Make Java problem matcher opt-in (#1326)

Default the problem-matcher input to false so setup-java no longer
registers Java compiler and uncaught-exception annotations unless
explicitly enabled with problem-matcher: true.

Fixes #1322

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/workflows/e2e-versions.yml

@@ -51,6 +51,15 @@ jobs:
           - distribution: microsoft
             os: macos-latest
             version: 25
+          - distribution: microsoft
+            os: windows-latest
+            version: '25.0.5+0.2'
+          - distribution: microsoft
+            os: ubuntu-latest
+            version: '25.0.5+0.2'
+          - distribution: microsoft
+            os: macos-latest
+            version: '25.0.5+0.2'
           - distribution: kona
             os: windows-latest
             version: 25

.licenses/npm/fast-xml-builder.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-builder
-version: 1.3.0
+version: 1.3.1
 type: npm
 summary: Build XML from JSON without C/C++ based libraries
 homepage:

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.11.2
+version: 5.12.0
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/is-unsafe.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: is-unsafe
-version: 2.0.0
+version: 2.0.3
 type: npm
 summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
   HTML, XML, SVG, SQL, SHELL, and REGEX contexts

.licenses/npm/strnum.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.4.2
+version: 2.5.1
 type: npm
 summary: Parse String to Number based on configuration
 homepage:

README.md

@@ -59,7 +59,7 @@ steps:
 - Warm JDK-cached jobs can reuse cached release metadata, avoiding vendor API calls while retaining a stale-metadata fallback for vendor outages and rate limits.
 - Maven configuration now supports multiple server credentials and custom dependency-resolution repositories.
 - Maven signing keys are imported into an isolated temporary GPG home instead of the runner's default keyring.
-- Set `problem-matcher: false` to disable Java compiler and uncaught-exception annotations.
+- Java compiler and uncaught-exception annotations are now disabled by default. Set `problem-matcher: true` to enable them.
 - GraalVM distributions now set `GRAALVM_HOME` in addition to `JAVA_HOME`.
 - Invalid boolean values, unsupported distribution/package/platform combinations, and mismatched Maven toolchain ID counts now fail with targeted errors.
 - Renamed environment-variable-name inputs so they are not mistaken for secret values:
@@ -155,7 +155,7 @@ steps:
 | `check-latest` | Check remote metadata for the latest version satisfying the version spec before using the runner tool cache. | `false` |
 | `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
 | `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
-| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
+| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `false` |
 | `verify-signature` | Verify downloaded Java package signatures when supported. Explicitly setting this to `true` makes verification failures fatal. | Distribution-dependent; see [Download integrity and signatures](#download-integrity-and-signatures) |
 | `verify-signature-public-key` | One or more ASCII-armored GPG public keys used for signature verification. Concatenate multiple armored key blocks. Custom keys replace the bundled distribution keys. | |
 | `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
@@ -225,6 +225,7 @@ Additional distribution notes:
 
 - Oracle OpenJDK builds are archived after a limited number of releases and no longer receive security updates. To continue receiving security patches, use Oracle JDK or another vendor.
 - Azul Zulu maps `arm64` to `aarch64` when querying the Azul Metadata API.
+- Microsoft Build of OpenJDK uses Microsoft's live version manifest, falling back to the bundled version list when no release matches. Version `25.0.5.0.2` can also be requested as `25.0.5+0.2`.
 - GraalVM Community is available as `distribution: graalvm-community` for stable JDK 17 and later releases.
 - On Ubuntu runners, commands executed with `sudo` do not inherit the `JAVA_HOME` and `PATH` set by `setup-java` and may fall back to the system-default JDK.
 

__tests__/distributors/jetbrains-installer.test.ts

@@ -9,6 +9,9 @@ import {
   afterAll
 } from '@jest/globals';
 import https from 'https';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
 import {HttpClient, HttpClientResponse} from '@actions/http-client';
 import type {IncomingMessage} from 'http';
 import {Readable} from 'stream';
@@ -476,6 +479,109 @@ describe('findPackageForDownload', () => {
     }
   );
 
+  describe('hotfix releases', () => {
+    beforeEach(() => {
+      jest.spyOn(HttpClient.prototype, 'getJson').mockResolvedValue({
+        statusCode: 200,
+        headers: {},
+        result: [
+          release('jbr-release-25.0.4b508.27', false),
+          release('jbr-release-25.0.4.1b635.9', false),
+          release('jbr-release-25.0.4.1b635.79', false),
+          release('jbr-release-25.0.3.2b1000.1', false)
+        ]
+      });
+      jest.spyOn(HttpClient.prototype, 'head').mockResolvedValue(response(200));
+    });
+
+    it.each(['linux', 'osx', 'windows'])(
+      'selects the patched JBR archive and checksum on %s',
+      async platform => {
+        const distribution = new JetBrainsDistribution({
+          version: '25',
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: true
+        });
+        distribution['getPlatformOption'] = () => platform;
+        const url = `https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-25.0.4.1-${platform}-x64-b635.79.tar.gz`;
+
+        const result = await distribution['findPackageForDownload']('25');
+
+        expect(result).toEqual({
+          version: '25.0.4+1.635.79',
+          url,
+          checksum: {
+            algorithm: 'sha512',
+            value: JETBRAINS_CHECKSUM,
+            source: `${url}.checksum`
+          }
+        });
+        expect(HttpClient.prototype.head).toHaveBeenCalledWith(url);
+        expect(spyHttpClientGet).toHaveBeenCalledTimes(1);
+        expect(spyHttpClientGet).toHaveBeenCalledWith(`${url}.checksum`);
+      }
+    );
+
+    it.each([
+      ['latest', '25.0.4+1.635.79'],
+      ['25.0.4', '25.0.4+1.635.79'],
+      ['25.0.4.0', '25.0.4+508.27'],
+      ['25.0.4.1', '25.0.4+1.635.79'],
+      ['25.0.4.1+635.79', '25.0.4+1.635.79'],
+      ['25.0.4+1.635.9', '25.0.4+1.635.9'],
+      ['25.0.4+508.27', '25.0.4+508.27']
+    ])('resolves %s to %s', async (input, expected) => {
+      const distribution = new JetBrainsDistribution({
+        version: input,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: true
+      });
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toMatchObject({version: expected});
+    });
+
+    it('resolves early-access hotfix releases separately', async () => {
+      jest.spyOn(HttpClient.prototype, 'getJson').mockResolvedValue({
+        statusCode: 200,
+        headers: {},
+        result: [
+          release('jbr-release-25.0.4.1b635.79', true),
+          release('jbr-release-25.0.4.2b636.1', false)
+        ]
+      });
+      const distribution = new JetBrainsDistribution({
+        version: '25.0.4.1-ea',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: true
+      });
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toMatchObject({version: '25.0.4+1.635.79'});
+    });
+
+    it.each(['25.0.4.2', '25.0.4.1+635.80'])(
+      'does not substitute another patch or build for %s',
+      async input => {
+        const distribution = new JetBrainsDistribution({
+          version: input,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: true
+        });
+
+        await expect(
+          distribution['findPackageForDownload'](distribution['version'])
+        ).rejects.toThrow(/No matching version found/);
+      }
+    );
+  });
+
   it('version is not found', async () => {
     const distribution = new JetBrainsDistribution({
       version: '8.0.452',
@@ -569,4 +675,84 @@ describe('findPackageForDownload', () => {
       source: `${result.url}.checksum`
     });
   });
+
+  describe('compareVersions', () => {
+    it.each([
+      ['25.0.4+1.635.79', '25.0.4+508.27', 1],
+      ['25.0.5+1.1', '25.0.4+1.635.79', 1],
+      ['25.0.4+10.1.1', '25.0.4+2.999.99', 1],
+      ['25.0.4+1.635.79', '25.0.4+1.635.9', 1],
+      ['25.0.4+1.636.1', '25.0.4+1.635.79', 1],
+      ['25.0.4+0.635.79', '25.0.4+635.79', 0],
+      ['11.0.11+1522', '11.0.11+1522.1', -1],
+      ['25.0.4', '25.0.4+508.27', -1]
+    ])('compares %s with %s', (first, second, expected) => {
+      const distribution = new JetBrainsDistribution({
+        version: '25',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+
+      expect(Math.sign(distribution['compareVersions'](first, second))).toBe(
+        expected
+      );
+      expect(
+        Math.sign(distribution['compareVersions'](second, first)) || 0
+      ).toBe(-expected || 0);
+    });
+  });
+
+  describe('hotfix releases in the tool cache', () => {
+    let cacheRoot: string;
+    const previousToolcache = process.env['RUNNER_TOOL_CACHE'];
+
+    beforeEach(async () => {
+      cacheRoot = await fs.promises.mkdtemp(
+        path.join(os.tmpdir(), 'jetbrains-')
+      );
+      process.env['RUNNER_TOOL_CACHE'] = cacheRoot;
+      for (const version of ['25.0.4-508.27', '25.0.4-1.635.79']) {
+        const javaPath = path.join(
+          cacheRoot,
+          'Java_JetBrains_jdk',
+          version,
+          'x64'
+        );
+        await fs.promises.mkdir(javaPath, {recursive: true});
+        await fs.promises.writeFile(`${javaPath}.complete`, '');
+      }
+    });
+
+    afterEach(async () => {
+      if (previousToolcache === undefined) {
+        delete process.env['RUNNER_TOOL_CACHE'];
+      } else {
+        process.env['RUNNER_TOOL_CACHE'] = previousToolcache;
+      }
+      await fs.promises.rm(cacheRoot, {recursive: true, force: true});
+    });
+
+    it.each(['25', '25.0.4.1', '25.0.4.1+635.79'])(
+      'reuses the patched JBR for %s',
+      input => {
+        const distribution = new JetBrainsDistribution({
+          version: input,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: false
+        });
+
+        expect(distribution['findInToolcache']()).toEqual({
+          version: '25.0.4+1.635.79',
+          path: path.join(
+            cacheRoot,
+            'Java_JetBrains_jdk',
+            '25.0.4-1.635.79',
+            'x64'
+          )
+        });
+      }
+    );
+  });
 });

