Update Undici to 6.29.1 (#1308)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/workflows/e2e-publishing.yml

@@ -174,3 +174,115 @@ jobs:
           if (-not (Test-Path $path)) {
             throw "settings.xml file is not found in expected location"
           }
+
+  test-maven-repositories:
+    name: Maven ${{ matrix.repositories }} repositories
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+        repositories: [dependencies, plugins, both]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Prepare Maven model inspection
+        run: |
+          $directory = Join-Path $env:RUNNER_TEMP "maven-repository-test"
+          New-Item -Path $directory -ItemType Directory -Force | Out-Null
+          $pomPath = Join-Path $directory "pom.xml"
+          $warmSettingsPath = Join-Path $directory "warm-settings.xml"
+          $cachePath = Join-Path $directory "repository"
+          $outputPath = Join-Path $directory "warm-effective-pom.xml"
+
+          # This project repository keeps the inspection plugin available offline
+          # after the generated settings disable inherited plugin Central.
+          @'
+          <project xmlns="http://maven.apache.org/POM/4.0.0">
+            <modelVersion>4.0.0</modelVersion>
+            <groupId>setup-java.test</groupId>
+            <artifactId>repository-settings</artifactId>
+            <version>1.0</version>
+            <pluginRepositories>
+              <pluginRepository>
+                <id>inspection</id>
+                <url>https://repo.maven.apache.org/maven2</url>
+              </pluginRepository>
+            </pluginRepositories>
+          </project>
+          '@ | Set-Content -Path $pomPath
+          '<settings />' | Set-Content -Path $warmSettingsPath
+
+          mvn --batch-mode --no-transfer-progress --settings $warmSettingsPath `
+            "-Dmaven.repo.local=$cachePath" --file $pomPath `
+            org.apache.maven.plugins:maven-help-plugin:3.5.1:effective-pom `
+            "-Doutput=$outputPath"
+          if ($LASTEXITCODE -ne 0) {
+            throw "Could not prepare the Maven Help Plugin"
+          }
+      - name: Configure dependency and plugin repositories
+        uses: ./
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+          settings-path: ${{ runner.temp }}/maven-repository-test/settings
+          mvn-server-credentials: |
+            private:PRIVATE_USERNAME:PRIVATE_TOKEN
+          mvn-repositories: ${{ matrix.repositories != 'plugins' && 'private:https://repo.example.invalid/maven:false' || '' }}
+          mvn-plugin-repositories: ${{ matrix.repositories != 'dependencies' && 'private:https://repo.example.invalid/maven:false' || '' }}
+          mvn-repositories-include-central: false
+      - name: Validate generated settings and effective Maven repositories
+        env:
+          REPOSITORY_CONFIGURATION: ${{ matrix.repositories }}
+        run: |
+          $directory = Join-Path $env:RUNNER_TEMP "maven-repository-test"
+          $settingsPath = Join-Path $directory "settings/settings.xml"
+          [xml]$settings = Get-Content -Path $settingsPath -Raw
+          $profiles = @($settings.settings.profiles.profile)
+          if ($profiles.Count -ne 1 -or $profiles[0].id -ne "setup-java-repositories") {
+            throw "Expected one repository profile"
+          }
+          $activeProfiles = @($settings.settings.activeProfiles.activeProfile)
+          if ($activeProfiles.Count -ne 1 -or $activeProfiles[0] -ne "setup-java-repositories") {
+            throw "Expected one active repository profile"
+          }
+          $server = $settings.settings.servers.server
+          if ($server.id -ne "private" -or $server.username -ne '${env.PRIVATE_USERNAME}' -or $server.password -ne '${env.PRIVATE_TOKEN}') {
+            throw "Repository credentials were not preserved"
+          }
+
+          function Assert-Repositories($repositories, $expectPrivate, $context) {
+            $central = @($repositories | Where-Object { $_.id -eq "central" })
+            if ($central.Count -ne 1 -or $central[0].releases.enabled -ne "false" -or $central[0].snapshots.enabled -ne "false") {
+              throw "$context did not disable inherited Maven Central"
+            }
+            $private = @($repositories | Where-Object { $_.id -eq "private" })
+            $expectedCount = if ($expectPrivate) { 1 } else { 0 }
+            if ($private.Count -ne $expectedCount) {
+              throw "$context has incorrect private repositories"
+            }
+            if ($expectPrivate -and ($private[0].url -ne "https://repo.example.invalid/maven" -or $private[0].snapshots.enabled -ne "false")) {
+              throw "$context has incorrect private repository settings"
+            }
+          }
+
+          $expectDependencies = $env:REPOSITORY_CONFIGURATION -ne "plugins"
+          $expectPlugins = $env:REPOSITORY_CONFIGURATION -ne "dependencies"
+          Assert-Repositories @($profiles[0].repositories.repository) $expectDependencies "Settings dependency repositories"
+          Assert-Repositories @($profiles[0].pluginRepositories.pluginRepository) $expectPlugins "Settings plugin repositories"
+
+          $pomPath = Join-Path $directory "pom.xml"
+          $cachePath = Join-Path $directory "repository"
+          $outputPath = Join-Path $directory "effective-pom.xml"
+          mvn --batch-mode --no-transfer-progress --offline --settings $settingsPath `
+            "-Dmaven.repo.local=$cachePath" --file $pomPath `
+            org.apache.maven.plugins:maven-help-plugin:3.5.1:effective-pom `
+            "-Doutput=$outputPath"
+          if ($LASTEXITCODE -ne 0) {
+            throw "Could not inspect the effective Maven model"
+          }
+          [xml]$effectivePom = Get-Content -Path $outputPath -Raw
+          Assert-Repositories @($effectivePom.project.repositories.repository) $expectDependencies "Effective dependency repositories"
+          Assert-Repositories @($effectivePom.project.pluginRepositories.pluginRepository) $expectPlugins "Effective plugin repositories"

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.29.0
+version: 6.29.1
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

