[Renovate] Update actions/setup-java action to v6 by appsec-renovate-bot[bot] · Pull Request #327 · badoo/MVIKotlin

appsec-renovate-bot · 2026-09-01T06:07:02Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-java	action	major	`v1` → `v6`

Release Notes

actions/setup-java (actions/setup-java)

`v6.0.0`

Compare Source

What's Changed

dist: Migrate from Zulu Discovery API to Azul Metadata API by @jameswald in #1010
feat: add .mvn/extensions.xml to Maven cache key pattern by @brunoborges with @Copilot in #1041
Migrate to ESM and upgrade dependencies by @priyagupta108 in #1078
Map Zulu x86 architecture to i686 for Azul Metadata API by @brunoborges in #1079
Rename jdkFile input to jdk-file with deprecated alias by @brunoborges in #1083
Infer distribution from asdf .tool-versions vendor prefix by @brunoborges in #1084
Add Maven compiler problem matcher for javac diagnostics by @brunoborges in #1086
feat: expose cache-primary-key output (#597) by @brunoborges in #1088
docs: clarify V6 ESM migration is not a user-facing breaking change by @brunoborges in #1090
Support multi-field Java versions like 18.0.1.1 by @brunoborges in #1092
docs: document seeding the Maven cache for plugin dependencies by @brunoborges in #1094
docs: clarify Maven cache paths and key hash inputs by @brunoborges in #1096
Support pinning java-version as "latest" by @brunoborges in #1093
chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @dependabot[bot] in #1101
chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @dependabot[bot] in #1103
chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in #1105
chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #1106
chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 by @dependabot[bot] in #1104
dist: Cover Tencent Kona JDK 25 by @johnshajiang in #1108
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in #1102
Preserve Maven toolchains across repeated setup-java runs (#1099) by @brunoborges in #1111
dist: Support Liberica NIK (#878) by @asm0dey in #1112
Fix template injection (zizmor alert #118) in e2e-versions.yml by @brunoborges with @Copilot in #1114
Fix template injection in e2e-versions.yml (zizmor alert #122) by @brunoborges with @Copilot in #1120
Disable persisted checkout credentials in e2e workflow by @brunoborges with @Copilot in #1115
feat: Update recommended configuration for GPG signing by @wetneb in #608
Cache Maven and Gradle wrapper distributions separately from the dependency cache by @brunoborges in #1097
Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @brunoborges in #1124
Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @brunoborges in #1123
Extract repeated directory-check assertions into check-dir.sh helper by @brunoborges in #1127
Consolidate duplicate jobs in e2e-versions workflow by @brunoborges in #1125
Use YAML anchors to reduce boilerplate in e2e-versions workflow by @brunoborges in #1126
Updated msft json for now by @jmjaffe37 in #1129
Document missing action inputs in README by @brunoborges in #1130
chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in #1128
Add an option to disable Java problem matchers by @brunoborges in #1133
docs: update setup-java examples by @HarithaVattikuti in #1131
Clarify credential environment variable inputs by @brunoborges in #1134
chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @dependabot[bot] in #1135
chore(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #1143
chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @dependabot[bot] in #1142
chore(deps-dev): bump @typescript-eslint/parser from 8.64.0 to 8.65.0 by @dependabot[bot] in #1138
chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @dependabot[bot] in #1136
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in #1137
chore(deps): fix npm audited vulnerabilities by @mhoffrog in #1140
Fix formatting issues in README.md by @brunoborges in #1144
Remediate npm audit findings and rebuild distributions by @brunoborges with @Copilot in #1145
Set GRAALVM_HOME for GraalVM distributions by @brunoborges with @Copilot in #1146
Add force-download option for reproducible JDK builds by @brunoborges with @Copilot in #1148
Add OpenJDK distribution by @brunoborges with @Copilot in #1147
Support Temurin JDKs with JMOD files by @brunoborges with @Copilot in #1149
Document Java package compatibility by distribution by @brunoborges in #1152