__tests__/distributors/microsoft-installer.test.ts

@@ -216,6 +216,172 @@ describe('findPackageForDownload', () => {
     expect(result.signatureUrl).toBe(`${url}.sig`);
   });
 
+  describe.each(['25.0.5.0.2', '25.0.5+0.2', '25.0.5'])(
+    'version %s missing from the live manifest',
+    version => {
+      it.each([
+        ['darwin', 'x64', 'macos', 'tar.gz'],
+        ['linux', 'x64', 'linux', 'tar.gz'],
+        ['win32', 'x64', 'windows', 'zip'],
+        ['darwin', 'aarch64', 'macos', 'tar.gz'],
+        ['linux', 'aarch64', 'linux', 'tar.gz'],
+        ['win32', 'aarch64', 'windows', 'zip']
+      ])(
+        'resolves the bundled release for %s/%s',
+        async (platform, architecture, osType, extension) => {
+          mockOsPlatform.mockReturnValue(platform);
+          const distro = new MicrosoftDistributions({
+            version,
+            architecture,
+            packageType: 'jdk',
+            checkLatest: false
+          });
+
+          const result = await distro['findPackageForDownload'](
+            distro['version']
+          );
+          const url = `https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-${osType}-${architecture}.${extension}`;
+
+          expect(result).toEqual({
+            version: '25.0.5+0.2',
+            url,
+            signatureUrl: `${url}.sig`,
+            checksum: {
+              algorithm: 'sha256',
+              value: MICROSOFT_CHECKSUM,
+              source: `${url}.sha256sum.txt`
+            }
+          });
+          expect(spyHttpClientGet).toHaveBeenCalledWith(`${url}.sha256sum.txt`);
+        }
+      );
+    }
+  );
+
+  it('prefers the live manifest when it contains the requested release', async () => {
+    mockOsPlatform.mockReturnValue('linux');
+    const url =
+      'https://example.test/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz';
+    spyGetManifestFromRepo.mockResolvedValue({
+      result: [
+        {
+          version: '25.0.5+0.2',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: url
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+
+    const result = await distribution['findPackageForDownload']('25.0.5+0.2');
+
+    expect(result.version).toBe('25.0.5+0.2');
+    expect(result.url).toBe(url);
+    expect(spyGetManifestFromRepo).toHaveBeenCalledWith(
+      'https://aka.ms/download-jdk/microsoft-openjdk-versions.json',
+      {accept: 'application/json'}
+    );
+  });
+
+  it('falls back to the bundled build when the live manifest has another build', async () => {
+    mockOsPlatform.mockReturnValue('linux');
+    spyGetManifestFromRepo.mockResolvedValue({
+      result: [
+        {
+          version: '25.0.5+0.3',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-25.0.5.0.3-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url:
+                'https://example.test/microsoft-jdk-25.0.5.0.3-linux-x64.tar.gz'
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+
+    const result = await distribution['findPackageForDownload']('25.0.5+0.2');
+
+    expect(result.version).toBe('25.0.5+0.2');
+    expect(result.url).toBe(
+      'https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz'
+    );
+  });
+
+  it('matches dotted Java versions without falling back to the base release', async () => {
+    mockOsPlatform.mockReturnValue('linux');
+    spyGetManifestFromRepo.mockResolvedValue({
+      result: [
+        {
+          version: '17.0.8',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-17.0.8-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: 'https://example.test/microsoft-jdk-17.0.8.tar.gz'
+            }
+          ]
+        },
+        {
+          version: '17.0.8.1',
+          stable: true,
+          release_url: 'https://aka.ms/download-jdk',
+          files: [
+            {
+              filename: 'microsoft-jdk-17.0.8.1-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: 'https://example.test/microsoft-jdk-17.0.8.1.tar.gz'
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+    distribution = new MicrosoftDistributions({
+      version: '17.0.8.1',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+
+    const result = await distribution['findPackageForDownload'](
+      distribution['version']
+    );
+
+    expect(result.version).toBe('17.0.8+1');
+    expect(result.url).toBe(
+      'https://example.test/microsoft-jdk-17.0.8.1.tar.gz'
+    );
+  });
+
+  it('preserves the error when the live manifest cannot be loaded', async () => {
+    spyGetManifestFromRepo.mockRejectedValue(new Error('Network error'));
+
+    await expect(
+      distribution['findPackageForDownload']('25.0.5+0.2')
+    ).rejects.toThrow('Could not load manifest for Microsoft Build of OpenJDK');
+  });
+
   it.each([
     ['amd64', 'x64'],
     ['arm64', 'aarch64']

__tests__/distributors/semeru-installer.test.ts

@@ -272,7 +272,7 @@ describe('findPackageForDownload', () => {
     }
   );
 
-  it.each(['zos', 'z/OS', 'z/os', 'test0987654321=', '++=++', 'myArch'])(
+  it.each(['zos', 'myArch'])(
     'incorrect Semeru `%s` architecture throws',
     async (arch: string) => {
       const distribution = new SemeruDistribution({

__tests__/java-platform-contract.test.ts

@@ -31,6 +31,36 @@ describe('Java platform capabilities', () => {
     expect(normalizeArchitecture(input)).toBe(expected);
   });
 
+  it.each(['constructor', 'Constructor'])(
+    'preserves custom architecture token %s for jdkfile',
+    architecture => {
+      expect(normalizeArchitecture(architecture)).toBe(architecture);
+      expect(validateJavaPlatform('jdkfile', 'linux', architecture, '17')).toBe(
+        architecture
+      );
+    }
+  );
+
+  it.each([
+    'x64<<end\nvalue\nend',
+    'z/OS',
+    'z/os',
+    'test0987654321=',
+    '++=++',
+    '../x64',
+    'x64\\other',
+    'x64 other',
+    '-x64',
+    '_x64'
+  ])('rejects invalid architecture token %s', architecture => {
+    const message = `Unsupported architecture value: ${JSON.stringify(architecture)}`;
+
+    expect(() => normalizeArchitecture(architecture)).toThrow(message);
+    expect(() =>
+      validateJavaPlatform('jdkfile', 'linux', architecture, '17')
+    ).toThrow(message);
+  });
+
   it.each([
     ['linux', false, 'linux-glibc'],
     ['linux', true, 'linux-musl'],

__tests__/problem-matcher.test.ts

@@ -27,7 +27,16 @@ describe('configureProblemMatcher', () => {
     jest.resetAllMocks();
   });
 
-  it('registers the Java problem matcher by default', () => {
+  it('does not register the Java problem matcher by default', () => {
+    configureProblemMatcher('/matchers/java.json');
+
+    expect(mockInfo).not.toHaveBeenCalled();
+    expect(mockDebug).toHaveBeenCalledWith('Java problem matcher is disabled');
+  });
+
+  it('registers the Java problem matcher when explicitly enabled', () => {
+    inputs[INPUT_PROBLEM_MATCHER] = 'true';
+
     configureProblemMatcher('/matchers/java.json');
 
     expect(mockInfo).toHaveBeenCalledWith('##[add-matcher]/matchers/java.json');

__tests__/verify-java.sh

@@ -15,6 +15,13 @@ EXPECTED_PATH=$2
 SETUP_JAVA_VERSION=$3
 REQUIRE_CONCRETE_VERSION=$4
 
+if [[ $EXPECTED_JAVA_VERSION == *"+"* ]] && [ "$SETUP_JAVA_VERSION" != "$EXPECTED_JAVA_VERSION" ]; then
+  echo "::error::The version output does not match the requested build"
+  echo "Requested version: $EXPECTED_JAVA_VERSION"
+  echo "Version output: $SETUP_JAVA_VERSION"
+  exit 1
+fi
+
 EXPECTED_JAVA_VERSION=$(echo $EXPECTED_JAVA_VERSION | cut -d'+' -f1)
 if [[ $EXPECTED_JAVA_VERSION == 8 ]] || [[ $EXPECTED_JAVA_VERSION == 8.* ]]; then
   EXPECTED_JAVA_VERSION="1.${EXPECTED_JAVA_VERSION}"

action.yml

@@ -138,9 +138,9 @@ inputs:
     required: false
     default: false
   problem-matcher:
-    description: 'Whether to register the Java problem matcher (compiler errors/warnings and uncaught exceptions). Set to "false" to disable annotations.'
+    description: 'Whether to register the Java problem matcher (compiler errors/warnings and uncaught exceptions). Disabled by default; set to "true" to enable annotations.'
     required: false
-    default: true
+    default: false
 outputs:
   distribution:
     description: 'Distribution of Java that has been installed'

dist/cleanup/314.index.js

@@ -21,8 +21,8 @@ var external_fs_default = /*#__PURE__*/__webpack_require__.n(external_fs_);
 // EXTERNAL MODULE: external "path"
 var external_path_ = __webpack_require__(6928);
 var external_path_default = /*#__PURE__*/__webpack_require__.n(external_path_);
-// EXTERNAL MODULE: ./node_modules/@actions/cache/lib/cache.js + 322 modules
+// EXTERNAL MODULE: ./node_modules/@actions/cache/lib/cache.js + 323 modules
-var lib_cache = __webpack_require__(6080);
+var lib_cache = __webpack_require__(8230);
 // EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js + 7 modules
 var lib_core = __webpack_require__(3838);
 // EXTERNAL MODULE: ./src/util.ts

dist/cleanup/348.index.js

@@ -15,7 +15,7 @@ export const modules = {
 /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_1__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6080);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8230);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(3838);
 
