +5145,9 @@
       "license": "MIT"
     },
     "node_modules/lint-staged": {
-      "version": "17.5.1",
+      "version": "17.6.0",
-      "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-17.5.1.tgz",
+      "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-17.6.0.tgz",
-      "integrity": "sha512-7EDuco1xnBMeVpvAbeMq1U5KXwJGLmY8q6l+Ye78r36C4mPc+Vg1Z2SK8gHyRTyvPro90A0q5/FAZ+Au23d6QQ==",
+      "integrity": "sha512-nOhBfYkZEwkFtNzD5pK9s9LkcWoxJ+whLzEnhqi9nl7zTB5n7tg8+9iYgMGx2Wm3VlLu8cbNj0RACzY+nWi5iQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5331,7 +5165,7 @@
         "url": "https://opencollective.com/lint-staged"
       },
       "optionalDependencies": {
-        "yaml": "^2.9.0"
+        "yaml": "^2.9.1"
       }
     },
     "node_modules/locate-path": {
@@ -5799,9 +5633,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.9.9",
+      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.9.tgz",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.10.tgz",
-      "integrity": "sha512-Z/CJHIkdujO/OtN7nXUii0Rf3VT5SRuhjBA82Xvu2XhBUgX3nhP67T0LHceBdQLex7OOFGTox+Q5Yg8Jk2Qivg==",
+      "integrity": "sha512-skGHTH1Yb9QvaTC4hWnRTzEYtCpApF0UMBPz+t/0ZPzP8ihefo/btKd+QA7pUE0fEwA1SbS/NmhyEcstdXOIdA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -6117,9 +5951,9 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.4.2",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.2.tgz",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.5.1.tgz",
-      "integrity": "sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==",
+      "integrity": "sha512-UM4nTLWzQiDBseVxUGxN0wJzIk0UU89Qi7pKXz9qISo+lhviJikTuikBsK/oFRlpvYHvSdz0TVoLyQ+sEpYwxA==",
       "funding": [
         {
           "type": "github",
@@ -6230,15 +6064,15 @@
       }
     },
     "node_modules/ts-jest": {
-      "version": "29.4.13",
+      "version": "29.4.15",
-      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.4.13.tgz",
+      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.4.15.tgz",
-      "integrity": "sha512-rUQG+Ar95cNQf//KvsSjvabLpCTbwk+vKGWkAgiKFugqVwmOpGR7n7xa3S68/AB21Wn0KNhIAVxmxrUsz0L1AQ==",
+      "integrity": "sha512-s2qmEUYFRqbjz1wv0EmccNPVOb45HOFpFuhzQJLKShYVisuTbCFPIIAIV2EuK5rIxb4BejLDbH7dnBZfYjybUQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "bs-logger": "^0.2.6",
         "fast-json-stable-stringify": "^2.1.0",
-        "handlebars": "^4.7.9",
+        "handlebars": "^4.7.10",
         "json5": "^2.2.3",
         "lodash.memoize": "^4.1.2",
         "make-error": "^1.3.6",
@@ -6375,9 +6209,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.29.0",
+      "version": "6.29.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",
-      "integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
+      "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
@@ -6582,9 +6416,9 @@
       "license": "ISC"
     },
     "node_modules/yaml": {
-      "version": "2.9.0",
+      "version": "2.9.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "dev": true,
       "license": "ISC",
       "optional": true,

package.json

@@ -42,34 +42,34 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^6.2.0",
+    "@actions/cache": "^6.3.0",
     "@actions/core": "^3.0.1",
     "@actions/exec": "^3.0.0",
     "@actions/glob": "^0.7.0",
     "@actions/http-client": "^4.0.1",
     "@actions/io": "^3.0.2",
     "@actions/tool-cache": "^4.0.0",
-    "fast-xml-parser": "^5.11.1",
+    "fast-xml-parser": "^5.12.0",
     "semver": "^7.8.5"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@jest/globals": "^30.5.2",
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.5",
     "@types/semver": "^7.8.0",
-    "@typescript-eslint/eslint-plugin": "^8.70.1",
+    "@typescript-eslint/eslint-plugin": "^8.72.0",
     "@typescript-eslint/parser": "^8.65.0",
     "@vercel/ncc": "^0.45.0",
-    "eslint": "^10.11.0",
+    "eslint": "^10.13.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jest": "^29.16.6",
+    "eslint-plugin-jest": "^29.17.0",
-    "eslint-plugin-n": "^18.3.0",
+    "eslint-plugin-n": "^18.5.0",
-    "globals": "^17.12.0",
+    "globals": "^17.13.0",
     "husky": "^9.1.7",
     "jest": "^30.5.2",
-    "lint-staged": "^17.5.1",
+    "lint-staged": "^17.6.0",
-    "prettier": "^3.9.9",
+    "prettier": "^3.9.10",
-    "ts-jest": "^29.4.13",
+    "ts-jest": "^29.4.15",
     "typescript": "^6.0.3"
   },
   "bugs": {

