chore(deps): Update GitHub Actions Setup and CI Tooling

[shuai-s-private-renovate-app]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-java	action	major	v5 → v6
jdx/mise-action	action	minor	v4.2.5 → v4.3.0

---

Release Notes

actions/setup-java (actions/setup-java)

v6.0.0

Compare Source

What's Changed

• dist: Migrate from Zulu Discovery API to Azul Metadata API by @​jameswald in #​1010
• feat: add .mvn/extensions.xml to Maven cache key pattern by @​brunoborges with @​Copilot in #​1041
• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1078
• Map Zulu x86 architecture to i686 for Azul Metadata API by @​brunoborges in #​1079
• Rename jdkFile input to jdk-file with deprecated alias by @​brunoborges in #​1083
• Infer distribution from asdf .tool-versions vendor prefix by @​brunoborges in #​1084
• Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1086
• feat: expose cache-primary-key output (#​597) by @​brunoborges in #​1088
• docs: clarify V6 ESM migration is not a user-facing breaking change by @​brunoborges in #​1090
• Support multi-field Java versions like 18.0.1.1 by @​brunoborges in #​1092
• docs: document seeding the Maven cache for plugin dependencies by @​brunoborges in #​1094
• docs: clarify Maven cache paths and key hash inputs by @​brunoborges in #​1096
• Support pinning java-version as "latest" by @​brunoborges in #​1093
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @​dependabot[bot] in #​1101
• chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @​dependabot[bot] in #​1103
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @​dependabot[bot] in #​1105
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1106
• chore(deps-dev): bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in #​1104
• dist: Cover Tencent Kona JDK 25 by @​johnshajiang in #​1108
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1102
• Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1111
• dist: Support Liberica NIK (#​878) by @​asm0dey in #​1112
• Fix template injection (zizmor alert #​118) in e2e-versions.yml by @​brunoborges with @​Copilot in #​1114
• Fix template injection in e2e-versions.yml (zizmor alert #​122) by @​brunoborges with @​Copilot in #​1120
• Disable persisted checkout credentials in e2e workflow by @​brunoborges with @​Copilot in #​1115
• feat: Update recommended configuration for GPG signing by @​wetneb in #​608
• Cache Maven and Gradle wrapper distributions separately from the dependency cache by @​brunoborges in #​1097
• Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @​brunoborges in #​1124
• Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @​brunoborges in #​1123
• Extract repeated directory-check assertions into check-dir.sh helper by @​brunoborges in #​1127
• Consolidate duplicate jobs in e2e-versions workflow by @​brunoborges in #​1125
• Use YAML anchors to reduce boilerplate in e2e-versions workflow by @​brunoborges in #​1126
• Updated msft json for now by @​jmjaffe37 in #​1129
• Document missing action inputs in README by @​brunoborges in #​1130
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​1128
• Add an option to disable Java problem matchers by @​brunoborges in #​1133
• docs: update setup-java examples by @​HarithaVattikuti in #​1131
• Clarify credential environment variable inputs by @​brunoborges in #​1134
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @​dependabot[bot] in #​1135
• chore(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​1143
• chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @​dependabot[bot] in #​1142
• chore(deps-dev): bump @​typescript-eslint/parser from 8.64.0 to 8.65.0 by @​dependabot[bot] in #​1138
• chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @​dependabot[bot] in #​1136
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1137
• chore(deps): fix npm audited vulnerabilities by @​mhoffrog in #​1140
• Fix formatting issues in README.md by @​brunoborges in #​1144
• Remediate npm audit findings and rebuild distributions by @​brunoborges with @​Copilot in #​1145
• Set GRAALVM_HOME for GraalVM distributions by @​brunoborges with @​Copilot in #​1146
• Add force-download option for reproducible JDK builds by @​brunoborges with @​Copilot in #​1148
• Add OpenJDK distribution by @​brunoborges with @​Copilot in #​1147
• Support Temurin JDKs with JMOD files by @​brunoborges with @​Copilot in #​1149