 

dist/cleanup/377.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_0__);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6080);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8230);
 /* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3838);
 /* harmony import */ var _actions_glob__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(2377);
 /**

dist/cleanup/index.js

@@ -36343,12 +36343,12 @@ async function saveCaches() {
     }
     const saves = [];
     if (cache) {
-        const { save } = await Promise.all(/* import() */[__nccwpck_require__.e(80), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
+        const { save } = await Promise.all(/* import() */[__nccwpck_require__.e(230), __nccwpck_require__.e(377)]).then(__nccwpck_require__.bind(__nccwpck_require__, 7377));
         saves.push(save(cache));
     }
     if (cacheJdk) {
-        const { saveJdkCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(80), __nccwpck_require__.e(314)]).then(__nccwpck_require__.bind(__nccwpck_require__, 2314));
+        const { saveJdkCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(230), __nccwpck_require__.e(314)]).then(__nccwpck_require__.bind(__nccwpck_require__, 2314));
-        const { saveJdkResolutionCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(80), __nccwpck_require__.e(348)]).then(__nccwpck_require__.bind(__nccwpck_require__, 967));
+        const { saveJdkResolutionCaches } = await Promise.all(/* import() */[__nccwpck_require__.e(230), __nccwpck_require__.e(348)]).then(__nccwpck_require__.bind(__nccwpck_require__, 967));
         saves.push(saveJdkCaches());
         saves.push(saveJdkResolutionCaches());
     }

dist/setup/219.index.js

@@ -15686,19 +15686,26 @@ var Matcher = __webpack_require__(8257);
 ;// CONCATENATED MODULE: ./node_modules/fast-xml-builder/src/util.js
 
 
+// String(val)/val.toString() drop the sign of -0 (e.g. String(-0) === '0'), silently
+// corrupting a round-tripped negative-zero value. XML has no separate int/float syntax,
+// so this is the single place every raw value gets turned into text.
+function valToStr(val) {
+  return typeof val === 'number' && Object.is(val, -0) ? '-0' : String(val)
+}
+
 function safeComment(val) {
-  return String(val)
+  return valToStr(val)
     .replace(/--/g, '- -')   // -- is illegal anywhere in comment content
     .replace(/--/g, '- -')   // handle the scenario when 2 consiucative dashes appears 
     .replace(/-$/, '- ');    // trailing - would form -- with the closing -->
 }
 
 function safeCdata(val) {
-  return String(val).replace(/\]\]>/g, ']]]]><![CDATA[>')
+  return valToStr(val).replace(/\]\]>/g, ']]]]><![CDATA[>')
 }
 
 function escapeAttribute(val) {
-  return String(val).replace(/"/g, '&quot;').replace(/'/g, '&apos;')
+  return valToStr(val).replace(/"/g, '&quot;').replace(/'/g, '&apos;')
 }
 // EXTERNAL MODULE: ./node_modules/xml-naming/src/index.js
 var src = __webpack_require__(4658);
@@ -15793,7 +15800,7 @@ function arrToStr(arr, options, indentation, matcher, stopNodeExpressions, qName
     if (!Array.isArray(arr)) {
         // Non-array values (e.g. string tag values) should be treated as text content
         if (arr !== undefined && arr !== null) {
-            let text = arr.toString();
+            let text = valToStr(arr);
             text = replaceEntitiesValue(text, options);
             return text;
         }
@@ -15832,6 +15839,7 @@ function arrToStr(arr, options, indentation, matcher, stopNodeExpressions, qName
                 tagText = options.tagValueProcessor(tagName, tagText);
                 tagText = replaceEntitiesValue(tagText, options);
             }
+            tagText = valToStr(tagText);
             if (isPreviousElementTag) {
                 xmlStr += indentation;
             }
@@ -15940,7 +15948,7 @@ function orderedJs2Xml_getRawContent(arr, options) {
     if (!Array.isArray(arr)) {
         // Non-array values return as-is
         if (arr !== undefined && arr !== null) {
-            return arr.toString();
+            return valToStr(arr);
         }
         return "";
     }
@@ -15952,7 +15960,7 @@ function orderedJs2Xml_getRawContent(arr, options) {
 
         if (tagName === options.textNodeName) {
             // Raw text content - NO processing, NO entity replacement
-            content += item[tagName];
+            content += valToStr(item[tagName]);
         } else if (tagName === options.cdataPropName) {
             // CDATA content
             content += item[tagName][0][options.textNodeName];
@@ -16293,11 +16301,11 @@ Builder.prototype.j2x = function (jObj, level, matcher, qNameValidator) {
       if (attr && !this.ignoreAttributesFn(attr, jPath)) {
         // Resolve the attribute name through sanitizeName
         const resolvedAttr = fxb_resolveTagName(attr, true, this.options, matcher, qNameValidator);
-        attrStr += this.buildAttrPairStr(resolvedAttr, '' + jObj[key], isCurrentStopNode);
+        attrStr += this.buildAttrPairStr(resolvedAttr, valToStr(jObj[key]), isCurrentStopNode);
       } else if (!attr) {
         //tag value
         if (key === this.options.textNodeName) {
-          let newval = this.options.tagValueProcessor(key, '' + jObj[key]);
+          let newval = this.options.tagValueProcessor(key, valToStr(jObj[key]));
           val += this.replaceEntitiesValue(newval);
         } else {
           // Check if this is a stopNode before building
@@ -16307,7 +16315,7 @@ Builder.prototype.j2x = function (jObj, level, matcher, qNameValidator) {
 
           if (isStopNode) {
             // Build as raw content without encoding
-            const textValue = '' + jObj[key];
+            const textValue = valToStr(jObj[key]);
             if (textValue === '') {
               val += this.indentate(level) + '<' + resolvedKey + this.closeTag(resolvedKey) + this.tagEndChar;
             } else {
@@ -16349,6 +16357,7 @@ Builder.prototype.j2x = function (jObj, level, matcher, qNameValidator) {
           if (this.options.oneListGroup) {
             let textValue = this.options.tagValueProcessor(resolvedKey, item);
             textValue = this.replaceEntitiesValue(textValue);
+            textValue = valToStr(textValue);
             listTagVal += textValue;
           } else {
             // Check if this is a stopNode before building
@@ -16358,7 +16367,7 @@ Builder.prototype.j2x = function (jObj, level, matcher, qNameValidator) {
 
             if (isStopNode) {
               // Build as raw content without encoding
-              const textValue = '' + item;
+              const textValue = valToStr(item);
               if (textValue === '') {
                 listTagVal += this.indentate(level) + '<' + resolvedKey + this.closeTag(resolvedKey) + this.tagEndChar;
               } else {
@@ -16382,7 +16391,7 @@ Builder.prototype.j2x = function (jObj, level, matcher, qNameValidator) {
         for (let j = 0; j < L; j++) {
           // Resolve attribute names inside attributesGroupName
           const resolvedAttr = fxb_resolveTagName(Ks[j], true, this.options, matcher, qNameValidator);
-          attrStr += this.buildAttrPairStr(resolvedAttr, '' + jObj[key][Ks[j]], isCurrentStopNode);
+          attrStr += this.buildAttrPairStr(resolvedAttr, valToStr(jObj[key][Ks[j]]), isCurrentStopNode);
         }
       } else {
         val += this.processTextOrObjNode(jObj[key], resolvedKey, level, matcher, qNameValidator)
@@ -16394,7 +16403,7 @@ Builder.prototype.j2x = function (jObj, level, matcher, qNameValidator) {
 
 Builder.prototype.buildAttrPairStr = function (attrName, val, isStopNode) {
   if (!isStopNode) {
-    val = this.options.attributeValueProcessor(attrName, '' + val);
+    val = this.options.attributeValueProcessor(attrName, valToStr(val));
     val = this.replaceEntitiesValue(val);
   }
   if (this.options.suppressBooleanAttributes && val === "true") {
@@ -16654,6 +16663,10 @@ Builder.prototype.buildTextValNode = function (val, key, attrStr, level, matcher
     // Normal processing: apply tagValueProcessor and entity replacement
     let textValue = this.options.tagValueProcessor(key, val);
     textValue = this.replaceEntitiesValue(textValue);
+    // tagValueProcessor may return the raw value unchanged (default is identity), and
+    // replaceEntitiesValue no-ops on non-strings, so a plain number can still reach here;
+    // stringify it now, sign-preserving, before it's implicitly ToString'd below.
+    textValue = valToStr(textValue);
 
     if (textValue === '') {
       return this.indentate(level) + '<' + key + attrStr + this.closeTag(key) + this.tagEndChar;
@@ -16695,8 +16708,8 @@ function isAttribute(name /*, options*/) {
 
 // EXTERNAL MODULE: ./node_modules/fast-xml-parser/src/fxp.js
 var fxp = __webpack_require__(5824);
-// EXTERNAL MODULE: ./node_modules/fast-xml-parser/src/xmlparser/XMLParser.js + 22 modules
+// EXTERNAL MODULE: ./node_modules/fast-xml-parser/src/xmlparser/XMLParser.js + 23 modules
-var XMLParser = __webpack_require__(6009);
+var XMLParser = __webpack_require__(1143);
 ;// CONCATENATED MODULE: ./node_modules/@azure/core-xml/dist/esm/xml.common.js
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.