src/auth.ts

@@ -30,11 +30,20 @@ export interface MavenRepositorySettings {
   prioritizeCentral: boolean;
 }
 
+export interface MavenMirror {
+  id: string;
+  url: string;
+  mirrorOf: string;
+}
+
 const MAVEN_REPOSITORY_ORIGIN = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]+\/?$/;
 
 export async function configureAuthentication() {
   const servers = getMavenServerSettings();
   const repositorySettings = getMavenRepositorySettings();
+  const mirrors = parseMavenMirrors(
+    core.getMultilineInput(constants.INPUT_MVN_MIRRORS)
+  );
   const settingsDirectory =
     core.getInput(constants.INPUT_SETTINGS_PATH) ||
     path.join(os.homedir(), constants.M2_DIR);
@@ -60,7 +69,8 @@ export async function configureAuthentication() {
     settingsDirectory,
     overwriteSettings,
     gpgPassphraseEnvVar,
-    repositorySettings
+    repositorySettings,
+    mirrors
   );
 
   if (gpgPrivateKey) {
@@ -333,6 +343,55 @@ export function parseMavenRepositories(
   return repositories;
 }
 
+// only exported for testing purposes
+export function parseMavenMirrors(entries: string[]): MavenMirror[] {
+  const mirrors: MavenMirror[] = [];
+  const mirrorIds = new Set<string>();
+
+  entries.forEach((entry, index) => {
+    if (!entry.trim()) {
+      return;
+    }
+
+    const separator = entry.indexOf(':');
+    const remainder = entry.slice(separator + 1).trim();
+    // Protect scheme/authority colons (including IPv6 and ports) before
+    // finding the selector, which may itself contain external:http:*.
+    const urlPrefix =
+      /^[A-Za-z][A-Za-z0-9+.-]*:(?:\/\/(?:[^/?#@\s]*@)?(?:\[[^\]]+\]|[^:/?#\s]+)(?::\d+(?=[/?#:\s]|$))?)?/.exec(
+        remainder
+      )?.[0] ?? '';
+    const fields =
+      /^(.*?):((?:\s*!?external:(?:http:)?\*\s*|[^:,]*)(?:,(?:\s*!?external:(?:http:)?\*\s*|[^:,]*))*)$/.exec(
+        remainder.slice(urlPrefix.length)
+      );
+    if (separator < 0 || !fields) {
+      throw new Error(
+        `Invalid mvn-mirrors entry at line ${index + 1}. Expected format: mirror-id:mirror-url:mirror-of`
+      );
+    }
+
+    const id = entry.slice(0, separator).trim();
+    const url = `${urlPrefix}${fields[1]}`.trim();
+    const mirrorOf = fields[2].trim();
+    if (!id || !url || !mirrorOf) {
+      throw new Error(
+        `Invalid mvn-mirrors entry at line ${index + 1}. mirror-id, mirror URL, and mirror-of are required`
+      );
+    }
+    if (mirrorIds.has(id)) {
+      throw new Error(
+        `Duplicate mirror-id '${id}' in mvn-mirrors input at line ${index + 1}`
+      );
+    }
+
+    mirrorIds.add(id);
+    mirrors.push({id, url, mirrorOf});
+  });
+
+  return mirrors;
+}
+
 function generateRepositorySection(
   customRepositories: MavenRepository[],
   settings: MavenRepositorySettings,
@@ -388,7 +447,8 @@ export async function createAuthenticationSettings(
   settingsDirectory: string,
   overwriteSettings: boolean,
   gpgPassphraseEnvVar: string | undefined = undefined,
-  repositorySettings: MavenRepositorySettings | undefined = undefined
+  repositorySettings: MavenRepositorySettings | undefined = undefined,
+  mirrors: MavenMirror[] = []
 ) {
   core.info(
     `Creating ${constants.MVN_SETTINGS_FILE} with server-id: ${servers.map(server => server.id).join(', ')}`
@@ -398,7 +458,7 @@ export async function createAuthenticationSettings(
   await io.mkdirP(settingsDirectory);
   await write(
     settingsDirectory,
-    generate(servers, gpgPassphraseEnvVar, repositorySettings),
+    generate(servers, gpgPassphraseEnvVar, repositorySettings, mirrors),
     overwriteSettings
   );
 }
@@ -407,7 +467,8 @@ export async function createAuthenticationSettings(
 export function generate(
   servers: MavenServerCredentials[],
   gpgPassphraseEnvVar?: string | undefined,
-  repositorySettings?: MavenRepositorySettings | undefined
+  repositorySettings?: MavenRepositorySettings | undefined,
+  mirrors: MavenMirror[] = []
 ) {
   // The maven-gpg-plugin reads the passphrase from the environment variable
   // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE).
@@ -447,6 +508,20 @@ export function generate(
   }
   lines.push('  </servers>');
 