README.md

@@ -170,8 +170,9 @@ steps:
 | `mvn-server-credentials` | Multiline Maven server credentials in the format `server-id:USERNAME_ENV:PASSWORD_ENV`. Replaces the single server configured by the three inputs above when set. | |
 | `mvn-server-repository-origins` | Multiline Maven credential origins in the format `server-id:repository-origin`. Each origin must belong to a configured server ID. Requires Maven 3.10+. | |
 | `mvn-repositories` | Multiline Maven dependency repositories in the format `repository-id:repository-url:snapshots-enabled`. | |
-| `mvn-repositories-include-central` | Include Maven Central in the generated dependency repositories profile. When `false`, Central is disabled unless an explicit `central` repository is declared. | `true` |
+| `mvn-plugin-repositories` | Multiline Maven plugin repositories in the format `repository-id:repository-url:snapshots-enabled`. Can be used independently of `mvn-repositories`. | |
-| `mvn-repositories-prioritize-central` | Place Maven Central before custom dependency repositories. Has no effect when Maven Central is excluded. | `true` |
+| `mvn-repositories-include-central` | Include Maven Central for dependency and plugin repositories in the generated profile. When `false`, Central is disabled for both types unless that type explicitly declares `central`. Has no effect when neither repository list is configured. | `true` |
+| `mvn-repositories-prioritize-central` | Place Maven Central before custom dependency and plugin repositories. Has no effect when Central is excluded or neither repository list is configured. | `true` |
 | `settings-path` | Directory where `settings.xml` is written. | `~/.m2` |
 | `overwrite-settings` | Overwrite an existing `settings.xml`. | `true` |
 | `gpg-private-key` | GPG private key to import into an isolated temporary keyring. | |
@@ -482,10 +483,20 @@ steps:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
-For dependencies hosted outside Maven Central, use `mvn-repositories` to add
+For dependencies hosted outside Maven Central, use `mvn-repositories`; for build
-resolution repositories to an active profile in the generated `settings.xml`.
+plugins, use `mvn-plugin-repositories`. Either input adds its own repository type
-Repository IDs can match `mvn-server-credentials` IDs when authentication is
+to the same active profile in the generated `settings.xml`. Repository IDs can
-required. See [Resolving Maven dependencies from custom repositories](docs/advanced-usage.md#resolving-maven-dependencies-from-custom-repositories).
+match `mvn-server-credentials` IDs when authentication is required.
+See [Resolving Maven dependencies from custom repositories](docs/advanced-usage.md#resolving-maven-dependencies-from-custom-repositories)
+and [Resolving Maven plugins from custom repositories](docs/advanced-usage.md#resolving-maven-plugins-from-custom-repositories).
+
+> [!WARNING]
+> `mvn-repositories-include-central: false` now disables inherited Maven Central
+> for **both dependencies and plugins**, even in existing workflows that only
+> configure `mvn-repositories`. Builds relying on uncached plugins from Central
+> must configure `mvn-plugin-repositories` with an accessible plugin repository
+> or explicitly declare `central` there. Neither repository list configured
+> means the Central controls remain inactive.
 
 ### GPG signing
 

__tests__/auth.test.ts

@@ -63,12 +63,51 @@ const credentials = (id: string, username: string, password: string) => [
 const repositorySettings = (
   repositories: auth.MavenRepository[],
   includeCentral = true,
-  prioritizeCentral = true
+  prioritizeCentral = true,
+  pluginRepositories: auth.MavenRepository[] = []
 ): auth.MavenRepositorySettings => ({
   repositories,
+  pluginRepositories,
   includeCentral,
   prioritizeCentral
 });
+const repositoryInputs = ['mvn-repositories', 'mvn-plugin-repositories'];
+const privateRepository = {
+  id: 'private',
+  url: 'https://repo.example.com/maven',
+  snapshotsEnabled: true
+};
+const privateRepositoryXml = {
+  id: privateRepository.id,
+  url: privateRepository.url,
+  snapshots: {enabled: 'true'}
+};
+const centralRepositoryXml = {
+  id: 'central',
+  url: 'https://repo.maven.apache.org/maven2',
+  snapshots: {enabled: 'false'}
+};
+const disabledCentralRepositoryXml = {
+  ...centralRepositoryXml,
+  releases: {enabled: 'false'}
+};
+const repositoryConfigurations = [
+  {
+    name: 'dependency-only',
+    repositories: [privateRepository],
+    pluginRepositories: []
+  },
+  {
+    name: 'plugin-only',
+    repositories: [],
+    pluginRepositories: [privateRepository]
+  },
+  {
+    name: 'combined',
+    repositories: [privateRepository],
+    pluginRepositories: [privateRepository]
+  }
+];
 
 describe('auth tests', () => {
   let spyOSHomedir: any;
@@ -475,6 +514,87 @@ describe('auth tests', () => {
     ).toEqual(['first', 'second', 'central']);
   });
 
+  it.each([
+    {
+      name: 'Central first by default',
+      prioritizeCentral: undefined,
+      expectedRepositories: [
+        {
+          id: 'central',
+          url: 'https://repo.maven.apache.org/maven2',
+          snapshots: {enabled: 'false'}
+        },
+        {
+          id: 'first',
+          url: 'https://first.example.com/plugins',
+          snapshots: {enabled: 'false'}
+        },
+        {
+          id: 'second',
+          url: 'https://second.example.com/plugins',
+          snapshots: {enabled: 'true'}
+        }
+      ]
+    },
+    {
+      name: 'custom plugins before Central',
+      prioritizeCentral: false,
+      expectedRepositories: [
+        {
+          id: 'first',
+          url: 'https://first.example.com/plugins',
+          snapshots: {enabled: 'false'}
+        },
+        {
+          id: 'second',
+          url: 'https://second.example.com/plugins',
+          snapshots: {enabled: 'true'}
+        },
+        {
+          id: 'central',
+          url: 'https://repo.maven.apache.org/maven2',
+          snapshots: {enabled: 'false'}
+        }
+      ]
+    }
+  ])(
+    'generates plugin-only settings with $name',
+    ({prioritizeCentral, expectedRepositories}) => {
+      const xml = auth.generate(
+        [],
+        undefined,
+        repositorySettings([], true, prioritizeCentral, [
+          {
+            id: 'first',
+            url: 'https://first.example.com/plugins',
+            snapshotsEnabled: false
+          },
+          {
+            id: 'second',
+            url: 'https://second.example.com/plugins',
+            snapshotsEnabled: true
+          }
+        ])
+      );
+
+      expect(parseXmlObject(xml)).toEqual(
+        expect.objectContaining({
+          settings: expect.objectContaining({
+            profiles: {
+              profile: {
+                id: 'setup-java-repositories',
+                pluginRepositories: {
+                  pluginRepository: expectedRepositories
+                }
+              }
+            },
+            activeProfiles: {activeProfile: 'setup-java-repositories'}
+          })
+        })
+      );
+    }
+  );
+
   it('excludes Central from the generated repository profile when configured', () => {
     const parsed = parseXmlObject(
       auth.generate(
@@ -506,6 +626,9 @@ describe('auth tests', () => {
         snapshots: {enabled: 'false'}
       }
     ]);
+    expect(
+      parsed.settings.profiles.profile.pluginRepositories.pluginRepository
+    ).toEqual(disabledCentralRepositoryXml);
   });
 