dist/setup/220.index.js

@@ -1,330 +0,0 @@
-export const id = 220;
-export const ids = [220];
-export const modules = {
-
-/***/ 3220:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
-
-
-// EXPORTS
-__webpack_require__.d(__webpack_exports__, {
-  MicrosoftDistributions: () => (/* binding */ MicrosoftDistributions)
-});
-
-// UNUSED EXPORTS: MICROSOFT_PUBLIC_KEY
-
-// EXTERNAL MODULE: ./src/distributions/base-installer.ts + 2 modules
-var base_installer = __webpack_require__(6242);
-// EXTERNAL MODULE: ./src/util.ts
-var util = __webpack_require__(4527);
-// EXTERNAL MODULE: ./src/gpg.ts
-var gpg = __webpack_require__(8343);
-;// CONCATENATED MODULE: ./src/distributions/microsoft/microsoft-key.ts
-// Microsoft Build of OpenJDK GPG signing key
-// Retrieved from: https://download.visualstudio.microsoft.com/download/pr/b90071e2-e0cf-4411-98be-dbeb09d67bf0/8622862bcd54206e158c5abca0582c9b/464279_464280_aoc_20210208.asc
-const MICROSOFT_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: BSN Pgp v1.1.0.0
-
-mQENBGAhlWcBCADCQjj6huLTenvZSLej35e9YKEHm4lix2uvPOONexMaU8V2v7KL
-RGdoXF7jwHci7efnPZ+9zpS2+g3rhvv8M7yWy9E/1psEtGzvmp1IL/qIabMEQqi+
-UlhPGh7MQ/BkXAlic8Dyl3XYqr0EXS11iCiTr6Zkxs9Ee4V54gxL4gogRn4wk9sl
-/nrjgDzMsUwla0pynoQQvYpqCdiAr3gKKllT1skCDqgVOMMyZxsx9HjZxg/3AJz6
-r5i512L2R+3Hkv+XmxT+mnGBCFcny0DM7PjNXEmIK3ZSkro1tQML90zx3Fyh5esx
-fpVvuIXGFV75o35VVCBZoiD3hcfOnIJsPQ9nABEBAAG0OE1pY3Jvc29mdCBKYXZh
-IEVuZ2luZWVyaW5nIDxqYXZhcGxhdGluZnJhQG1pY3Jvc29mdC5jb20+iQE4BBMB
-CAAiBQJgIZVnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRA1Ux0xWyHB
-icwTCACJO2FGNocNvdUtAb+eDKuGwt0chAJdCES2ZtgBScwrwDyWpxpRznoXWBHL
-MJeLyxJoKsCG3vVlY4uh48psCzVm3OKvi7MCPT955t8W6TzfSBxTpjR8zRgJkjPJ
-EGhHTlusUfz7TtM5etJF0qscSJH1grcNsgtee97mk4QyEzT8Di83NQmYxKcBrliq
-yK/SWWt8VkTyYAEO6L5PoB4L9r8ka27uQs+jgCw+/Z0JMtNmmhyNGY3+a1YtPeoy
-JdQaI9LphfKGbVaz6SK2aol7vj+c2TG3TLUYdOYGMH1OZlri2GTkCVjwna2GC7p4
-Fa133tP85xzJEq1XeXm8WeLFo2wV
-=rHCS
------END PGP PUBLIC KEY BLOCK-----`;
-
-// EXTERNAL MODULE: ./src/constants.ts
-var constants = __webpack_require__(7242);
-// EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js + 7 modules
-var core = __webpack_require__(3838);
-// EXTERNAL MODULE: ./node_modules/@actions/tool-cache/lib/tool-cache.js + 2 modules
-var tool_cache = __webpack_require__(9805);
-// EXTERNAL MODULE: external "fs"
-var external_fs_ = __webpack_require__(9896);
-var external_fs_default = /*#__PURE__*/__webpack_require__.n(external_fs_);
-// EXTERNAL MODULE: external "path"
-var external_path_ = __webpack_require__(6928);
-var external_path_default = /*#__PURE__*/__webpack_require__.n(external_path_);
-;// CONCATENATED MODULE: ./src/distributions/microsoft/installer.ts
-
-
-
-
-
-
-
-
-
-
-class MicrosoftDistributions extends base_installer/* JavaBase */.O {
-    constructor(installerOptions) {
-        super('Microsoft', installerOptions);
-    }
-    async downloadTool(javaRelease) {
-        core/* info */.pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
-        let javaArchivePath = await this.downloadAndVerify(javaRelease);
-        if (this.verifySignature) {
-            try {
-                if (!javaRelease.signatureUrl) {
-                    throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.`);
-                }
-                core/* info */.pq(`Verifying Java package signature...`);
-                try {
-                    await gpg/* verifyPackageSignature */.Yi(javaArchivePath, javaRelease.signatureUrl, this.verifySignaturePublicKey ?? MICROSOFT_PUBLIC_KEY);
-                }
-                catch (error) {
-                    throw new Error(`Failed to verify signature for Microsoft Build of OpenJDK version ${javaRelease.version}. Signature URL: ${javaRelease.signatureUrl}. Error: ${error.message} ${constants/* SIGNATURE_VERIFICATION_FAILURE_HELP */.kQ}`, { cause: error });
-                }
-            }
-            catch (error) {
-                if (this.verifySignatureExplicitlyRequested) {
-                    throw error;
-                }
-                core/* warning */.$e(error instanceof Error ? error.message : `Unknown error: ${error}`);
-            }
-        }
-        core/* info */.pq(`Extracting Java archive...`);
-        const extension = (0,util/* getDownloadArchiveExtension */.ag)();
-        if (process.platform === 'win32') {
-            javaArchivePath = (0,util/* renameWinArchive */.n2)(javaArchivePath);
-        }
-        const extractedJavaPath = await (0,util/* extractJdkFile */.PE)(javaArchivePath, extension);
-        const archiveName = external_fs_default().readdirSync(extractedJavaPath)[0];
-        const archivePath = external_path_default().join(extractedJavaPath, archiveName);
-        const javaPath = await (0,util/* cacheJdkDir */.Vj)(archivePath, this.toolcacheFolderName, this.getToolcacheVersionName(javaRelease.version), this.architecture);
-        return { version: javaRelease.version, path: javaPath };
-    }
-    async findPackageForDownload(range) {
-        const arch = this.distributionArchitecture();
-        if (arch !== 'x64' && arch !== 'aarch64') {
-            throw new Error(`Unsupported architecture: ${this.architecture}`);
-        }
-        if (!this.stable) {
-            throw new Error('Early access versions are not supported');
-        }
-        if (this.packageType !== 'jdk') {
-            throw new Error('Microsoft Build of OpenJDK provides only the `jdk` package type');
-        }
-        const manifest = await this.getAvailableVersions();
-        if (!manifest) {
-            throw new Error('Could not load manifest for Microsoft Build of OpenJDK');
-        }
-        const foundRelease = await tool_cache/* findFromManifest */.DC(range, true, manifest, arch);
-        if (!foundRelease) {
-            const availableVersionStrings = manifest.map(item => item.version);
-            throw this.createVersionNotFoundError(range, availableVersionStrings);
-        }
-        const file = foundRelease.files[0];
-        const signatureUrl = file.signature_url ?? `${file.download_url}.sig`;
-        return {
-            url: file.download_url,
-            signatureUrl,
-            version: foundRelease.version,
-            checksum: await this.fetchChecksum(`${file.download_url}.sha256sum.txt`, 'sha256')
-        };
-    }
-    supportsSignatureVerification() {
-        return true;
-    }
-    async getAvailableVersions() {
-        let releases = null;
-        const fileUrl = `https://aka.ms/download-jdk/microsoft-openjdk-versions.json`;
-        // Avoid leaking the GitHub token to a non-GitHub host (aka.ms redirects to a CDN).
-        const headers = { accept: 'application/json' };
-        let response = null;
-        if (core/* isDebug */._o()) {
-            console.time('Retrieving available versions for Microsoft took'); // eslint-disable-line no-console
-        }
-        try {
-            response = await this.http.getJson(fileUrl, headers);
-            if (!response.result) {
-                return null;
-            }
-        }
-        catch (err) {
-            core/* debug */.Yz(`Http request for microsoft-openjdk-versions.json failed with status code: ${response?.statusCode}. Error: ${err}`);
-            return null;
-        }
-        if (response.result) {
-            releases = response.result;
-        }
-        if (core/* isDebug */._o() && releases) {
-            core/* startGroup */.Oh('Print information about available versions');
-            console.timeEnd('Retrieving available versions for Microsoft took'); // eslint-disable-line no-console
-            core/* debug */.Yz(`Available versions: [${releases.length}]`);
-            core/* debug */.Yz(releases.map(item => item.version).join(', '));
-            core/* endGroup */.N4();
-        }
-        return releases;
-    }
-}
-
-
-/***/ }),
-
-/***/ 8343:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   Fh: () => (/* binding */ importKey),
-/* harmony export */   Yi: () => (/* binding */ verifyPackageSignature),
-/* harmony export */   mS: () => (/* binding */ removeGpgHome),
-/* harmony export */   nY: () => (/* binding */ toGpgPath),
-/* harmony export */   o6: () => (/* binding */ isGpgAvailable)
-/* harmony export */ });
-/* unused harmony export GPG_HOME_PREFIX */
-/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
-/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
-/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
-/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
-/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
-/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
-
-
-
-
-
-
-
-const GPG_HOME_PREFIX = 'setup-java-gpg-';
-const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
-async function isGpgAvailable() {
-    return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
-}
-// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
-// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
-// internally. Passing Windows paths with backslashes can cause fatal GPG errors
-// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
-function toGpgPath(p) {
-    if (process.platform !== 'win32')
-        return p;
-    return p
-        .replace(/\\/g, '/')
-        .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
-}
-function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) {
-    const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix));
-    if (process.platform !== 'win32') {
-        fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
-    }
-    return gpgHome;
-}
-async function importKey(privateKey) {
-    const gpgHome = createGpgHome(GPG_HOME_PREFIX);
-    const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
-    try {
-        fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
-            encoding: 'utf-8',
-            flag: 'wx',
-            mode: 0o600
-        });
-        try {
-            await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
-                '--homedir',
-                toGpgPath(gpgHome),
-                '--batch',
-                '--import',
-                toGpgPath(privateKeyFile)
-            ], { silent: true });
-        }
-        finally {
-            fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(privateKeyFile, { force: true });
-        }
-        return gpgHome;
-    }
-    catch (error) {
-        await removeGpgHome(gpgHome);
-        throw error;
-    }
-}
-async function removeGpgHome(gpgHome) {
-    if (!gpgHome) {
-        return;
-    }
-    const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
-    const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
-    if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
-        !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
-        throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
-    }
-    if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
-        return;
-    }
-    await stopGpgAgent(resolvedGpgHome);
-    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
-}
-async function stopGpgAgent(gpgHome) {
-    try {
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
-    }
-    catch {
-        // gpgconf may be unavailable, but directory removal must still be attempted.
-    }
-}
-async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
-    const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
-    let gpgHome;
-    try {
-        // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
-        const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4();
-        gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
-    }
-    catch (error) {
-        try {
-            await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
-        }
-        catch {
-            // ignore cleanup failures
-        }
-        throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`, { cause: error });
-    }
-    try {
-        const publicKeys = Array.isArray(publicKeyContent)
-            ? publicKeyContent
-            : [publicKeyContent];
-        const publicKeyFiles = publicKeys.map((publicKey, index) => {
-            const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
-            fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
-            return toGpgPath(publicKeyFile);
-        });
-        const options = { silent: true };
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
-            '--homedir',
-            toGpgPath(gpgHome),
-            '--batch',
-            '--import',
-            ...publicKeyFiles
-        ], options);
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
-            '--homedir',
-            toGpgPath(gpgHome),
-            '--batch',
-            '--verify',
-            toGpgPath(signaturePath),
-            toGpgPath(archivePath)
-        ], options);
-    }
-    finally {
-        await stopGpgAgent(gpgHome);
-        await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
-        await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
-    }
-}
-
-
-/***/ })
-
-};