+  if (mirrors.length) {
+    lines.push('  <mirrors>');
+    for (const mirror of mirrors) {
+      lines.push(
+        '    <mirror>',
+        `      <id>${escapeXmlText(mirror.id)}</id>`,
+        `      <url>${escapeXmlText(mirror.url)}</url>`,
+        `      <mirrorOf>${escapeXmlText(mirror.mirrorOf)}</mirrorOf>`,
+        '    </mirror>'
+      );
+    }
+    lines.push('  </mirrors>');
+  }
+
   if (repositorySettings || includeGpgPassphraseProfile) {
     lines.push('  <profiles>');
     if (repositorySettings) {

src/constants.ts

@@ -20,6 +20,7 @@ export const INPUT_MVN_SERVER_REPOSITORY_ORIGINS =
   'mvn-server-repository-origins';
 export const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
 export const INPUT_MVN_PLUGIN_REPOSITORIES = 'mvn-plugin-repositories';
+export const INPUT_MVN_MIRRORS = 'mvn-mirrors';
 export const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL =
   'mvn-repositories-include-central';
 export const INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL =

src/distributions/base-installer.ts

@@ -241,7 +241,7 @@ export abstract class JavaBase {
             if (javaRelease.floating) {
               if (
                 !semver.valid(foundJava.version) ||
-                !isVersionSatisfies(this.version, foundJava.version)
+                !this.isVersionSatisfied(this.version, foundJava.version)
               ) {
                 throw new Error(
                   `The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`
@@ -401,7 +401,7 @@ export abstract class JavaBase {
     }
     if (
       !semver.valid(restored.release.version) ||
-      !isVersionSatisfies(this.version, restored.release.version)
+      !this.isVersionSatisfied(this.version, restored.release.version)
     ) {
       core.debug(
         `Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`
@@ -622,10 +622,10 @@ export abstract class JavaBase {
       .filter(item => item.stable === this.stable);
 
     const satisfiedVersions = availableVersions
-      .filter(item => isVersionSatisfies(this.version, item.version))
+      .filter(item => this.isVersionSatisfied(this.version, item.version))
       .filter(item => item.path)
       .sort((a, b) => {
-        return -semver.compareBuild(a.version, b.version);
+        return -this.compareVersions(a.version, b.version);
       });
     if (!satisfiedVersions || satisfiedVersions.length === 0) {
       return null;
@@ -637,6 +637,14 @@ export abstract class JavaBase {
     };
   }
 
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    return isVersionSatisfies(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    return semver.compareBuild(a, b);
+  }
+
   protected normalizeVersion(version: string) {
     let stable = true;
     const latest = false;

src/distributions/corretto/installer.ts

@@ -1,10 +1,13 @@
 import * as core from '@actions/core';
 import fs from 'fs';
 import path from 'path';
+import {HttpCodes} from '@actions/http-client';
 import {
   cacheJdkDir,
   extractJdkFile,
   getDownloadArchiveExtension,
+  getGitHubHttpHeaders,
+  isExactCorrettoVersion,
   convertVersionToSemver,
   renameWinArchive
 } from '../../util.js';
@@ -24,8 +27,19 @@ const CORRETTO_VERSIONS_URL =
   'https://corretto.github.io/corretto-downloads/latest_links/indexmap_with_checksum.json';
 