• Document Java package compatibility by distribution by @​brunoborges in #​1152
• Fix caching when wrapper distributions are absent by @​brunoborges in #​1151
• Reject invalid boolean input values by @​brunoborges in #​1160
• Fail on mismatched Maven toolchain ID counts by @​brunoborges in #​1161
• Consolidate JDK metadata retry handling by @​brunoborges in #​1162
• Add direct setup orchestration tests by @​brunoborges in #​1163
• Harden java-package validation across distributions by @​brunoborges in #​1165
• Verify JDK downloads with vendor checksums by @​brunoborges in #​1167
• Reduce change-time Java E2E matrix by @​brunoborges in #​1170
• Add read-only mode for dependency caching by @​brunoborges in #​1169
• Test Temurin 25 on hosted runners by @​brunoborges in #​1172
• Restore dependency and wrapper caches concurrently by @​brunoborges in #​1174
• Add dependency cache path overrides by @​brunoborges in #​1175
• Centralize OS/architecture capability validation by @​brunoborges in #​1178
• Optimize Temurin tool-cache fast path with lazy loading by @​brunoborges in #​1179
• Optimize Maven configuration warm path by @​brunoborges in #​1182
• Fix macOS e2e workflow assertions by @​brunoborges in #​1184
• Remove legacy Adopt distributions in v6 by @​brunoborges with @​Copilot in #​1185
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​1190
• Reimagine setup-java README by @​brunoborges in #​1192
• Document deprecation of setup-java v1 through v4 by @​brunoborges in #​1198
• Update setup-java README action from v6 to v5 by @​brunoborges in #​1199
• Highlight major changes in setup-java v5 by @​brunoborges in #​1200
• Highlight major changes in setup-java v6 by @​brunoborges in #​1203
• chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 by @​dependabot[bot] in #​1202
• Add conditional JDK caching by @​brunoborges in #​1201
• docs: fix README and advanced usage inconsistencies with actual behavior by @​brunoborges in #​1204
• Move the extracted JDK into the tool-cache instead of copying it by @​brunoborges in #​1206
• docs: drop benchmark numbers from the JDK caching section by @​brunoborges in #​1205
• docs: correct the mvn-toolchain-id default in README and action.yml by @​brunoborges in #​1207
• Cache resolved JDK releases to remove the vendor API from warm jobs by @​brunoborges in #​1208
• Report concrete versions for floating Oracle JDK downloads by @​jdubois in #​1213
• Import Maven signing keys into an isolated GPG home by @​jdubois in #​1214
• Reuse the tool cache for floating versions the resolution cache identified by @​brunoborges in #​1219
• Fix JetBrains Runtime release pagination by @​jdubois in #​1218
• Fix JDK resolution cache platform identity by @​jdubois in #​1210
• fix: select musl JDK artifacts on Alpine for Dragonwell, Corretto, Zulu and Liberica by @​brunoborges in #​1220
• Fix SapMachine early-access filtering by @​jdubois in #​1217
• Fix JetBrains GitHub token resolution by @​jdubois in #​1224
• Include gradle.properties in Gradle cache key by @​jdubois in #​1225
• Handle early dependency cache failures during Java setup by @​jdubois in #​1226
• Fix js-yaml audit vulnerability by @​brunoborges in #​1228
• Fix failing GitHub Actions job for graalvm 24-ea by @​brunoborges with @​Copilot in #​1227
• Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date by @​jmjaffe37 in #​1236
• chore(deps-dev): bump globals from 17.8.0 to 17.9.0 by @​dependabot[bot] in #​1233
• chore(deps-dev): bump @​types/semver from 7.7.1 to 7.8.0 by @​dependabot[bot] in #​1229
• chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 by @​dependabot[bot] in #​1231
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.65.0 to 8.67.0 by @​dependabot[bot] in #​1232
• Test JDK 26 installation from SDKMAN by @​brunoborges in #​1238
• Add support for multiple Maven servers by @​brunoborges in #​1239
• Add Maven dependency-resolution repositories by @​brunoborges in #​1240
• Add Red Hat Build of OpenJDK support by @​brunoborges in #​1241
• Fix Oracle macOS E2E version check by @​brunoborges in #​1243
• ci: constrain cache e2e job modes by @​philip-gai in #​1244
• Expose contributing guide to GitHub by @​brunoborges in #​1245
• Set default signature verification for supported distributions by @​johnoliver in #​1246
• chore(deps): combine open Dependabot npm updates by @​brunoborges in #​1252
• Prepare documentation for v6 release by @​brunoborges in #​1253