dist/setup/282.index.js

@@ -34,16 +34,16 @@ class JetBrainsDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
     async findPackageForDownload(range) {
         const versionsRaw = await this.getAvailableVersions();
         const versions = versionsRaw.map(v => {
-            const formattedVersion = `${v.semver}+${v.build}`;
+            const formattedVersion = (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .normalizeJavaVersionToSemver */ .zZ)(`${v.semver}+${v.build}`);
             return {
                 version: formattedVersion,
                 url: v.url
             };
         });
         const satisfiedVersions = versions
-            .filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .isVersionSatisfies */ .y)(range, item.version))
+            .filter(item => this.isVersionSatisfied(range, item.version))
             .sort((a, b) => {
-            return -semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(a.version, b.version);
+            return -this.compareVersions(a.version, b.version);
         });
         const resolvedFullVersion = satisfiedVersions.length > 0 ? satisfiedVersions[0] : null;
         if (!resolvedFullVersion) {
@@ -59,6 +59,44 @@ class JetBrainsDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
             checksum: await this.fetchChecksum(`${resolvedFullVersion.url}.checksum`, ['sha512', 'sha256'])
         };
     }
+    normalizeVersion(version) {
+        const normalized = super.normalizeVersion(version);
+        if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+            // A patch-only request must match any JBR build of that patch.
+            normalized.version = version.replace(/-ea$/, '');
+        }
+        return normalized;
+    }
+    isVersionSatisfied(range, version) {
+        const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+        if (patchRequest) {
+            const candidate = semver__WEBPACK_IMPORTED_MODULE_3___default().parse(version);
+            return (candidate !== null &&
+                semver__WEBPACK_IMPORTED_MODULE_3___default().eq(patchRequest[1], candidate) &&
+                (candidate.build.slice(0, -2).join('.') || '0') ===
+                    patchRequest[2].slice(1));
+        }
+        return super.isVersionSatisfied(range, version);
+    }
+    compareVersions(a, b) {
+        const mainComparison = semver__WEBPACK_IMPORTED_MODULE_3___default().compare(a, b);
+        if (mainComparison !== 0) {
+            return mainComparison;
+        }
+        // JBR builds have two components (one in older releases). Any preceding
+        // metadata components are Java patch fields and take priority over builds.
+        const first = new (semver__WEBPACK_IMPORTED_MODULE_3___default().SemVer)(a).build;
+        const second = new (semver__WEBPACK_IMPORTED_MODULE_3___default().SemVer)(b).build;
+        const firstPatch = first.slice(0, -2);
+        const secondPatch = second.slice(0, -2);
+        for (let index = 0; index < Math.max(firstPatch.length, secondPatch.length); index++) {
+            const patchComparison = semver__WEBPACK_IMPORTED_MODULE_3___default().compareIdentifiers(firstPatch[index] ?? '0', secondPatch[index] ?? '0');
+            if (patchComparison !== 0) {
+                return patchComparison;
+            }
+        }
+        return semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(first.length ? `0.0.0+${first.slice(-2).join('.')}` : '0.0.0', second.length ? `0.0.0+${second.slice(-2).join('.')}` : '0.0.0');
+    }
     async downloadTool(javaRelease) {
         _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
         const javaArchivePath = await this.downloadAndVerify(javaRelease);

dist/setup/824.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */   i: () => (/* binding */ XMLValidator)
 /* harmony export */ });
 /* harmony import */ var _validator_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1176);
-/* harmony import */ var _xmlparser_XMLParser_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6009);
+/* harmony import */ var _xmlparser_XMLParser_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1143);
 
 
 
@@ -627,7 +627,7 @@ function getPositionFromMatch(match) {
 
 /***/ }),
 
-/***/ 6009:
+/***/ 1143:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -1582,8 +1582,10 @@ function toNumber(str, options = {}) {
         return parse_int(trimmedStr, 2);
     } else if (options.octal && octRegex.test(trimmedStr)) {
         return parse_int(trimmedStr, 8);
-    } else if (!isFinite(trimmedStr)) { //Infinity
+    } else if (!isFinite(trimmedStr)) { //Infinity or not a number
-        return handleInfinity(str, Number(trimmedStr), options);
+        const num = Number(trimmedStr);
+        if (Number.isNaN(num)) return str; //not a number: always the original string
+        return handleInfinity(str, num, options); //only +/-Infinity reaches here
     } else if (trimmedStr.includes('e') || trimmedStr.includes('E')) { //eNotation
         return resolveEnotation(str, trimmedStr, options);
     } else {
@@ -1595,8 +1597,8 @@ function toNumber(str, options = {}) {
             const leadingZeros = match[2];
             let numTrimmedByZeros = trimZeros(match[3]); //complete num without leading zeros
             const decimalAdjacentToLeadingZeros = sign ? // 0., -00., 000.
-                str[leadingZeros.length + 1] === "."
+                trimmedStr[leadingZeros.length + 1] === "."
-                : str[leadingZeros.length] === ".";
+                : trimmedStr[leadingZeros.length] === ".";
 
             //trim ending zeros for floating number
             if (!options.leadingZeros //leading zeros are not allowed
@@ -1644,8 +1646,8 @@ function resolveEnotation(str, trimmedStr, options) {
         const eChar = notation[3].indexOf("e") === -1 ? "E" : "e";
         const leadingZeros = notation[2];
         const eAdjacentToLeadingZeros = sign ? // 0E.
-            str[leadingZeros.length + 1] === eChar
+            trimmedStr[leadingZeros.length + 1] === eChar
-            : str[leadingZeros.length] === eChar;
+            : trimmedStr[leadingZeros.length] === eChar;
 
         if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str;
         else if (leadingZeros.length === 1
@@ -1654,8 +1656,7 @@ function resolveEnotation(str, trimmedStr, options) {
         } else if (leadingZeros.length > 0) {
             // Has leading zeros — only accept if leadingZeros option allows it
             if (options.leadingZeros && !eAdjacentToLeadingZeros) {
-                trimmedStr = (notation[1] || "") + notation[3];
+                return Number(trimmedStr); // Number() accepts leading zeros; stripping can leave a mantissa-less ".e0"
-                return Number(trimmedStr);
             } else return str;
         } else {
             // No leading zeros — always valid e-notation, parse it
@@ -1718,6 +1719,7 @@ function handleInfinity(str, num, options) {
             return str; // Return original string like "1e1000"
     }
 }
+
 ;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/ignoreAttributes.js
 function getIgnoreAttributesFn(ignoreAttributes) {
     if (typeof ignoreAttributes === 'function') {
@@ -3899,6 +3901,56 @@ const SQL_STRICT_PATTERNS = [...sql, ...SQL_STRICT_EXTRA];
 
 /* harmony default export */ const sql_strict = (SQL_STRICT_PATTERNS);
 