 export class CorrettoDistribution extends JavaBase {
+  private readonly requestedVersion: string;
+
   constructor(installerOptions: JavaInstallerOptions) {
-    super('Corretto', installerOptions);
+    super('Corretto', {
+      ...installerOptions,
+      // Java 8 releases use zero-padded fields, e.g. 8.472.08.1.
+      version: isExactCorrettoVersion(installerOptions.version)
+        ? installerOptions.version.replace(/(^|\.)0+(?=\d)/g, '$1')
+        : installerOptions.version
+    });
+    this.requestedVersion = installerOptions.version
+      .replace('+', '.')
+      .replace(/^8\.(\d+)\.(\d)\./, '8.$1.0$2.');
   }
 
   protected async downloadTool(
@@ -63,6 +77,9 @@ export class CorrettoDistribution extends JavaBase {
     if (!this.stable) {
       throw new Error('Early access versions are not supported');
     }
+    if (isExactCorrettoVersion(this.requestedVersion)) {
+      return this.findExactRelease();
+    }
     const availableVersions = await this.getAvailableVersions();
 
     // The `latest` alias is normalized to the SemVer wildcard, but Corretto
@@ -83,7 +100,9 @@ export class CorrettoDistribution extends JavaBase {
     }
 
     if (version.includes('.')) {
-      throw new Error('Only major versions are supported');
+      throw new Error(
+        'Specify a major version or a full Corretto release, such as 25.0.5.0.10'
+      );
     }
     const matchingVersions = availableVersions
       .filter(item => item.version == version)
@@ -110,6 +129,91 @@ export class CorrettoDistribution extends JavaBase {
     return resolvedVersion;
   }
 
+  private async findExactRelease(): Promise<JavaDownloadRelease> {
+    const version = this.requestedVersion;
+    const major = version.split('.')[0];
+    const platform = this.getPlatformOption();
+    const arch = this.architecture;
+    if (platform !== 'windows' && this.packageType !== 'jdk') {
+      throw new Error('Corretto JRE archives are only available for Windows');
+    }
+    const os =
+      platform === 'macos'
+        ? 'macosx'
+        : platform === 'alpine'
+          ? 'alpine-linux'
+          : platform;
+    const suffix =
+      platform === 'windows' ? `-${this.packageType}.zip` : '.tar.gz';
+    const url = `https://corretto.aws/downloads/resources/${version}/amazon-corretto-${version}-${os}-${arch}${suffix}`;
+
+    // Versioned archives have no checksum sidecar; Amazon publishes their SHA-256s in the release notes.
+    const source = `https://api.github.com/repos/corretto/corretto-${major}/releases/tags/${version}`;
+    const findCatalogRelease = async (): Promise<
+      JavaDownloadRelease | undefined
+    > => {
+      const archive = (await this.getAvailableVersions()).find(
+        item => item.downloadLink === url
+      );
+      if (!archive) {
+        return undefined;
+      }
+      return {
+        version: this.version,
+        url,
+        checksum: {
+          algorithm: 'sha256',
+          value: archive.checksum_sha256,
+          source: CORRETTO_VERSIONS_URL
+        }
+      };
+    };
+
+    let response;
+    try {
+      response = await this.http.getJson<{body: string | null}>(source, {
+        ...getGitHubHttpHeaders(),
+        accept: 'application/vnd.github+json'
+      });
+    } catch (error) {
+      const catalogRelease = await findCatalogRelease();
+      if (catalogRelease) {
+        return catalogRelease;
+      }
+      throw error;
+    }
+    const row = response.result?.body
+      ?.split(/\r?\n/)
+      .find(line => line.includes(`](${url})`));
+    const checksum = row?.match(/`([a-fA-F0-9]{64})`/)?.[1];
+    if (checksum) {
+      return {
+        version: this.version,
+        url,
+        checksum: {algorithm: 'sha256', value: checksum, source}
+      };
+    }
+
+    // The current catalog also covers releases missing from GitHub, such as Corretto 15 and 16.
+    const catalogRelease = await findCatalogRelease();
+    if (catalogRelease) {
+      return catalogRelease;
+    }
+    if (response.statusCode === HttpCodes.NotFound) {
+      throw new Error(
+        `Corretto release ${version} was not found in Amazon's GitHub releases or current download catalog`
+      );
+    }
+    if (!row) {
+      throw new Error(
+        `No ${platform}/${arch} ${this.packageType} archive is listed for Corretto ${version}`
+      );
+    }
+    throw new Error(
+      `No SHA-256 checksum is published for Corretto ${version} (${platform}, ${arch}, ${this.packageType})`
+    );
+  }
+
   private async getAvailableVersions(): Promise<ICorrettoAvailableVersions[]> {
     const platform = this.getPlatformOption();
     const arch = this.distributionArchitecture();