Fix caching when wrapper distributions are absent by @brunoborges in #1151
Reject invalid boolean input values by @brunoborges in #1160
Fail on mismatched Maven toolchain ID counts by @brunoborges in #1161
Consolidate JDK metadata retry handling by @brunoborges in #1162
Add direct setup orchestration tests by @brunoborges in #1163
Harden java-package validation across distributions by @brunoborges in #1165
Verify JDK downloads with vendor checksums by @brunoborges in #1167
Reduce change-time Java E2E matrix by @brunoborges in #1170
Add read-only mode for dependency caching by @brunoborges in #1169
Test Temurin 25 on hosted runners by @brunoborges in #1172
Restore dependency and wrapper caches concurrently by @brunoborges in #1174
Add dependency cache path overrides by @brunoborges in #1175
Centralize OS/architecture capability validation by @brunoborges in #1178
Optimize Temurin tool-cache fast path with lazy loading by @brunoborges in #1179
Optimize Maven configuration warm path by @brunoborges in #1182
Fix macOS e2e workflow assertions by @brunoborges in #1184
Remove legacy Adopt distributions in v6 by @brunoborges with @Copilot in #1185
chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #1190
Reimagine setup-java README by @brunoborges in #1192
Document deprecation of setup-java v1 through v4 by @brunoborges in #1198
Update setup-java README action from v6 to v5 by @brunoborges in #1199
Highlight major changes in setup-java v5 by @brunoborges in #1200
Highlight major changes in setup-java v6 by @brunoborges in #1203
chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 by @dependabot[bot] in #1202
Add conditional JDK caching by @brunoborges in #1201
docs: fix README and advanced usage inconsistencies with actual behavior by @brunoborges in #1204
Move the extracted JDK into the tool-cache instead of copying it by @brunoborges in #1206
docs: drop benchmark numbers from the JDK caching section by @brunoborges in #1205
docs: correct the mvn-toolchain-id default in README and action.yml by @brunoborges in #1207
Cache resolved JDK releases to remove the vendor API from warm jobs by @brunoborges in #1208
Report concrete versions for floating Oracle JDK downloads by @jdubois in #1213
Import Maven signing keys into an isolated GPG home by @jdubois in #1214
Reuse the tool cache for floating versions the resolution cache identified by @brunoborges in #1219
Fix JetBrains Runtime release pagination by @jdubois in #1218
Fix JDK resolution cache platform identity by @jdubois in #1210
fix: select musl JDK artifacts on Alpine for Dragonwell, Corretto, Zulu and Liberica by @brunoborges in #1220
Fix SapMachine early-access filtering by @jdubois in #1217
Fix JetBrains GitHub token resolution by @jdubois in #1224
Include gradle.properties in Gradle cache key by @jdubois in #1225
Handle early dependency cache failures during Java setup by @jdubois in #1226
Fix js-yaml audit vulnerability by @brunoborges in #1228
Fix failing GitHub Actions job for graalvm 24-ea by @brunoborges with @Copilot in #1227
Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date by @jmjaffe37 in #1236
chore(deps-dev): bump globals from 17.8.0 to 17.9.0 by @dependabot[bot] in #1233
chore(deps-dev): bump @types/semver from 7.7.1 to 7.8.0 by @dependabot[bot] in #1229
chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 by @dependabot[bot] in #1231
chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.65.0 to 8.67.0 by @dependabot[bot] in #1232
Test JDK 26 installation from SDKMAN by @brunoborges in #1238
Add support for multiple Maven servers by @brunoborges in #1239
Add Maven dependency-resolution repositories by @brunoborges in #1240
Add Red Hat Build of OpenJDK support by @brunoborges in #1241
Fix Oracle macOS E2E version check by @brunoborges in #1243
ci: constrain cache e2e job modes by @philip-gai in #1244
Expose contributing guide to GitHub by @brunoborges in #1245
Set default signature verification for supported distributions by @johnoliver in #1246
chore(deps): combine open Dependabot npm updates by @brunoborges in #1252
Prepare documentation for v6 release by @brunoborges in #1253

New Contributors

@jameswald made their first contribution in #1010
@asm0dey made their first contribution in #1112
@wetneb made their first contribution in #608
@philip-gai made their first contribution in #1128