   it('combines repository and GPG configuration in shared profile blocks', () => {
@@ -543,6 +666,9 @@ describe('auth tests', () => {
               snapshots: {enabled: 'false'}
             }
           ]
+        },
+        pluginRepositories: {
+          pluginRepository: disabledCentralRepositoryXml
         }
       },
       {
@@ -556,6 +682,161 @@ describe('auth tests', () => {
     ]);
   });
 
+  it.each(
+    repositoryConfigurations.flatMap(configuration =>
+      [
+        {includeCentral: true, prioritizeCentral: true},
+        {includeCentral: true, prioritizeCentral: false},
+        {includeCentral: false, prioritizeCentral: true},
+        {includeCentral: false, prioritizeCentral: false}
+      ].map(controls => ({...configuration, ...controls}))
+    )
+  )(
+    'generates $name repositories with includeCentral=$includeCentral and prioritizeCentral=$prioritizeCentral',
+    ({repositories, pluginRepositories, includeCentral, prioritizeCentral}) => {
+      const xml = auth.generate(
+        credentials('private', 'USERNAME', 'PASSWORD'),
+        undefined,
+        repositorySettings(
+          repositories,
+          includeCentral,
+          prioritizeCentral,
+          pluginRepositories
+        )
+      );
+      const expectedEntries = (configured: boolean) => {
+        const entries = includeCentral
+          ? configured
+            ? prioritizeCentral
+              ? [centralRepositoryXml, privateRepositoryXml]
+              : [privateRepositoryXml, centralRepositoryXml]
+            : []
+          : configured
+            ? [privateRepositoryXml, disabledCentralRepositoryXml]
+            : [disabledCentralRepositoryXml];
+        return entries.length === 1 ? entries[0] : entries;
+      };
+      const includeRepositories = repositories.length > 0 || !includeCentral;
+      const includePluginRepositories =
+        pluginRepositories.length > 0 || !includeCentral;
+
+      expect(parseXmlObject(xml)).toMatchObject({
+        settings: {
+          profiles: {
+            profile: {
+              id: 'setup-java-repositories',
+              ...(includeRepositories
+                ? {
+                    repositories: {
+                      repository: expectedEntries(repositories.length > 0)
+                    }
+                  }
+                : {}),
+              ...(includePluginRepositories
+                ? {
+                    pluginRepositories: {
+                      pluginRepository: expectedEntries(
+                        pluginRepositories.length > 0
+                      )
+                    }
+                  }
+                : {})
+            }
+          },
+          activeProfiles: {activeProfile: 'setup-java-repositories'}
+        }
+      });
+      if (!includeRepositories) {
+        expect(xml).not.toContain('<repositories>');
+      }
+      if (!includePluginRepositories) {
+        expect(xml).not.toContain('<pluginRepositories>');
+      }
+    }
+  );
+
+  it.each(repositoryConfigurations)(
+    'handles explicit Central independently for $name repositories',
+    ({repositories, pluginRepositories}) => {
+      const central = {
+        id: 'central',
+        url: 'https://mirror.example.com/maven',
+        snapshotsEnabled: true
+      };
+      const explicitCentralXml = {
+        id: central.id,
+        url: central.url,
+        snapshots: {enabled: 'true'}
+      };
+      const xml = auth.generate(
+        [],
+        undefined,
+        repositorySettings(
+          repositories.length ? [central] : [],
+          false,
+          true,
+          pluginRepositories.length ? [central] : []
+        )
+      );
+
+      expect(parseXmlObject(xml)).toMatchObject({
+        settings: {
+          profiles: {
+            profile: {
+              repositories: {
+                repository: repositories.length
+                  ? explicitCentralXml
+                  : disabledCentralRepositoryXml
+              },
+              pluginRepositories: {
+                pluginRepository: pluginRepositories.length
+                  ? explicitCentralXml
+                  : disabledCentralRepositoryXml
+              }
+            }
+          }
+        }
+      });
+      expect(xml.match(/<id>central<\/id>/g)).toHaveLength(2);
+    }
+  );
+
+  it('escapes plugin repository values while preserving parsed semantics', () => {
+    const repository = {
+      id: `private&<>"'é`,
+      url: `https://repo.example.com:8443/a?x=1&y=<value>"'é`,
+      snapshotsEnabled: false
+    };
+    const xml = auth.generate(
+      credentials(repository.id, 'USERNAME', 'PASSWORD'),
+      undefined,
+      repositorySettings([], true, true, [repository])
+    );
+
+    expect(parseXmlObject(xml)).toMatchObject({
+      settings: {
+        servers: {server: {id: repository.id}},
+        profiles: {
+          profile: {
+            pluginRepositories: {
+              pluginRepository: [
+                centralRepositoryXml,
+                {
+                  id: repository.id,
+                  url: repository.url,
+                  snapshots: {enabled: 'false'}
+                }
+              ]
+            }
+          }
+        }
+      }
+    });
+    expect(xml).toContain('private&amp;&lt;&gt;');
+    expect(xml).toContain('x=1&amp;y=&lt;value&gt;');
+    expect(xml).not.toContain('<repositories>');
+  });
+
   it('escapes repository values while preserving parsed semantics', () => {
     const repository = {
       id: `private&<>"'é`,
@@ -601,15 +882,18 @@ describe('auth tests', () => {
     ]);
   });
 