src/distributions/jetbrains/installer.ts

@@ -16,8 +16,8 @@ import {
   extractJdkFile,
   getGitHubToken,
   getNextPageUrlFromLinkHeader,
-  isVersionSatisfies,
   MAX_PAGINATION_PAGES,
+  normalizeJavaVersionToSemver,
   validatePaginationUrl
 } from '../../util.js';
 import {OutgoingHttpHeaders} from 'http';
@@ -38,7 +38,9 @@ export class JetBrainsDistribution extends JavaBase {
     const versionsRaw = await this.getAvailableVersions();
 
     const versions = versionsRaw.map(v => {
-      const formattedVersion = `${v.semver}+${v.build}`;
+      const formattedVersion = normalizeJavaVersionToSemver(
+        `${v.semver}+${v.build}`
+      );
 
       return {
         version: formattedVersion,
@@ -47,9 +49,9 @@ export class JetBrainsDistribution extends JavaBase {
     });
 
     const satisfiedVersions = versions
-      .filter(item => isVersionSatisfies(range, item.version))
+      .filter(item => this.isVersionSatisfied(range, item.version))
       .sort((a, b) => {
-        return -semver.compareBuild(a.version, b.version);
+        return -this.compareVersions(a.version, b.version);
       });
 
     const resolvedFullVersion =
@@ -74,6 +76,61 @@ export class JetBrainsDistribution extends JavaBase {
     };
   }
 
+  protected normalizeVersion(version: string) {
+    const normalized = super.normalizeVersion(version);
+    if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+      // A patch-only request must match any JBR build of that patch.
+      normalized.version = version.replace(/-ea$/, '');
+    }
+    return normalized;
+  }
+
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+    if (patchRequest) {
+      const candidate = semver.parse(version);
+      return (
+        candidate !== null &&
+        semver.eq(patchRequest[1], candidate) &&
+        (candidate.build.slice(0, -2).join('.') || '0') ===
+          patchRequest[2].slice(1)
+      );
+    }
+    return super.isVersionSatisfied(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    const mainComparison = semver.compare(a, b);
+    if (mainComparison !== 0) {
+      return mainComparison;
+    }
+
+    // JBR builds have two components (one in older releases). Any preceding
+    // metadata components are Java patch fields and take priority over builds.
+    const first = new semver.SemVer(a).build;
+    const second = new semver.SemVer(b).build;
+    const firstPatch = first.slice(0, -2);
+    const secondPatch = second.slice(0, -2);
+    for (
+      let index = 0;
+      index < Math.max(firstPatch.length, secondPatch.length);
+      index++
+    ) {
+      const patchComparison = semver.compareIdentifiers(
+        firstPatch[index] ?? '0',
+        secondPatch[index] ?? '0'
+      );
+      if (patchComparison !== 0) {
+        return patchComparison;
+      }
+    }
+
+    return semver.compareBuild(
+      first.length ? `0.0.0+${first.slice(-2).join('.')}` : '0.0.0',
+      second.length ? `0.0.0+${second.slice(-2).join('.')}` : '0.0.0'
+    );
+  }
+
   protected async downloadTool(
     javaRelease: JavaDownloadRelease
   ): Promise<JavaInstallerResults> {

src/distributions/liberica/installer.ts

@@ -9,7 +9,6 @@ import {
   cacheJdkDir,
   extractJdkFile,
   getDownloadArchiveExtension,
-  isVersionSatisfies,
   renameWinArchive
 } from '../../util.js';
 import * as core from '@actions/core';
@@ -66,8 +65,8 @@ export class LibericaDistributions extends JavaBase {
     }));
 
     const satisfiedVersion = availableVersions
-      .filter(item => isVersionSatisfies(range, item.version))
+      .filter(item => this.isVersionSatisfied(range, item.version))
-      .sort((a, b) => -semver.compareBuild(a.version, b.version))[0];
+      .sort((a, b) => -this.compareVersions(a.version, b.version))[0];
 
     if (!satisfiedVersion) {
       const availableVersionStrings = availableVersions.map(
@@ -79,6 +78,65 @@ export class LibericaDistributions extends JavaBase {
     return satisfiedVersion;
   }
 