+;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/util/decode-entities.js
+/**
+ * Decode the HTML character references that matter for markup-context
+ * detection.
+ *
+ * Browsers decode character references in attribute values before they
+ * interpret a URL, so `javascript:alert(1)` in an href is the
+ * `javascript:` scheme. The HTML/XML/SVG rules match literal characters, so
+ * without this step such payloads slip through.
+ *
+ * Deliberately NOT a full entity decoder. It decodes only:
+ *   - decimal refs  :  :  :  &#58   (any leading zeros,
+ *                   trailing ; optional — browsers accept both)
+ *   - hex refs      : : : &#x3a   (same)
+ *   - named refs    :  	  

+ *       Named refs are CASE-SENSITIVE and REQUIRE the trailing ';', exactly
+ *       like a browser (so `:` and `&colon` are not decoded).
+ *       	 / 
 matter because the URL parser strips tab/newline,
+ *       so `java	script:` is still a javascript: URL.
+ *
+ * It does NOT decode & (single pass only), so double-encoded text such as
+ * "<script>" stays literal — a browser renders that as text.
+ *
+ * All quantifiers are bounded; no ReDoS risk.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+const NAMED = Object.freeze({
+  colon: ':',
+  Tab: '\t',
+  NewLine: '\n',
+});
+
+const ENTITY_RE =
+  /&(?:#[xX]0*([0-9a-fA-F]{1,6});?|#0*([0-9]{1,7});?|([a-zA-Z][a-zA-Z0-9]{1,15});)/g;
+
+function decodeEntities(input) {
+  if (input.indexOf('&') === -1) return input;
+
+  return input.replace(ENTITY_RE, (match, hex, dec, name) => {
+    if (name !== undefined) {
+      return Object.prototype.hasOwnProperty.call(NAMED, name) ? NAMED[name] : match;
+    }
+    const cp = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);
+    if (!Number.isFinite(cp) || cp > 0x10ffff) return match;
+    return String.fromCodePoint(cp);
+  });
+}
+
 ;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/html.js
 /**
  * HTML context patterns.
@@ -4062,7 +4114,8 @@ const XML_PATTERNS = [
   {
     id: 'xml-namespace-confusion',
     description: 'xmlns: attribute injection — can redefine namespaces to confuse parsers',
-    pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    // pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    pattern: /\bxmlns(?::\w{1,40})?\s*=/i,
   },
   {
     id: 'xml-comment-injection',
@@ -4581,6 +4634,11 @@ const LOG_PATTERNS = [
 
 
 
+// Markup contexts are also matched against an entity-decoded copy of the input,
+// because browsers decode HTML character references before interpreting a URL
+// scheme (e.g. javascript:… is a javascript: URL).
+
+
 // ─── VALID_CONTEXTS convenience re-export ─────────────────────────────────
 // Importing this pulls in ALL contexts. Use it only when you need all of them
 // (e.g. for validation UI, tooling, or exhaustive audits).
@@ -4603,6 +4661,12 @@ const LOG_PATTERNS = [
 html.label       = 'HTML';
 xml.label        = 'XML';
 svg.label        = 'SVG';
+
+// Markup contexts: also test an entity-decoded copy (see util/decode-entities.js).
+// Non-markup contexts (SQL, SHELL, LOG, …) are matched byte-for-byte as supplied.
+html.decodeEntities = true;
+xml.decodeEntities  = true;
+svg.decodeEntities  = true;
 sql.label        = 'SQL';
 sql_strict.label = 'SQL-STRICT';
 shell.label      = 'SHELL';
@@ -4697,6 +4761,20 @@ function normalise(context) {
   return { lists: [context], regex: null };
 }
 
+/**
+ * For markup contexts, return an entity-decoded copy of `value` to test
+ * alongside the raw input, or null when there is nothing extra to test.
+ *
+ * @param {string} value
+ * @param {Rule[]} list
+ * @returns {string|null}
+ */
+function decodedCopy(value, list) {
+  if (!list.decodeEntities) return null;
+  const decoded = decodeEntities(value);
+  return decoded === value ? null : decoded;
+}
+
 /**
  * Test value against a single PatternList. Returns the first MatchResult or null.
  *
@@ -4706,8 +4784,9 @@ function normalise(context) {
  */
 function matchList(value, list) {
   const label = list.label ?? 'CUSTOM';
+  const decoded = decodedCopy(value, list);
   for (const rule of list) {
-    if (rule.pattern.test(value)) {
+    if (rule.pattern.test(value) || (decoded !== null && rule.pattern.test(decoded))) {
       return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern };
     }
   }
@@ -4805,8 +4884,9 @@ function allUnsafe(value, context) {
 
   for (const list of lists) {
     const label = list.label ?? 'CUSTOM';
+    const decoded = decodedCopy(value, list);
     for (const rule of list) {
-      if (rule.pattern.test(value)) {
+      if (rule.pattern.test(value) || (decoded !== null && rule.pattern.test(decoded))) {
         results.push({ context: label, id: rule.id, description: rule.description, pattern: rule.pattern });
       }
     }
@@ -5104,7 +5184,15 @@ function buildAttributesMap(attrStr, jPath, tagName, force = false) {
   }
 }
 const parseXml = function (xmlData) {
-  xmlData = xmlData.replace(/\r\n?/g, "\n"); //TODO: remove this line
+  const options = this.options;
+  const crlfPositions = options.captureMetaData ? [] : undefined;
+  xmlData = xmlData.replace(/\r\n?/g, options.captureMetaData ? (newline, index) => {
+    if (newline.length === 2) {
+      // Store the position after earlier CRLF pairs have been normalized.
+      crlfPositions.push(index - crlfPositions.length);
+    }
+    return "\n";
+  } : "\n");
   const xmlObj = new XmlNode('!xml');
   let currentNode = xmlObj;
   let textData = "";
@@ -5117,7 +5205,6 @@ const parseXml = function (xmlData) {
   this.entityExpansionCount = 0;
   this.currentExpandedLength = 0;
   this.doctypefound = false;
-  const options = this.options;
   const docTypeReader = new DocTypeReader(options.processEntities);
   const xmlLen = xmlData.length;
   for (let i = 0; i < xmlLen; i++) {//for each char in XML data
@@ -5161,7 +5248,7 @@ const parseXml = function (xmlData) {
         currentNode = this.tagsNodeStack.pop() || xmlObj;//avoid recursion, set the parent tag scope
 
         if (options.captureMetaData && currentNode) {
-          currentNode.addEndIndex(closeIndex + 1);
+          currentNode.addEndIndex(getOriginalIndex(closeIndex + 1, crlfPositions));
         }
         textData = "";
         i = closeIndex;
@@ -5187,11 +5274,12 @@ const parseXml = function (xmlData) {
           if (tagData.tagName !== tagData.tagExp && tagData.attrExpPresent && options.ignoreAttributes !== true) {
             childNode[":@"] = attsMap
           }
-          this.addChild(currentNode, childNode, this.readonlyMatcher, i);
+          const startIndex = options.captureMetaData ? getOriginalIndex(i, crlfPositions) : i;
+          this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
           if (options.captureMetaData) {
             // closeIndex points at '?' of the closing '?>'
-            currentNode.addEndIndex(tagData.closeIndex + 2);
+            currentNode.addEndIndex(getOriginalIndex(tagData.closeIndex + 2, crlfPositions));
           }
         }
 
@@ -5323,7 +5411,7 @@ const parseXml = function (xmlData) {
           this.isCurrentNodeStopNode = this.isItStopNode();
         }
 
-        const startIndex = i;
+        const startIndex = options.captureMetaData ? getOriginalIndex(i, crlfPositions) : i;
         if (this.isCurrentNodeStopNode) {
           let tagContent = "";
 
@@ -5359,7 +5447,7 @@ const parseXml = function (xmlData) {
           this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
           if (options.captureMetaData) {
-            currentNode.addEndIndex(i + 1);
+            currentNode.addEndIndex(getOriginalIndex(i + 1, crlfPositions));
           }
         } else {
           //selfClosing tag
@@ -5373,7 +5461,7 @@ const parseXml = function (xmlData) {
             this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
             if (options.captureMetaData) {
-              currentNode.addEndIndex(closeIndex + 1);
+              currentNode.addEndIndex(getOriginalIndex(closeIndex + 1, crlfPositions));
             }
             this.matcher.pop(); // Pop self-closing tag
             this.isCurrentNodeStopNode = false; // Reset flag
@@ -5386,7 +5474,7 @@ const parseXml = function (xmlData) {
             this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
 
             if (options.captureMetaData) {
-              currentNode.addEndIndex(result.closeIndex + 1);
+              currentNode.addEndIndex(getOriginalIndex(result.closeIndex + 1, crlfPositions));
             }
             this.matcher.pop(); // Pop unpaired tag
             this.isCurrentNodeStopNode = false; // Reset flag
@@ -5419,6 +5507,17 @@ const parseXml = function (xmlData) {
   return xmlObj.child;
 }
 