-  it('parses Maven repositories while preserving colons in URLs', () => {
+  it.each(repositoryInputs)(
+    'parses %s while preserving colons in URLs',
+    inputName => {
       expect(
         auth.parseMavenRepositories(
           [
             '',
-          ' private : https://repo.example.com:8443/maven : true ',
+            ' private : https://repo.example.com:8443/maven : TRUE ',
             'releases:https://repo.example.com/releases:false'
           ],
-        true
+          true,
+          inputName
         )
       ).toEqual([
         {
@@ -623,9 +907,11 @@ describe('auth tests', () => {
           snapshotsEnabled: false
         }
       ]);
-  });
+    }
+  );
 
-  it.each([
+  it.each(
+    [
       {
         entries: ['private'],
         error:
@@ -641,41 +927,66 @@ describe('auth tests', () => {
         error:
           'Invalid mvn-repositories entry at line 1. repository-id, repository URL, and snapshots-enabled are required'
       },
+      {
+        entries: ['private:https://repo.example.com:'],
+        error:
+          'Invalid mvn-repositories entry at line 1. repository-id, repository URL, and snapshots-enabled are required'
+      },
+      {
+        entries: ['', 'private:https://repo.example.com:true', ' :url:false'],
+        error:
+          'Invalid mvn-repositories entry at line 3. repository-id, repository URL, and snapshots-enabled are required'
+      },
       {
         entries: ['private:https://repo.example.com:sometimes'],
         error:
           "Invalid snapshots-enabled value 'sometimes' in mvn-repositories entry at line 1. Expected true or false"
       }
-  ])('rejects malformed Maven repositories: $entries', ({entries, error}) => {
+    ].flatMap(testCase =>
-    expect(() => auth.parseMavenRepositories(entries, true)).toThrow(error);
+      repositoryInputs.map(inputName => ({
+        ...testCase,
+        inputName,
+        error: testCase.error.replace('mvn-repositories', inputName)
+      }))
+    )
+  )('rejects malformed $inputName: $entries', ({entries, error, inputName}) => {
+    expect(() => auth.parseMavenRepositories(entries, true, inputName)).toThrow(
+      error
+    );
   });
 
-  it('rejects duplicate Maven repository ids', () => {
+  it.each(repositoryInputs)('rejects duplicate IDs in %s', inputName => {
     expect(() =>
       auth.parseMavenRepositories(
         [
           'private:https://first.example.com:false',
           'private:https://second.example.com:true'
         ],
-        true
+        true,
+        inputName
       )
-    ).toThrow("Duplicate repository-id 'private' in mvn-repositories input");
+    ).toThrow(`Duplicate repository-id 'private' in ${inputName} input`);
   });
 
-  it('reserves the Central repository id only when automatic Central inclusion is enabled', () => {
+  it.each(repositoryInputs)(
+    'reserves the Central ID in %s only when automatic inclusion is enabled',
+    inputName => {
       const central = 'central:https://custom.example.com/maven:false';
 
-    expect(() => auth.parseMavenRepositories([central], true)).toThrow(
+      expect(() =>
+        auth.parseMavenRepositories([central], true, inputName)
+      ).toThrow(
         "Repository-id 'central' is reserved when mvn-repositories-include-central is enabled"
       );
-    expect(auth.parseMavenRepositories([central], false)).toEqual([
+      expect(auth.parseMavenRepositories([central], false, inputName)).toEqual([
         {
           id: 'central',
           url: 'https://custom.example.com/maven',
           snapshotsEnabled: false
         }
       ]);
-  });
+    }
+  );
 
   it('uses an explicit Central repository instead of adding a disabled override', () => {
     const parsed = parseXmlObject(
@@ -721,16 +1032,138 @@ describe('auth tests', () => {
           snapshotsEnabled: true
         }
       ],
+      pluginRepositories: [],
       includeCentral: false,
       prioritizeCentral: false
     });
   });
 
   it('does not read repository controls when no repositories are configured', () => {
+    (
+      core.getInput as jest.MockedFunction<typeof core.getInput>
+    ).mockReturnValue('false');
     expect(auth.getMavenRepositorySettings()).toBeUndefined();
     expect(core.getInput).not.toHaveBeenCalled();
   });
 
+  it('ignores blank dependency and plugin repository inputs', () => {
+    (
+      core.getMultilineInput as jest.MockedFunction<
+        typeof core.getMultilineInput
+      >
+    ).mockReturnValue(['', ' ', '\t']);
+
+    expect(auth.getMavenRepositorySettings()).toBeUndefined();
+    expect(core.getInput).not.toHaveBeenCalled();
+  });
+
+  it.each(repositoryConfigurations)(
+    'reads $name inputs with default Central controls and shared IDs',
+    ({repositories, pluginRepositories}) => {
+      (
+        core.getInput as jest.MockedFunction<typeof core.getInput>
+      ).mockReturnValue('');
+      (
+        core.getMultilineInput as jest.MockedFunction<
+          typeof core.getMultilineInput
+        >
+      ).mockImplementation(name => {
+        const configured =
+          name === 'mvn-repositories' ? repositories : pluginRepositories;
+        return configured.map(
+          repository =>
+            `${repository.id}:${repository.url}:${repository.snapshotsEnabled}`
+        );
+      });
+
+      expect(auth.getMavenRepositorySettings()).toEqual({
+        repositories,
+        pluginRepositories,
+        includeCentral: true,
+        prioritizeCentral: true
+      });
+    }
+  );
+
+  it.each([true, false])(
+    'configures plugin repositories with credentials, GPG, a custom path, and overwrite=%s',
+    async overwriteSettings => {
+      const directory = path.join(m2Dir, 'custom');
+      const location = path.join(directory, MVN_SETTINGS_FILE);
+      fs.mkdirSync(directory, {recursive: true});
+      fs.writeFileSync(location, 'EXISTING SETTINGS');
+      (
+        core.getInput as jest.MockedFunction<typeof core.getInput>
+      ).mockImplementation(name => {
+        const inputs: Record<string, string> = {
+          'settings-path': directory,
+          'overwrite-settings': String(overwriteSettings),
+          'gpg-passphrase-env-var': 'GPG_PASSPHRASE',
+          'mvn-repositories-include-central': 'false'
+        };
+        return inputs[name] ?? '';
+      });
+      (
+        core.getMultilineInput as jest.MockedFunction<
+          typeof core.getMultilineInput
+        >
+      ).mockImplementation(name => {
+        const inputs: Record<string, string[]> = {
+          'mvn-server-credentials': ['private:USERNAME:PASSWORD'],
+          'mvn-server-repository-origins': ['private:https://repo.example.com'],
+          'mvn-plugin-repositories': [
+            'private:https://repo.example.com/maven:true'
+          ]
+        };
+        return inputs[name] ?? [];
+      });
+
+      await auth.configureAuthentication();
+
+      const xml = fs.readFileSync(location, 'utf8');
+      if (!overwriteSettings) {
+        expect(xml).toBe('EXISTING SETTINGS');
+        return;
+      }
+      expect(parseXmlObject(xml)).toMatchObject({
+        settings: {
+          servers: {
+            server: {
+              id: 'private',
+              username: '${env.USERNAME}',
+              password: '${env.PASSWORD}',
+              repositoryOrigins: {
+                repositoryOrigin: 'https://repo.example.com'
+              }
+            }
+          },
+          profiles: {
+            profile: [
+              {
+                id: 'setup-java-repositories',
+                repositories: {repository: disabledCentralRepositoryXml},
+                pluginRepositories: {
+                  pluginRepository: [
+                    privateRepositoryXml,
+                    disabledCentralRepositoryXml
+                  ]
+                }
+              },
+              {
+                id: 'setup-java-gpg',
+                properties: {'gpg.passphraseEnvName': 'GPG_PASSPHRASE'}
+              }
+            ]
+          },
+          activeProfiles: {
+            activeProfile: ['setup-java-repositories', 'setup-java-gpg']
+          }
+        }
+      });
+      expect(fs.existsSync(settingsFile)).toBe(false);
+    }
+  );
+
   it.each([
     {
       entries: ['releases:RELEASES_USERNAME'],