New Contributors

• @​jameswald made their first contribution in #​1010
• @​asm0dey made their first contribution in #​1112
• @​wetneb made their first contribution in #​608
• @​philip-gai made their first contribution in #​1128

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

v6

Compare Source

v5.7.0

Compare Source

What's Changed

• Fix npm audit failures on releases/v5 by @​brunoborges in #​1154
• Backport #​1151: Fix missing wrapper cache distributions by @​brunoborges in #​1153
• Deprecate legacy Adopt distributions in v5 by @​brunoborges in #​1186

Full Changelog: actions/setup-java@v5.6.0...v5.7.0

v5.6.0

Compare Source

What's Changed

• Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1087
• feat: expose cache-primary-key output (#​597) [v5 backport] by @​brunoborges in #​1089
• dist: Cover Tencent Kona JDK 25 (#​1108) [v5 backport] by @​brunoborges in #​1110
• Backport #​1111: Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1113
• Backport #​1097/#​1098 to v5: cache Maven and Gradle wrapper distributions separately by @​brunoborges in #​1122

Full Changelog: actions/setup-java@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

• chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by @​brunoborges in #​1061
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​1069
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1068
• Bump actions/setup-python from 5 to 6 by @​dependabot[bot] in #​1067
• Bump @​typescript-eslint/parser from 8.61.1 to 8.62.0 by @​dependabot[bot] in #​1062
• feat: Add verify-signature plumbing and Temurin+Microsoft verification support by @​johnoliver in #​1060
• Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by @​jmjaffe37 in #​1070
• Fix arm64 e2e workflow tests mislabeled as x64 by @​brunoborges with @​Copilot in #​1073
• feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by @​brunoborges in #​1053
• feat: Disable interactiveMode in generated Maven settings.xml by @​brunoborges with @​Copilot in #​1052
• Bump prettier from 3.6.2 to 3.9.1 by @​dependabot[bot] in #​1066
• chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by @​dependabot[bot] in #​1074
• fix: Maven Toolchains grows unexpectedly by @​Okeanos in #​534
• dist: Support Tencent Kona JDK by @​johnshajiang in #​672
• feat: Add set-default option by @​gsmet in #​1017
• docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by @​brunoborges in #​1075
• feat: Add distribution detection support to .sdkmanrc file by @​lukaszgyg in #​975

New Contributors

• @​jmjaffe37 made their first contribution in #​1070
• @​gsmet made their first contribution in #​1017
• @​lukaszgyg made their first contribution in #​975

Full Changelog: actions/setup-java@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

• Bump @​typescript-eslint/parser from 8.48.0 to 8.61.1 by @​dependabot[bot] in #​1021
• Fix codeql workflow permissions by @​jsoref in #​993
• fix CodeQL permissions by @​gdams in #​1025
• fix: reject non-semver candidate versions in isVersionSatisfies by @​sproctor in #​1009
• Bump @​actions/cache to 5.1.0, handle cache write denied by @​jasongin in #​1026
• Add Maven Wrapper cache feature by @​mahabaleshwars in #​1027
• Spelling by @​jsoref in #​713
• add link to advanced configuration for JetBrains by @​robstoll in #​850
• docs(action): fix missing required or default fields by @​kranthipoturaju in #​1007
• feat: add microsoft openjdk 17.0.18 by @​al-kau in #​1002
• Update README.md - use "alert syntax for Markdown" for notes by @​mhoffrog in #​924
• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​1033
• Update contributor guide with emoji for clarity by @​brunoborges in #​1028
• add javac problem matcher by @​Trass3r in #​562
• Clarify README version syntax and migration guidance by @​brunoborges with @​Copilot in #​1038
• Update undici artifacts to 6.27.0 (license cache + dist) by @​brunoborges in #​1040
• docs: enhance custom jdk file installation by @​stephanabel in #​996
• Templates for new Java distributions by @​panticmilos in #​429
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1032
• Bump @​types/node from 25.9.3 to 26.0.0 by @​dependabot[bot] in #​1031
• docs: replace non-existent HelloWorldApp references with java --version by @​brunoborges with @​Copilot in #​1043
• docs: add JavaFX Maven project configuration instructions by @​brunoborges with @​Copilot in #​1044
• docs: self-signed certificate / internal CA handling for GitHub Enterprise by @​brunoborges in #​1050
• docs: document importing an internal CA into the installed JDK (cacerts) by @​brunoborges in #​1051
• chore: Harden workflows: least-privilege permissions + zizmor integration by @​brunoborges in #​1039
• dist: Add GraalVM Community distribution support by @​brunoborges with @​Copilot in #​1042
• docs: note jdkfile approach for Early Access / unreleased JDK builds by @​brunoborges in #​1058
• dist: Apply Copilot review suggestions from PR #​1042 (GraalVM Community) by @​brunoborges in #​1059