+function getOriginalIndex(index, crlfPositions) {
+  let low = 0;
+  let high = crlfPositions.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if (crlfPositions[middle] < index) low = middle + 1;
+    else high = middle;
+  }
+  return index + low;
+}
+
 function addChild(currentNode, childNode, matcher, startIndex) {
   // unset startIndex if not requested
   if (!this.options.captureMetaData) startIndex = undefined;
@@ -5597,6 +5696,8 @@ function readStopNodeData(xmlData, tagName, i) {
   const startIndex = i;
   // Starting at 1 since we already have an open tag
   let openTagCount = 1;
+  let lenient = false; // set once a quote-aware tag scan fails
+  let nextGt = -1; // cached index of the next '>'
 
   const xmllen = xmlData.length;
   for (; i < xmllen; i++) {
@@ -5628,14 +5729,29 @@ function readStopNodeData(xmlData, tagName, i) {
         const closeIndex = findClosingIndex(xmlData, "]]>", i, "StopNode is not closed.") - 2;
         i = closeIndex;
       } else {
-        const tagData = readTagExp(xmlData, i, false)
+        const tagData = lenient ? undefined : readTagExp(xmlData, i, false);
 
         if (tagData) {
-          const openTagName = tagData && tagData.tagName;
+          const openTagName = tagData.tagName;
           if (openTagName === tagName && tagData.tagExp[tagData.tagExp.length - 1] !== "/") {
             openTagCount++;
           }
           i = tagData.closeIndex;
+        } else {
+          // no closing '>'. use lenient approach to find '<' instead of readTagExp, to avoid repeated rescans.
+          lenient = true;
+          if (nextGt < i) {
+            nextGt = xmlData.indexOf(">", i);
+            if (nextGt === -1) return; // no '>' left, so no closing tag can follow
+          }
+          const nextLt = xmlData.indexOf("<", i + 1);
+          if (nextLt === -1 || nextLt > nextGt) { // looks like a real tag
+            const exp = xmlData.substring(i + 1, nextGt);
+            const sep = exp.search(/\s/);
+            const name = sep === -1 ? exp : exp.substring(0, sep);
+            if (name === tagName && exp[exp.length - 1] !== "/") openTagCount++;
+            i = nextGt;
+          } // else: treat this '<' as plain text
         }
       }
     }

dist/setup/index.js

@@ -31545,6 +31545,8 @@ const CANONICAL_ARCHITECTURES = [
     'riscv64',
     's390x'
 ];
+// Used in environment-variable names and tool-cache paths.
+const ARCHITECTURE_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 const PLATFORM_ALIASES = {
     darwin: 'macos',
     linux: 'linux',
@@ -31554,10 +31556,17 @@ const PLATFORM_ALIASES = {
 function normalizeArchitecture(architecture) {
     const trimmedArchitecture = architecture.trim();
     const normalizedArchitecture = trimmedArchitecture.toLowerCase();
-    return (ARCHITECTURE_ALIASES[normalizedArchitecture] ??
+    const alias = Object.prototype.hasOwnProperty.call(ARCHITECTURE_ALIASES, normalizedArchitecture)
+        ? ARCHITECTURE_ALIASES[normalizedArchitecture]
+        : undefined;
+    const result = alias ??
         (CANONICAL_ARCHITECTURES.includes(normalizedArchitecture)
             ? normalizedArchitecture
-            : trimmedArchitecture));
+            : trimmedArchitecture);
+    if (!ARCHITECTURE_TOKEN.test(result)) {
+        throw new Error(`Unsupported architecture value: ${JSON.stringify(architecture)}`);
+    }
+    return result;
 }
 function normalizePlatform(platform) {
     return PLATFORM_ALIASES[platform];
@@ -36681,7 +36690,7 @@ async function getJavaDistribution(distributionName, installerOptions, jdkFile)
             return new LibericaNikDistributions(normalizedInstallerOptions);
         }
         case package_types/* JavaDistribution */.zS.Microsoft: {
-            const { MicrosoftDistributions } = await Promise.all(/* import() */[__nccwpck_require__.e(242), __nccwpck_require__.e(220)]).then(__nccwpck_require__.bind(__nccwpck_require__, 3220));
+            const { MicrosoftDistributions } = await Promise.all(/* import() */[__nccwpck_require__.e(242), __nccwpck_require__.e(772)]).then(__nccwpck_require__.bind(__nccwpck_require__, 4772));
             return new MicrosoftDistributions(normalizedInstallerOptions);
         }
         case package_types/* JavaDistribution */.zS.Semeru: {
@@ -36738,7 +36747,7 @@ async function getJavaDistribution(distributionName, installerOptions, jdkFile)
 
 
 function configureProblemMatcher(matcherPath) {
-    const problemMatcherEnabled = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_PROBLEM_MATCHER */.Wt, true);
+    const problemMatcherEnabled = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_PROBLEM_MATCHER */.Wt, false);
     if (!problemMatcherEnabled) {
         setup_java_core/* debug */.Yz('Java problem matcher is disabled');
         return;

docs/advanced-usage.md

@@ -659,9 +659,10 @@ runner, distribution, JDK size, network, and cache eviction pressure.
 
 The `architecture` input is normalized before setup-java checks the tool cache
 or contacts a vendor. `amd64`, `ia32`, `arm`, and `arm64` are accepted aliases
-for `x64`, `x86`, `armv7`, and `aarch64`. The table lists the combinations
+for `x64`, `x86`, `armv7`, and `aarch64`. Every value must be one token that
-setup-java validates up front; an individual Java patch release can still be
+starts with a letter or digit and contains only letters, digits, `_`, or `-`.
-absent from a vendor catalog.
+The table lists the combinations setup-java validates up front; an individual
+Java patch release can still be absent from a vendor catalog.
 
 | Distribution | Linux | macOS | Windows | Other / version restrictions |
 | --- | --- | --- | --- | --- |
@@ -1309,7 +1310,7 @@ jobs:
 
 ## Java problem matcher (compiler annotations)
 
-By default, `setup-java` registers a [problem matcher](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) for Java after installing the JDK. It scans the log output of subsequent steps and turns Java diagnostics into GitHub [annotations](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-a-warning-message) that appear in the run summary and inline on the affected files. It matches three kinds of lines:
+Java [problem matcher](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) registration is disabled by default. Set `problem-matcher: true` to have `setup-java` register the matcher after installing the JDK. When enabled, it scans the log output of subsequent steps and turns Java diagnostics into GitHub [annotations](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-a-warning-message) that appear in the run summary and inline on the affected files. It matches three kinds of lines:
 
 - Compiler errors and warnings, e.g. `App.java:12: error: cannot find symbol` (owner `javac`).
 - Maven compiler errors and warnings, e.g. `[ERROR] /path/App.java:[12,5] cannot find symbol` (owner `maven-javac`).
@@ -1317,9 +1318,9 @@ By default, `setup-java` registers a [problem matcher](https://github.com/action
 
 GitHub Actions limits problem matcher annotations to 10 of each severity per step and 50 annotations per job. Additional diagnostics remain available in the build log. Log grouping does not change these limits because every matched diagnostic still counts as an annotation.
 
-### Disabling the problem matcher
+### Enabling the problem matcher
 
-Set `problem-matcher` to `false` to prevent the matcher from being registered:
+Set `problem-matcher` to `true` to enable annotations, including in workflows that previously relied on default registration:
 
 ```yaml
 jobs:
@@ -1332,13 +1333,13 @@ jobs:
         with:
           distribution: '<distribution>'
           java-version: '21'
-          problem-matcher: false
+          problem-matcher: true
 
       - name: Build with Maven
         run: mvn package --file pom.xml
 ```
 
-Disabling the matcher only stops annotations from being created. Compiler output remains in the log, and compilation errors still fail the build step.
+Omit `problem-matcher` or set it to `false` to prevent this action invocation from registering the matcher. Compiler output remains in the log, and compilation errors still fail the build step. This does not unregister matchers already registered by other steps or earlier action invocations.
 