__tests__/distributors/liberica-installer.test.ts

@@ -15,6 +15,7 @@ import type {
 } from '../../src/distributions/liberica/models.js';
 import {HttpClient} from '@actions/http-client';
 import os from 'os';
+import path from 'path';
 
 import manifestData from '../data/liberica.json' with {type: 'json'};
 
@@ -253,35 +254,68 @@ describe('findPackageForDownload', () => {
     expect(result.version).toBe(expected);
   });
 
-  describe('compound build versions', () => {
+  describe.each([
+    [17, 20],
+    [25, 4]
+  ])('patch releases for Java %s.0.%s', (featureVersion, updateVersion) => {
+    const mainVersion = `${featureVersion}.0.${updateVersion}`;
+
     beforeEach(() => {
       distribution['getAvailableVersions'] = async () =>
-        ['1', '1.1', '1.2', '1.10'].map(build => ({
+        ['+1', '+10', '.1+1', '.1+2', '.1+10', '.2+1', '.10+1'].map(suffix => ({
-          featureVersion: 25,
+          featureVersion,
           interimVersion: 0,
-          updateVersion: 4,
+          updateVersion,
-          buildVersion: 1,
+          buildVersion: Number(suffix.split('+')[1]),
-          version: `25.0.4+${build}`,
+          version: `${mainVersion}${suffix}`,
-          downloadUrl: `https://download.bell-sw.com/java/25.0.4+${build}/bellsoft-jdk25.0.4+${build}-macos-aarch64.tar.gz`
+          downloadUrl: `https://download.bell-sw.com/java/${mainVersion}${suffix}/bellsoft-jdk${mainVersion}${suffix}-macos-aarch64.tar.gz`
         }));
     });
 
     it.each([
-      ['25.0.4+1.1', '25.0.4+1.1'],
+      [`${mainVersion}+1.1`, `${mainVersion}+1.1`, '.1+1'],
-      ['25.0.4+1', '25.0.4+1'],
+      [`${mainVersion}+1.2`, `${mainVersion}+1.2`, '.1+2'],
-      ['25.0.4', '25.0.4+1.10'],
+      [`${mainVersion}+1.10`, `${mainVersion}+1.10`, '.1+10'],
-      ['25', '25.0.4+1.10']
+      [`${mainVersion}+1`, `${mainVersion}+1`, '+1'],
-    ])('version is %s -> %s', async (input, expected) => {
+      [mainVersion, `${mainVersion}+10.1`, '.10+1'],
+      [`${featureVersion}`, `${mainVersion}+10.1`, '.10+1']
+    ])('version is %s -> %s', async (input, expected, suffix) => {
       const result = await distribution['findPackageForDownload'](input);
       expect(result).toEqual({
         version: expected,
-        url: `https://download.bell-sw.com/java/${expected}/bellsoft-jdk${expected}-macos-aarch64.tar.gz`
+        url: `https://download.bell-sw.com/java/${mainVersion}${suffix}/bellsoft-jdk${mainVersion}${suffix}-macos-aarch64.tar.gz`
       });
     });
 
+    it('sorts builds within the same patch numerically', async () => {
+      const versions = await distribution['getAvailableVersions']();
+      distribution['getAvailableVersions'] = async () =>
+        versions.filter(item => item.version.startsWith(`${mainVersion}.1+`));
+
+      const result = await distribution['findPackageForDownload'](mainVersion);
+      expect(result.version).toBe(`${mainVersion}+1.10`);
+    });
+
+    it('selects the newest build for a four-component patch-only request', async () => {
+      const patchDistribution = new LibericaDistributions({
+        version: `${mainVersion}.1`,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      patchDistribution['getAvailableVersions'] =
+        distribution['getAvailableVersions'];
+
+      await expect(
+        patchDistribution['findPackageForDownload'](
+          patchDistribution['version']
+        )
+      ).resolves.toMatchObject({version: `${mainVersion}+1.10`});
+    });
+
     it('does not substitute a different compound build', async () => {
       await expect(
-        distribution['findPackageForDownload']('25.0.4+1.3')
+        distribution['findPackageForDownload'](`${mainVersion}+1.3`)
       ).rejects.toThrow(/No matching version found for SemVer/);
     });
   });
@@ -293,6 +327,160 @@ describe('findPackageForDownload', () => {
   });
 });
 