New Contributors

• @​jsoref made their first contribution in #​993
• @​sproctor made their first contribution in #​1009
• @​jasongin made their first contribution in #​1026
• @​robstoll made their first contribution in #​850
• @​kranthipoturaju made their first contribution in #​1007
• @​al-kau made their first contribution in #​1002
• @​mhoffrog made their first contribution in #​924
• @​brunoborges made their first contribution in #​1028
• @​Trass3r made their first contribution in #​562
• @​stephanabel made their first contribution in #​996

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in #​969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in #​989
• chore: upgrade dependencies (@​actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @​Copilot in #​999
• Add Oracle JDK 17 licensing limitation note by @​mahabaleshwars in #​1001
• Update readme for ubuntu sudo java_home behavior by @​mahabaleshwars in #​1013
• temurin: add support for Alpine Linux by @​gdams in #​674
• fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @​gdams in #​1015
• Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @​dependabot[bot] in #​952
• Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot[bot] in #​881
• Bump picomatch, @​types/jest, jest, jest-circus and ts-jest by @​dependabot[bot] in #​1016
• Bump @​types/node from 24.1.0 to 25.9.3 by @​dependabot[bot] in #​950
• Implement pagination with link headers for Adoptium based apis by @​johnoliver in #​1014
• Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @​johnoliver in #​522
• Bump @​vercel/ncc from 0.38.1 to 0.44.0 by @​dependabot[bot] in #​1018

New Contributors

• @​alaahong made their first contribution in #​969
• @​Copilot made their first contribution in #​999
• @​johnoliver made their first contribution in #​1014

Full Changelog: actions/setup-java@v5...v5.3.0

v5.2.0

Compare Source

What's Changed

Enhancement

• Retry on HTTP 522 Connection timed out by @​findepi in #​964

Documentation Changes

• Update gradle caching by @​priya-kinthali in #​972
• Update checkout to v6 by @​mahabaleshwars in #​973

Dependency Updates

• Upgrade @​actions/cache to v5 by @​salmanmkc in #​968
• Upgrade actions/checkout from 5 to 6 by @​dependabot in #​961

New Contributors

• @​findepi made their first contribution in #​964

Full Changelog: actions/setup-java@v5...v5.2.0

v5.1.0

Compare Source

What's Changed

New Features

• Add support for .sdkmanrc file in java-version-file parameter by @​guicamest in #​736
• Add support for Microsoft OpenJDK 25 builds by @​the-mod in #​927

Bug Fixes & Improvements

• Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File by @​aparnajyothi-y in #​767
• Enhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by @​priya-kinthali in #​946
• Update SapMachine URLs by @​RealCLanger in #​955
• Add GitHub Token Support for GraalVM and Refactor Code by @​mahabaleshwars in #​849

Documentation changes

• Update documentation to use checkout and Java v5 by @​lmvysakh in #​903
• Clarify JAVA_HOME and PATH setup in README by @​chiranjib-swain in #​841

Dependency updates

• Upgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by @​dependabot in #​873
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot in #​912

New Contributors

• @​lmvysakh made their first contribution in #​903
• @​chiranjib-swain made their first contribution in #​841
• @​the-mod made their first contribution in #​927
• @​priya-kinthali made their first contribution in #​946
• @​guicamest made their first contribution in #​736

Full Changelog: actions/setup-java@v5...v5.1.0

jdx/mise-action (jdx/mise-action)

v4.3.0: : Install age-filtered mise releases

Compare Source

A small release that adds an opt-in way to hold back from installing brand-new mise releases.

Added

minimum_release_age input (#​604 by @​jdx)

When version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #​603).

- uses: jdx/mise-action@v4
  with:
    minimum_release_age: 7d

It accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.

Full Changelog: jdx/mise-action@v4.2.5...v4.3.0

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.