 ## Publishing using Gradle
 ```yaml
@@ -1651,4 +1652,4 @@ Notes and caveats:
 - On **self-hosted runners**, importing into a tool-cache JDK persists for as long as that cached version remains on the runner; if you want it to survive JDK reinstalls, pre-seed the CA into your runner image or re-run the import step each time.
 - Prefer giving the certificate a stable, descriptive `-alias` so re-runs are idempotent (re-importing the same alias will fail; add `keytool -delete -alias internal-ca ...` first if you re-run within a long-lived runner).
 
-This documents the post-install workflow; there is no dedicated action input for supplying a custom `cacerts` file.
+This documents the post-install workflow; there is no dedicated action input for supplying a custom `cacerts` file.

package-lock.json

@@ -16,7 +16,7 @@
         "@actions/http-client": "^4.0.1",
         "@actions/io": "^3.0.2",
         "@actions/tool-cache": "^4.0.0",
-        "fast-xml-parser": "^5.11.2",
+        "fast-xml-parser": "^5.12.0",
         "semver": "^7.8.5"
       },
       "devDependencies": {
@@ -3903,9 +3903,9 @@
       "license": "MIT"
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.3.0",
+      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.1.tgz",
-      "integrity": "sha512-F74cZEdCvuw9P41GAC3rod4X04jjWGM1JPEv/GWSqFTWLsdyMSBMBMlm9Hk3GLBgLBbdBNY8yee0pQh2RBVESQ==",
+      "integrity": "sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==",
       "funding": [
         {
           "type": "github",
@@ -3919,9 +3919,9 @@
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.11.2",
+      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.11.2.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.12.0.tgz",
-      "integrity": "sha512-R9iDuNrQYeQut46cn2r2wHKn4HYzVDvDm5J1wW+koZewykv0yuO2HChTYeZtrULyHIDM9cj9TUXloCsueCQUog==",
+      "integrity": "sha512-/pXxRBtwxY9w8z7YbgsvIPPcPvFDsTbIkWwTQJhzNJPokj+TbN6ftmcv4j/pEQDvOCNnKGDzuk5Bo2oogIOiFg==",
       "funding": [
         {
           "type": "github",
@@ -3930,11 +3930,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@nodable/entities": "^3.0.1",
+        "@nodable/entities": "^3.1.0",
-        "fast-xml-builder": "^1.2.0",
+        "fast-xml-builder": "^1.3.1",
-        "is-unsafe": "^2.0.0",
+        "is-unsafe": "^2.0.3",
         "path-expression-matcher": "^1.6.2",
-        "strnum": "^2.4.2",
+        "strnum": "^2.5.1",
         "xml-naming": "^0.3.0"
       },
       "bin": {
@@ -4368,9 +4368,9 @@
       }
     },
     "node_modules/is-unsafe": {
-      "version": "2.0.0",
+      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.3.tgz",
-      "integrity": "sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA==",
+      "integrity": "sha512-ZBllczCCO267vgdFb6Tq3pv+LhHaCiGMdr+ZsuL+OopruAg7S+3ZDs1vD0RPC0uSrkjzbraxaGjtX1YBxjPeFQ==",
       "funding": [
         {
           "type": "github",
@@ -5951,9 +5951,9 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.4.2",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.2.tgz",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.5.1.tgz",
-      "integrity": "sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==",
+      "integrity": "sha512-UM4nTLWzQiDBseVxUGxN0wJzIk0UU89Qi7pKXz9qISo+lhviJikTuikBsK/oFRlpvYHvSdz0TVoLyQ+sEpYwxA==",
       "funding": [
         {
           "type": "github",

package.json

@@ -49,7 +49,7 @@
     "@actions/http-client": "^4.0.1",
     "@actions/io": "^3.0.2",
     "@actions/tool-cache": "^4.0.0",
-    "fast-xml-parser": "^5.11.2",
+    "fast-xml-parser": "^5.12.0",
     "semver": "^7.8.5"
   },
   "devDependencies": {

src/distributions/jetbrains/installer.ts

@@ -16,8 +16,8 @@ import {
   extractJdkFile,
   getGitHubToken,
   getNextPageUrlFromLinkHeader,
-  isVersionSatisfies,
   MAX_PAGINATION_PAGES,
+  normalizeJavaVersionToSemver,
   validatePaginationUrl
 } from '../../util.js';
 import {OutgoingHttpHeaders} from 'http';
@@ -38,7 +38,9 @@ export class JetBrainsDistribution extends JavaBase {
     const versionsRaw = await this.getAvailableVersions();
 
     const versions = versionsRaw.map(v => {
-      const formattedVersion = `${v.semver}+${v.build}`;
+      const formattedVersion = normalizeJavaVersionToSemver(
+        `${v.semver}+${v.build}`
+      );
 
       return {
         version: formattedVersion,
@@ -47,9 +49,9 @@ export class JetBrainsDistribution extends JavaBase {
     });
 
     const satisfiedVersions = versions
-      .filter(item => isVersionSatisfies(range, item.version))
+      .filter(item => this.isVersionSatisfied(range, item.version))
       .sort((a, b) => {
-        return -semver.compareBuild(a.version, b.version);
+        return -this.compareVersions(a.version, b.version);
       });
 
     const resolvedFullVersion =
@@ -74,6 +76,61 @@ export class JetBrainsDistribution extends JavaBase {
     };
   }
 
+  protected normalizeVersion(version: string) {
+    const normalized = super.normalizeVersion(version);
+    if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+      // A patch-only request must match any JBR build of that patch.
+      normalized.version = version.replace(/-ea$/, '');
+    }
+    return normalized;
+  }
+
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+    if (patchRequest) {
+      const candidate = semver.parse(version);
+      return (
+        candidate !== null &&
+        semver.eq(patchRequest[1], candidate) &&
+        (candidate.build.slice(0, -2).join('.') || '0') ===
+          patchRequest[2].slice(1)
+      );
+    }
+    return super.isVersionSatisfied(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    const mainComparison = semver.compare(a, b);
+    if (mainComparison !== 0) {
+      return mainComparison;
+    }
+
+    // JBR builds have two components (one in older releases). Any preceding
+    // metadata components are Java patch fields and take priority over builds.
+    const first = new semver.SemVer(a).build;
+    const second = new semver.SemVer(b).build;
+    const firstPatch = first.slice(0, -2);
+    const secondPatch = second.slice(0, -2);
+    for (
+      let index = 0;
+      index < Math.max(firstPatch.length, secondPatch.length);
+      index++
+    ) {
+      const patchComparison = semver.compareIdentifiers(
+        firstPatch[index] ?? '0',
+        secondPatch[index] ?? '0'
+      );
+      if (patchComparison !== 0) {
+        return patchComparison;
+      }
+    }
+
+    return semver.compareBuild(
+      first.length ? `0.0.0+${first.slice(-2).join('.')}` : '0.0.0',
+      second.length ? `0.0.0+${second.slice(-2).join('.')}` : '0.0.0'
+    );
+  }
+
   protected async downloadTool(
     javaRelease: JavaDownloadRelease
   ): Promise<JavaInstallerResults> {

src/distributions/microsoft/installer.ts

@@ -8,10 +8,12 @@ import {
   cacheJdkDir,
   extractJdkFile,
   getDownloadArchiveExtension,
+  normalizeJavaVersionToSemver,
   renameWinArchive
 } from '../../util.js';
 import * as gpg from '../../gpg.js';
 import {MICROSOFT_PUBLIC_KEY} from './microsoft-key.js';
+import bundledVersions from './microsoft-openjdk-versions.json' with {type: 'json'};
 import {SIGNATURE_VERIFICATION_FAILURE_HELP} from '../../constants.js';
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
@@ -108,7 +110,20 @@ export class MicrosoftDistributions extends JavaBase {
       throw new Error('Could not load manifest for Microsoft Build of OpenJDK');
     }
 
-    const foundRelease = await tc.findFromManifest(range, true, manifest, arch);
+    const findMatchingRelease = async (releases: tc.IToolRelease[]) => {
+      const matchingReleases = releases
+        .map(release => ({
+          ...release,
+          version: normalizeJavaVersionToSemver(release.version)
+        }))
+        .filter(release => this.isVersionSatisfied(range, release.version));
+
+      return tc.findFromManifest(range, true, matchingReleases, arch);
+    };
+
+    const foundRelease =
+      (await findMatchingRelease(manifest)) ??
+      (await findMatchingRelease(bundledVersions));
 
     if (!foundRelease) {
       const availableVersionStrings = manifest.map(item => item.version);

src/distributions/microsoft/microsoft-openjdk-versions.json

@@ -1,4 +1,47 @@
 [
+  {
+    "version": "25.0.5+0.2",
+    "stable": true,
+    "release_url": "https://aka.ms/download-jdk",
+    "files": [
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-macos-x64.tar.gz",
+        "arch": "x64",
+        "platform": "darwin",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-macos-x64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz",
+        "arch": "x64",
+        "platform": "linux",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-windows-x64.zip",
+        "arch": "x64",
+        "platform": "win32",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-windows-x64.zip"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-macos-aarch64.tar.gz",
+        "arch": "aarch64",
+        "platform": "darwin",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-macos-aarch64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-linux-aarch64.tar.gz",
+        "arch": "aarch64",
+        "platform": "linux",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-aarch64.tar.gz"
+      },
+      {
+        "filename": "microsoft-jdk-25.0.5.0.2-windows-aarch64.zip",
+        "arch": "aarch64",
+        "platform": "win32",
+        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-windows-aarch64.zip"
+      }
+    ]
+  },
   {
     "version": "25.0.3",
     "stable": true,

src/distributions/platform-types.ts

@@ -192,6 +192,9 @@ const CANONICAL_ARCHITECTURES: readonly JavaArchitecture[] = [
   's390x'
 ];
 
+// Used in environment-variable names and tool-cache paths.
+const ARCHITECTURE_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+
 const PLATFORM_ALIASES: Readonly<
   Partial<Record<NodeJS.Platform, JavaPlatform>>
 > = {
@@ -204,14 +207,27 @@ const PLATFORM_ALIASES: Readonly<
 export function normalizeArchitecture(architecture: string): string {
   const trimmedArchitecture = architecture.trim();
   const normalizedArchitecture = trimmedArchitecture.toLowerCase();
-  return (
+  const alias = Object.prototype.hasOwnProperty.call(
-    ARCHITECTURE_ALIASES[normalizedArchitecture] ??
+    ARCHITECTURE_ALIASES,
+    normalizedArchitecture
+  )
+    ? ARCHITECTURE_ALIASES[normalizedArchitecture]
+    : undefined;
+  const result =
+    alias ??
     (CANONICAL_ARCHITECTURES.includes(
       normalizedArchitecture as JavaArchitecture
     )
       ? normalizedArchitecture
-      : trimmedArchitecture)
+      : trimmedArchitecture);
-  );
+
+  if (!ARCHITECTURE_TOKEN.test(result)) {
+    throw new Error(
+      `Unsupported architecture value: ${JSON.stringify(architecture)}`
+    );
+  }
+
+  return result;
 }
 
 export function normalizePlatform(

src/problem-matcher.ts

@@ -3,7 +3,7 @@ import {INPUT_PROBLEM_MATCHER} from './constants.js';
 import {getBooleanInput} from './util.js';
 
 export function configureProblemMatcher(matcherPath: string): void {
-  const problemMatcherEnabled = getBooleanInput(INPUT_PROBLEM_MATCHER, true);
+  const problemMatcherEnabled = getBooleanInput(INPUT_PROBLEM_MATCHER, false);
 
   if (!problemMatcherEnabled) {
     core.debug('Java problem matcher is disabled');