+describe('patch request resolution from the constructor', () => {
+  const releases: LibericaVersion[] = ['17.0.20+10', '17.0.20.1+1'].map(
+    version => ({
+      featureVersion: 17,
+      interimVersion: 0,
+      updateVersion: 20,
+      buildVersion: Number(version.split('+')[1]),
+      version,
+      downloadUrl: `https://download.bell-sw.com/java/${version}/jdk.tar.gz`
+    })
+  );
+  let cacheRoot: string;
+  let previousToolcache: string | undefined;
+
+  beforeEach(async () => {
+    previousToolcache = process.env['RUNNER_TOOL_CACHE'];
+    cacheRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'liberica-'));
+    process.env['RUNNER_TOOL_CACHE'] = cacheRoot;
+    for (const version of ['17.0.20-10', '17.0.20-1.1']) {
+      const javaPath = path.join(
+        cacheRoot,
+        'Java_Liberica_jdk',
+        version,
+        'x64'
+      );
+      await fs.promises.mkdir(javaPath, {recursive: true});
+      await fs.promises.writeFile(`${javaPath}.complete`, '');
+    }
+  });
+
+  afterEach(async () => {
+    if (previousToolcache === undefined) {
+      delete process.env['RUNNER_TOOL_CACHE'];
+    } else {
+      process.env['RUNNER_TOOL_CACHE'] = previousToolcache;
+    }
+    await fs.promises.rm(cacheRoot, {recursive: true, force: true});
+  });
+
+  it.each([
+    ['17', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20+10', '17.0.20+10', '17.0.20+10'],
+    ['17.0.20+1.1', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20.1', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20.1+1', '17.0.20+1.1', '17.0.20.1+1'],
+    ['17.0.20.0', '17.0.20+10', '17.0.20+10']
+  ])(
+    'resolves %s consistently remotely and in cache',
+    async (input, expected, apiVersion) => {
+      const distribution = new LibericaDistributions({
+        version: input,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      distribution['getAvailableVersions'] = async () => releases;
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toEqual({
+        version: expected,
+        url: `https://download.bell-sw.com/java/${apiVersion}/jdk.tar.gz`
+      });
+      expect(distribution['findInToolcache']()).toEqual({
+        version: expected,
+        path: path.join(
+          cacheRoot,
+          'Java_Liberica_jdk',
+          expected.replace('+', '-'),
+          'x64'
+        )
+      });
+    }
+  );
+
+  it.each(['17.0.20.2', '17.0.20+1.2'])(
+    'does not substitute a different patch or exact build for %s',
+    async version => {
+      const distribution = new LibericaDistributions({
+        version,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      distribution['getAvailableVersions'] = async () => releases;
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).rejects.toThrow(/No matching version found/);
+      expect(distribution['findInToolcache']()).toBeNull();
+    }
+  );
+
+  it('keeps patch-only and exact-build resolution cache identities distinct', () => {
+    const distribution = new LibericaDistributions({
+      version: '17.0.20.1',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    expect(distribution['version']).toBe('17.0.20.1');
+  });
+
+  it('orders main versions, patches, and builds consistently in cache', async () => {
+    for (const version of ['17.0.20-1.2', '17.0.20-1.10', '17.0.21-1']) {
+      const javaPath = path.join(
+        cacheRoot,
+        'Java_Liberica_jdk',
+        version,
+        'x64'
+      );
+      await fs.promises.mkdir(javaPath, {recursive: true});
+      await fs.promises.writeFile(`${javaPath}.complete`, '');
+    }
+
+    for (const [version, expected] of [
+      ['17', '17.0.21+1'],
+      ['17.0.20', '17.0.20+1.10'],
+      ['17.0.20.1', '17.0.20+1.10']
+    ]) {
+      const distribution = new LibericaDistributions({
+        version,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      expect(distribution['findInToolcache']()?.version).toBe(expected);
+    }
+  });
+
+  it('preserves early-access handling for patch-only requests', async () => {
+    const javaPath = path.join(
+      cacheRoot,
+      'Java_Liberica_jdk',
+      '17.0.20-ea.1.2',
+      'x64'
+    );
+    await fs.promises.mkdir(javaPath, {recursive: true});
+    await fs.promises.writeFile(`${javaPath}.complete`, '');
+    const distribution = new LibericaDistributions({
+      version: '17.0.20.1-ea',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    expect(distribution['stable']).toBe(false);
+    expect(distribution['findInToolcache']()).toEqual({
+      version: '17.0.20+1.2',
+      path: javaPath
+    });
+  });
+});
+
 describe('getPlatformOption', () => {
   beforeEach(() => {
     // The linux row below is glibc, so pin the Alpine probe rather than
@@ -369,6 +557,36 @@ describe('convertVersionToSemver', () => {
       },
       '11.0.0+13'
     ],
+    [
+      {
+        version: '17.0.20.1+1',
+        featureVersion: 17,
+        interimVersion: 0,
+        updateVersion: 20,
+        buildVersion: 1
+      },
+      '17.0.20+1.1'
+    ],
+    [
+      {
+        version: '25.0.4.1+1',
+        featureVersion: 25,
+        interimVersion: 0,
+        updateVersion: 4,
+        buildVersion: 1
+      },
+      '25.0.4+1.1'
+    ],
+    [
+      {
+        version: '17.0.20.1+2',
+        featureVersion: 17,
+        interimVersion: 0,
+        updateVersion: 20,
+        buildVersion: 2
+      },
+      '17.0.20+1.2'
+    ],
     [
       {
         version: '25.0.4+1.1',

action.yml

@@ -72,12 +72,15 @@ inputs:
   mvn-repositories:
     description: 'Multiline list of Maven dependency repositories in the format `repository-id:repository-url:snapshots-enabled`.'
     required: false
+  mvn-plugin-repositories:
+    description: 'Multiline list of Maven plugin repositories in the format `repository-id:repository-url:snapshots-enabled`.'
+    required: false
   mvn-repositories-include-central:
-    description: 'Include Maven Central in the generated dependency repositories profile. When false, Central is disabled unless an explicit repository with ID `central` is declared.'
+    description: 'Include Maven Central for dependency and plugin repositories in the generated profile. When false, Central is disabled for both types unless that type explicitly declares ID `central`. Has no effect when neither repository list is configured.'
     required: false
     default: true
   mvn-repositories-prioritize-central:
-    description: 'Place Maven Central before custom dependency repositories. Has no effect when Maven Central is excluded.'
+    description: 'Place Maven Central before custom dependency and plugin repositories. Has no effect when Maven Central is excluded or neither repository list is configured.'
     required: false
     default: true
   settings-path:

dist/cleanup/index.js

@@ -7217,7 +7217,7 @@ function defaultFactory (origin, opts) {
 }
 
 class Agent extends DispatcherBase {
-  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, ...options } = {}) {
+  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, tls, ...options } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
@@ -7236,11 +7236,15 @@ class Agent extends DispatcherBase {
       connect = { ...connect }
     }
 