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

`v5.7.0`

Compare Source

What's Changed

Fix npm audit failures on releases/v5 by @brunoborges in #1154
Backport #1151: Fix missing wrapper cache distributions by @brunoborges in #1153
Deprecate legacy Adopt distributions in v5 by @brunoborges in #1186

Full Changelog: actions/setup-java@v5.6.0...v5.7.0

`v5.6.0`

Compare Source

What's Changed

Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @brunoborges in #1087
feat: expose cache-primary-key output (#597) [v5 backport] by @brunoborges in #1089
dist: Cover Tencent Kona JDK 25 (#1108) [v5 backport] by @brunoborges in #1110
Backport #1111: Preserve Maven toolchains across repeated setup-java runs (#1099) by @brunoborges in #1113
Backport #1097/#1098 to v5: cache Maven and Gradle wrapper distributions separately by @brunoborges in #1122

Full Changelog: actions/setup-java@v5...v5.6.0

`v5.5.0`

Compare Source

What's Changed

chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by @brunoborges in #1061
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1069
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1068
Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #1067
Bump @typescript-eslint/parser from 8.61.1 to 8.62.0 by @dependabot[bot] in #1062
feat: Add verify-signature plumbing and Temurin+Microsoft verification support by @johnoliver in #1060
Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by @jmjaffe37 in #1070
Fix arm64 e2e workflow tests mislabeled as x64 by @brunoborges with @Copilot in #1073
feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by @brunoborges in #1053
feat: Disable interactiveMode in generated Maven settings.xml by @brunoborges with @Copilot in #1052
Bump prettier from 3.6.2 to 3.9.1 by @dependabot[bot] in #1066
chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by @dependabot[bot] in #1074
fix: Maven Toolchains grows unexpectedly by @Okeanos in #534
dist: Support Tencent Kona JDK by @johnshajiang in #672
feat: Add set-default option by @gsmet in #1017
docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by @brunoborges in #1075
feat: Add distribution detection support to .sdkmanrc file by @lukaszgyg in #975

New Contributors

@jmjaffe37 made their first contribution in #1070
@gsmet made their first contribution in #1017
@lukaszgyg made their first contribution in #975

Full Changelog: actions/setup-java@v5...v5.5.0

`v5.4.0`

Compare Source

What's Changed

Bump @typescript-eslint/parser from 8.48.0 to 8.61.1 by @dependabot[bot] in #1021
Fix codeql workflow permissions by @jsoref in #993
fix CodeQL permissions by @gdams in #1025
fix: reject non-semver candidate versions in isVersionSatisfies by @sproctor in #1009
Bump @actions/cache to 5.1.0, handle cache write denied by @jasongin in #1026
Add Maven Wrapper cache feature by @mahabaleshwars in #1027
Spelling by @jsoref in #713
add link to advanced configuration for JetBrains by @robstoll in #850
docs(action): fix missing required or default fields by @kranthipoturaju in #1007
feat: add microsoft openjdk 17.0.18 by @al-kau in #1002
Update README.md - use "alert syntax for Markdown" for notes by @mhoffrog in #924
Bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in #1033
Update contributor guide with emoji for clarity by @brunoborges in #1028
add javac problem matcher by @Trass3r in #562
Clarify README version syntax and migration guidance by @brunoborges with @Copilot in #1038
Update undici artifacts to 6.27.0 (license cache + dist) by @brunoborges in #1040
docs: enhance custom jdk file installation by @stephanabel in #996
Templates for new Java distributions by @panticmilos in #429
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1032
Bump @types/node from 25.9.3 to 26.0.0 by @dependabot[bot] in #1031
docs: replace non-existent HelloWorldApp references with java --version by @brunoborges with @Copilot in #1043
docs: add JavaFX Maven project configuration instructions by @brunoborges with @Copilot in #1044
docs: self-signed certificate / internal CA handling for GitHub Enterprise by @brunoborges in #1050
docs: document importing an internal CA into the installed JDK (cacerts) by @brunoborges in #1051
chore: Harden workflows: least-privilege permissions + zizmor integration by @brunoborges in #1039
dist: Add GraalVM Community distribution support by @brunoborges with @Copilot in #1042
docs: note jdkfile approach for Early Access / unreleased JDK builds by @brunoborges in #1058
dist: Apply Copilot review suggestions from PR #1042 (GraalVM Community) by @brunoborges in #1059