+  protected normalizeVersion(version: string) {
+    const normalized = super.normalizeVersion(version);
+    if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+      // Keep patch-only requests distinct from exact SDKMAN build requests.
+      normalized.version = version.replace(/-ea$/, '');
+    }
+    return normalized;
+  }
+
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+    if (patchRequest) {
+      const candidate = semver.parse(version);
+      if (!candidate || !semver.eq(patchRequest[1], candidate)) {
+        return false;
+      }
+      const patch =
+        candidate.build.length > 1
+          ? candidate.build.slice(0, -1).join('.')
+          : '0';
+      return patch === patchRequest[2].slice(1);
+    }
+    return super.isVersionSatisfied(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    const mainComparison = semver.compare(a, b);
+    if (mainComparison !== 0) {
+      return mainComparison;
+    }
+
+    const getPatchAndBuild = (version: string) => {
+      const build = new semver.SemVer(version).build;
+      return build.length > 1
+        ? {patch: build.slice(0, -1), build: build[build.length - 1]}
+        : {patch: [], build: build[0] ?? '0'};
+    };
+    const first = getPatchAndBuild(a);
+    const second = getPatchAndBuild(b);
+    const compareNumericIdentifiers = (left: string, right: string) =>
+      semver.compareBuild(`0.0.0+${left}`, `0.0.0+${right}`);
+
+    for (
+      let index = 0;
+      index < Math.max(first.patch.length, second.patch.length);
+      index++
+    ) {
+      const patchComparison = compareNumericIdentifiers(
+        first.patch[index] ?? '0',
+        second.patch[index] ?? '0'
+      );
+      if (patchComparison !== 0) {
+        return patchComparison;
+      }
+    }
+
+    return compareNumericIdentifiers(first.build, second.build);
+  }
+
   private async getAvailableVersions(): Promise<LibericaVersion[]> {
     if (core.isDebug()) {
       console.time('Retrieving available versions for Liberica took'); // eslint-disable-line no-console
@@ -171,6 +229,14 @@ export class LibericaDistributions extends JavaBase {
     const mainVersion = [featureVersion, interimVersion, updateVersion].join(
       '.'
     );
+    const patchVersion = version.version
+      .split('+')[0]
+      .split('.')
+      .slice(3)
+      .join('.');
+    if (patchVersion) {
+      return `${mainVersion}+${patchVersion}.${buildVersion}`;
+    }
     if (buildVersion != 0) {
       return `${mainVersion}+${buildVersion}`;
     }

src/distributions/microsoft/installer.ts

@@ -8,10 +8,12 @@ import {
   cacheJdkDir,
   extractJdkFile,
   getDownloadArchiveExtension,
+  normalizeJavaVersionToSemver,
   renameWinArchive
 } from '../../util.js';
 import * as gpg from '../../gpg.js';
 import {MICROSOFT_PUBLIC_KEY} from './microsoft-key.js';
+import bundledVersions from './microsoft-openjdk-versions.json' with {type: 'json'};
 import {SIGNATURE_VERIFICATION_FAILURE_HELP} from '../../constants.js';
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
@@ -108,7 +110,20 @@ export class MicrosoftDistributions extends JavaBase {
       throw new Error('Could not load manifest for Microsoft Build of OpenJDK');
     }
 
-    const foundRelease = await tc.findFromManifest(range, true, manifest, arch);
+    const findMatchingRelease = async (releases: tc.IToolRelease[]) => {
+      const matchingReleases = releases
+        .map(release => ({
+          ...release,
+          version: normalizeJavaVersionToSemver(release.version)
+        }))
+        .filter(release => this.isVersionSatisfied(range, release.version));
+
+      return tc.findFromManifest(range, true, matchingReleases, arch);
+    };
+
+    const foundRelease =
+      (await findMatchingRelease(manifest)) ??
+      (await findMatchingRelease(bundledVersions));
 
     if (!foundRelease) {
       const availableVersionStrings = manifest.map(item => item.version);