+    if (tls && typeof tls !== 'function') {
+      tls = { ...tls }
+    }
+
     this[kInterceptors] = options.interceptors?.Agent && Array.isArray(options.interceptors.Agent)
       ? options.interceptors.Agent
       : [createRedirectInterceptor({ maxRedirections })]
 
-    this[kOptions] = { ...util.deepClone(options), connect }
+    this[kOptions] = { ...util.deepClone(options), connect, tls }
     this[kOptions].interceptors = options.interceptors
       ? { ...options.interceptors }
       : undefined
@@ -8273,8 +8277,6 @@ async function connectH1 (client, socket) {
   socket[kParser] = new Parser(client, socket, llhttpInstance)
 
   addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     const parser = this[kParser]
 
     // On Mac OS, we get an ECONNRESET even if there is a full body to be forwarded
@@ -9204,8 +9206,6 @@ async function connectH2 (client, socket) {
   socket[kHTTP2Session] = session
 
   util.addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     this[kError] = err
 
     this[kClient][kOnError](err)
@@ -9279,8 +9279,6 @@ function resumeH2 (client) {
 }
 
 function onHttp2SessionError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   this[kSocket][kError] = err
   this[kClient][kOnError](err)
 }
@@ -9978,9 +9976,10 @@ class Client extends DispatcherBase {
     // h2
     maxConcurrentStreams,
     allowH2,
-    webSocket
+    webSocket,
+    eventSource
   } = {}) {
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -10501,6 +10500,7 @@ module.exports = Client
 
 
 
+const buffer = __nccwpck_require__(4573)
 const Dispatcher = __nccwpck_require__(883)
 const {
   ClientDestroyedError,
@@ -10513,6 +10513,7 @@ const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kInterceptedDispatch = Symbol('Intercepted Dispatch')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   constructor (opts) {
@@ -10523,6 +10524,7 @@ class DispatcherBase extends Dispatcher {
     this[kClosed] = false
     this[kOnClosed] = []
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   get webSocketOptions () {
@@ -10532,6 +10534,12 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   get destroyed () {
     return this[kDestroyed]
   }
@@ -16890,6 +16898,7 @@ module.exports = {
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 
+const buffer = __nccwpck_require__(4573)
 const { Transform } = __nccwpck_require__(7075)
 const { isASCIINumber, isValidLastEventId } = __nccwpck_require__(4811)
 
@@ -16914,11 +16923,19 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
 const RETRY = Buffer.from('retry')
 
+// Each data field creates a string node, and each unconsumed input chunk keeps
+// a Buffer wrapper. The absolute ceiling protects the large default byte limit.
+const minParserItems = 1024
+const maxParserItems = 131072
+const bytesPerParserItem = 128
+
 function isASCIINumberBytes (buffer, start) {
   if (start >= buffer.length) {
     return false
@@ -16957,6 +16974,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -17005,6 +17028,13 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  lineLength = 0
+  eventSize = 0
+  eventFieldSizes = { data: 0, event: 0, id: 0, retry: 0 }
+  dataLineCount = 0
+  maxEventSize
+  maxDataLines
+  maxBufferedChunks
 
   event = {
     data: undefined,
@@ -17015,6 +17045,7 @@ class EventSourceStream extends Transform {
 
   /**
    * @param {object} options
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} options.eventSourceSettings
    * @param {Function} [options.push]
    */
@@ -17026,6 +17057,12 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
+    const parserItemLimit = this.maxEventSize > 0
+      ? Math.min(maxParserItems, Math.max(minParserItems, Math.floor(this.maxEventSize / bytesPerParserItem)))
+      : 0
+    this.maxDataLines = parserItemLimit
+    this.maxBufferedChunks = parserItemLimit
     if (options.push) {
       this.push = options.push
     }
@@ -17043,6 +17080,14 @@ class EventSourceStream extends Transform {
       return
     }
 
+    // A leading line ending can immediately release the currently buffered
+    // line, even when it uses the final allowed chunk slot.
+    if (this.maxEventSize > 0 &&
+        this.chunks.length >= this.maxBufferedChunks &&
+        chunk[0] !== LF && chunk[0] !== CR) {
+      callback(createMaxEventSizeExceededError())
+      return
+    }
     this.chunks.push(chunk)
 
     // Strip leading byte-order-mark if we opened the stream and started
@@ -17121,7 +17166,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
+        try {
           this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -17130,15 +17180,28 @@ class EventSourceStream extends Transform {
         continue
       }
 
+      // readLine() is only called after CR or LF. Reject an unfinished line
+      // before it can retain an unbounded number of decoded chunks. The seven
+      // extra bytes allow the longest field prefix ("event: " or "retry: ").
+      if (this.maxEventSize > 0 && ++this.lineLength > this.maxEventSize + 7) {
+        callback(createMaxEventSizeExceededError())
+        return
+      }
       this.advanceCursor()
     }
 
     callback()
   }
 
+  _destroy (error, callback) {
+    this.chunks.length = 0
+    this.clearEvent()
+    super._destroy(error, callback)
+  }
+
   /**
    * @param {Buffer} line
-   * @param {EventStreamEvent} event
+   * @param {EventSourceStreamEvent} event
    */
   parseLine (line, event) {
     // If the line is empty (a blank line)
@@ -17172,6 +17235,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      if (this.maxEventSize > 0 && this.dataLineCount >= this.maxDataLines) {
+        throw createMaxEventSizeExceededError()
+      }
+      const valueBytes = line.length - valueStart
+      const dataSize = this.eventFieldSizes.data + (event.data === undefined ? 0 : 1) + valueBytes
+      this.setEventFieldSize('data', dataSize)
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -17179,11 +17249,13 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.dataLineCount++
       return
     }
 