New Contributors

@jsoref made their first contribution in #993
@sproctor made their first contribution in #1009
@jasongin made their first contribution in #1026
@robstoll made their first contribution in #850
@kranthipoturaju made their first contribution in #1007
@al-kau made their first contribution in #1002
@mhoffrog made their first contribution in #924
@brunoborges made their first contribution in #1028
@Trass3r made their first contribution in #562
@stephanabel made their first contribution in #996

Full Changelog: actions/setup-java@v5...v5.4.0

`v5.3.0`

Compare Source

What's Changed

chore: update Java version to 25 in setup examples by @alaahong in #969
Bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in #984
Refactor error handling and improve test logging for installers by @chiranjib-swain in #989
chore: upgrade dependencies (@actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @Copilot in #999
Add Oracle JDK 17 licensing limitation note by @mahabaleshwars in #1001
Update readme for ubuntu sudo java_home behavior by @mahabaleshwars in #1013
temurin: add support for Alpine Linux by @gdams in #674
fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @gdams in #1015
Bump @typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @dependabot[bot] in #952
Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @dependabot[bot] in #881
Bump picomatch, @types/jest, jest, jest-circus and ts-jest by @dependabot[bot] in #1016
Bump @types/node from 24.1.0 to 25.9.3 by @dependabot[bot] in #950
Implement pagination with link headers for Adoptium based apis by @johnoliver in #1014
Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @johnoliver in #522
Bump @vercel/ncc from 0.38.1 to 0.44.0 by @dependabot[bot] in #1018

New Contributors

@alaahong made their first contribution in #969
@Copilot made their first contribution in #999
@johnoliver made their first contribution in #1014

Full Changelog: actions/setup-java@v5...v5.3.0

`v5.2.0`

Compare Source

What's Changed

Enhancement

Retry on HTTP 522 Connection timed out by @findepi in #964

Documentation Changes

Update gradle caching by @priya-kinthali in #972
Update checkout to v6 by @mahabaleshwars in #973

Dependency Updates

Upgrade @actions/cache to v5 by @salmanmkc in #968
Upgrade actions/checkout from 5 to 6 by @dependabot in #961

New Contributors

@findepi made their first contribution in #964

Full Changelog: actions/setup-java@v5...v5.2.0

`v5.1.0`

Compare Source

What's Changed

New Features

Add support for .sdkmanrc file in java-version-file parameter by @guicamest in #736
Add support for Microsoft OpenJDK 25 builds by @the-mod in #927

Bug Fixes & Improvements

Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File by @aparnajyothi-y in #767
Enhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by @priya-kinthali in #946
Update SapMachine URLs by @RealCLanger in #955
Add GitHub Token Support for GraalVM and Refactor Code by @mahabaleshwars in #849

Documentation changes

Update documentation to use checkout and Java v5 by @lmvysakh in #903
Clarify JAVA_HOME and PATH setup in README by @chiranjib-swain in #841

Dependency updates

Upgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by @dependabot in #873
Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot in #912

New Contributors

@lmvysakh made their first contribution in #903
@chiranjib-swain made their first contribution in #841
@the-mod made their first contribution in #927
@priya-kinthali made their first contribution in #946
@guicamest made their first contribution in #736

Full Changelog: actions/setup-java@v5...v5.1.0

`v5.0.0`

Compare Source

What's Changed

Breaking Changes

Upgrade to node 24 by @salmanmkc in #888

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Upgrades

Upgrade Publish Immutable Action by @HarithaVattikuti in #798
Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @dependabot[bot] in #730
Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in #833
Upgrade form-data to bring in fix for critical vulnerability by @gowridurgad in #887
Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in #896

Bug Fixes

Prevent default installation of JetBrains pre-releases by @priyagupta108 in #859
Improve Error Handling for Setup-Java Action to Help Debug Intermittent Failures by @gowridurgad in #848

New Contributors

@gowridurgad made their first contribution in #848
@salmanmkc made their first contribution in #888

Full Changelog: actions/setup-java@v4...v5.0.0

`v4.9.1`

Compare Source

Adds a deprecation warning for setup-java v4.