src/distributions/microsoft/microsoft-openjdk-versions.json

@@ -1,4 +1,47 @@
 [
+  {
+    "version": "25.0.5+0.2",
+    "stable": true,
+    "release_url": "https://aka.ms/download-jdk",
+    "files": [
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-macos-x64.tar.gz",
+        "arch": "x64",
+        "platform": "darwin",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-macos-x64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz",
+        "arch": "x64",
+        "platform": "linux",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-windows-x64.zip",
+        "arch": "x64",
+        "platform": "win32",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-windows-x64.zip"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-macos-aarch64.tar.gz",
+        "arch": "aarch64",
+        "platform": "darwin",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-macos-aarch64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-linux-aarch64.tar.gz",
+        "arch": "aarch64",
+        "platform": "linux",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-aarch64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-windows-aarch64.zip",
+        "arch": "aarch64",
+        "platform": "win32",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-windows-aarch64.zip"
+      }
+    ]
+  },
   {
     "version": "25.0.3",
     "stable": true,

src/distributions/platform-types.ts

@@ -192,6 +192,9 @@ const CANONICAL_ARCHITECTURES: readonly JavaArchitecture[] = [
   's390x'
 ];
 
+// Used in environment-variable names and tool-cache paths.
+const ARCHITECTURE_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+
 const PLATFORM_ALIASES: Readonly<
   Partial<Record<NodeJS.Platform, JavaPlatform>>
 > = {
@@ -204,14 +207,27 @@ const PLATFORM_ALIASES: Readonly<
 export function normalizeArchitecture(architecture: string): string {
   const trimmedArchitecture = architecture.trim();
   const normalizedArchitecture = trimmedArchitecture.toLowerCase();
-  return (
+  const alias = Object.prototype.hasOwnProperty.call(
-    ARCHITECTURE_ALIASES[normalizedArchitecture] ??
+    ARCHITECTURE_ALIASES,
+    normalizedArchitecture
+  )
+    ? ARCHITECTURE_ALIASES[normalizedArchitecture]
+    : undefined;
+  const result =
+    alias ??
     (CANONICAL_ARCHITECTURES.includes(
       normalizedArchitecture as JavaArchitecture
     )
       ? normalizedArchitecture
-      : trimmedArchitecture)
+      : trimmedArchitecture);
-  );
+
+  if (!ARCHITECTURE_TOKEN.test(result)) {
+    throw new Error(
+      `Unsupported architecture value: ${JSON.stringify(architecture)}`
+    );
+  }
+
+  return result;
 }
 
 export function normalizePlatform(

src/problem-matcher.ts

@@ -3,7 +3,7 @@ import {INPUT_PROBLEM_MATCHER} from './constants.js';
 import {getBooleanInput} from './util.js';
 
 export function configureProblemMatcher(matcherPath: string): void {
-  const problemMatcherEnabled = getBooleanInput(INPUT_PROBLEM_MATCHER, true);
+  const problemMatcherEnabled = getBooleanInput(INPUT_PROBLEM_MATCHER, false);
 
   if (!problemMatcherEnabled) {
     core.debug('Java problem matcher is disabled');

src/util.ts

@@ -397,6 +397,18 @@ export function getVersionFromFileContent(
   const tentativeVersion = avoidOldNotation(capturedVersion);
   const rawVersion = tentativeVersion.split('-')[0];
 
+  // Preserve Corretto's full vendor release before generic coercion drops its extra numeric fields.
+  if (
+    (extractedDistribution || distributionName) === 'corretto' &&
+    capturedVersion === tentativeVersion &&
+    isExactCorrettoVersion(tentativeVersion)
+  ) {
+    return {
+      version: tentativeVersion,
+      distribution: extractedDistribution
+    };
+  }
+
   let version = semver.validRange(rawVersion)
     ? tentativeVersion
     : semver.coerce(tentativeVersion);
@@ -500,6 +512,13 @@ function avoidOldNotation(content: string): string {
   return content.startsWith('1.') ? content.substring(2) : content;
 }
 
+export function isExactCorrettoVersion(version: string): boolean {
+  // Java 8 releases have a nonzero update field; later releases use five numeric fields.
+  return /^(?:8\.(?!0+(?:\.|$))\d+(?:\.\d+){2}|(?!8\.)\d+(?:\.\d+){4})$/.test(
+    version.replace('+', '.')
+  );
+}
+
 export function convertVersionToSemver(version: number[] | string) {
   // Some distributions may use semver-like notation (12.10.2.1, 12.10.2.1.1)
   const versionArray = Array.isArray(version) ? version : version.split('.');