`v4.9.0`

Compare Source

What's Changed

Fix v4 dependency audit failures by @brunoborges in #1188
Deprecate legacy Adopt distributions in v4 by @brunoborges in #1187

Full Changelog: actions/setup-java@v4.8.0...v4.9.0

`v4.8.0`

Compare Source

What's Changed

License and Audit Fixes by @HarithaVattikuti in #960
Update SapMachine URLs by @RealCLanger in #965

Full Changelog: actions/setup-java@v4...v4.8.0

`v4.7.1`

Compare Source

What's Changed

Documentation changes

Add Documentation to Recommend Using GraalVM JDK 17 Version to 17.0.12 to Align with GFTC License Terms by @aparnajyothi-y in #704
Remove duplicated GraalVM section in documentation by @Marcono1234 in #716

Dependency updates:

Upgrade @action/cache from 4.0.0 to 4.0.2 by @aparnajyothi-y in #766
Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot in #744
Upgrade ts-jest from 29.1.2 to 29.2.5 by @dependabot in #743
Upgrade @action/cache to 4.0.3 by @aparnajyothi-y in #773

Full Changelog: actions/setup-java@v4...v4.7.1

`v4.7.0`

Compare Source

What's Changed

Configure Dependabot settings by @HarithaVattikuti in #722
README Update: Added a permissions section by @benwells in #723
Upgrade cache from version 3.2.4 to 4.0.0 by @aparnajyothi-y in #724
Upgrade @actions/http-client from 2.2.1 to 2.2.3 by @dependabot in #728
Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @dependabot in #727
Upgrade @types/jest from 29.5.12 to 29.5.14 by @dependabot in #729

New Contributors

@benwells made their first contribution in #723

Full Changelog: actions/setup-java@v4...v4.7.0

`v4.6.0`

Compare Source

What's Changed

Add-ons:

Add Support for JetBrains Runtime by @gmitch215 in #637

 - name: Checkout
   uses: actions/checkout@v4
 - name: Setup-java
   uses: actions/setup-java@v4
   with:
     distribution: ‘jetbrains’
     java-version: '21'

Bug fixes:

Fix Ubuntu-latest CI failures by @mahabaleshwars in #693

New Contributors

@gmitch215 made their first contribution in #637

Full Changelog: actions/setup-java@v4...v4.6.0

`v4.5.0`

Compare Source

What's Changed

Upgrade IA Publish by @Jcambass in #686

Bug fixes:

Improve archive extraction on windows runners without powershell core and Update micromatch dependency by @priyagupta108 in #689
Update workflows for GraalVM and Version Enhancements by @mahabaleshwars in #699
Refine isGhes logic by @jww3 in #697

New Contributors:

@priyagupta108 made their first contribution in #689
@jww3 made their first contribution in #697

Full Changelog: actions/setup-java@v4...v4.5.0

[`v4.4.0`](https:/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

[Renovate] Update actions/setup-java action to v6

6eae08b

Navigation Menu

Uh oh!

Uh oh!

[Renovate] Update actions/setup-java action to v6 - #327

[Renovate] Update actions/setup-java action to v6#327
appsec-renovate-bot[bot] wants to merge 1 commit into
masterfrom
renovate/actions-setup-java-6.x

appsec-renovate-bot Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

appsec-renovate-bot Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Enhancement

Documentation Changes

Dependency Updates

New Contributors

What's Changed

New Features

Bug Fixes & Improvements

Documentation changes

Dependency updates

New Contributors

What's Changed

Breaking Changes

Dependency Upgrades

Bug Fixes

New Contributors

What's Changed

What's Changed

What's Changed

Documentation changes

Dependency updates:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Bug fixes:

New Contributors:

[v4.4.0](https:/

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

appsec-renovate-bot Bot commented Sep 1, 2026 •

edited

Loading

[`v4.4.0`](https:/