     if (isFieldName(line, fieldLength, RETRY)) {
       if (isASCIINumberBytes(line, valueStart)) {
+        this.setEventFieldSize('retry', line.length - valueStart)
         event.retry = line.toString('utf8', valueStart)
       }
       return
@@ -17191,18 +17263,27 @@ class EventSourceStream extends Transform {
 
     if (isFieldName(line, fieldLength, ID)) {
       if (isValidLastEventIdBytes(line, valueStart)) {
+        this.setEventFieldSize('id', line.length - valueStart)
         event.id = line.toString('utf8', valueStart)
       }
       return
     }
 
     if (isFieldName(line, fieldLength, EVENT)) {
-      const value = line.toString('utf8', valueStart)
+      if (valueStart < line.length) {
+        this.setEventFieldSize('event', line.length - valueStart)
+        event.event = line.toString('utf8', valueStart)
+      }
+    }
+  }
 
-      if (value.length > 0) {
+  setEventFieldSize (field, size) {
-        event.event = value
+    const eventSize = this.eventSize - this.eventFieldSizes[field] + size
-      }
+    if (this.maxEventSize > 0 && eventSize > this.maxEventSize) {
+      throw createMaxEventSizeExceededError()
     }
+    this.eventSize = eventSize
+    this.eventFieldSizes[field] = size
   }
 
   /**
@@ -17235,6 +17316,12 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventSize = 0
+    this.dataLineCount = 0
+    this.eventFieldSizes.data = 0
+    this.eventFieldSizes.event = 0
+    this.eventFieldSizes.id = 0
+    this.eventFieldSizes.retry = 0
   }
 
   hasPendingEvent () {
@@ -17270,14 +17357,16 @@ class EventSourceStream extends Transform {
   syncLineStartToCursor () {
     this.lineChunkIndex = this.chunkIndex
     this.linePos = this.pos
+    this.lineLength = 0
     this.dropConsumedChunks()
   }
 
   dropConsumedChunks () {
-    while (this.lineChunkIndex > 0) {
+    if (this.lineChunkIndex > 0) {
-      this.chunks.shift()
+      const consumed = this.lineChunkIndex
-      this.lineChunkIndex--
+      this.chunks.splice(0, consumed)
-      this.chunkIndex--
+      this.lineChunkIndex = 0
+      this.chunkIndex -= consumed
     }
 
     if (this.chunkIndex === this.chunks.length) {
@@ -17402,6 +17491,7 @@ const { isNetworkError } = __nccwpck_require__(9051)
 const { delay } = __nccwpck_require__(4811)
 const { kEnumerableProperty } = __nccwpck_require__(3440)
 const { environmentSettingsObject } = __nccwpck_require__(3168)
+const { getGlobalDispatcher } = __nccwpck_require__(2581)
 
 let experimentalWarned = false
 
@@ -17683,6 +17773,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -17861,7 +17952,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   }
 ])
 
@@ -22957,8 +23049,10 @@ async function httpNetworkFetch (
   // 19. Run these steps in parallel:
 
   //    1. Run these steps, but abort when fetchParams is canceled:
-  fetchParams.controller.onAborted = onAborted
+  if (!fetchParams.controller.resume) {
     fetchParams.controller.on('terminated', onAborted)
+  }
+
   fetchParams.controller.resume = async () => {
     // 1. While true
     while (true) {
@@ -23127,8 +23221,6 @@ async function httpNetworkFetch (
           }
           location = headersList.get('location', true)
 
-          this.body = new Readable({ read: resume })
-
           const decoders = []
 
           const willFollow = location && request.redirect === 'follow' &&
@@ -23146,7 +23238,7 @@ async function httpNetworkFetch (
             // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
             const maxContentEncodings = 5
             if (codings.length > maxContentEncodings) {
-              reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+              this.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
               return true
             }
 
@@ -23179,6 +23271,8 @@ async function httpNetworkFetch (
             }
           }
 
+          this.body = new Readable({ read: resume })
+
           const onError = this.onError.bind(this)
 
           resolve({
@@ -23225,10 +23319,6 @@ async function httpNetworkFetch (
             fetchParams.controller.off('terminated', this.abort)
           }
 
-          if (fetchParams.controller.onAborted) {
-            fetchParams.controller.off('terminated', fetchParams.controller.onAborted)
-          }
-
           fetchParams.controller.ended = true
 
           this.body.push(null)
@@ -29703,6 +29793,20 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          const socket = this.ws[kResponse].socket
+          if (this.#loop && socket.writableNeedDrain) {
+            this.#loop = false
+            socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {
@@ -31040,7 +31144,7 @@ module.exports = {
 /* harmony export */   gk: () => (/* binding */ INPUT_CACHE),
 /* harmony export */   wG: () => (/* binding */ INPUT_JOB_STATUS)
 /* harmony export */ });
-/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, SIGNATURE_VERIFICATION_DOCUMENTATION_URL, SIGNATURE_VERIFICATION_FAILURE_HELP, INPUT_MVN_SERVER_CREDENTIALS, INPUT_MVN_SERVER_REPOSITORY_ORIGINS, INPUT_MVN_REPOSITORIES, INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL, INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, MAVEN_REPOSITORIES_PROFILE_ID, MAVEN_CENTRAL_REPOSITORY_ID, MAVEN_CENTRAL_REPOSITORY_URL, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
+/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, SIGNATURE_VERIFICATION_DOCUMENTATION_URL, SIGNATURE_VERIFICATION_FAILURE_HELP, INPUT_MVN_SERVER_CREDENTIALS, INPUT_MVN_SERVER_REPOSITORY_ORIGINS, INPUT_MVN_REPOSITORIES, INPUT_MVN_PLUGIN_REPOSITORIES, INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL, INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, MAVEN_REPOSITORIES_PROFILE_ID, MAVEN_CENTRAL_REPOSITORY_ID, MAVEN_CENTRAL_REPOSITORY_URL, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
 const MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
 const INPUT_JAVA_VERSION = 'java-version';
 const INPUT_JAVA_VERSION_FILE = 'java-version-file';
@@ -31060,6 +31164,7 @@ const SIGNATURE_VERIFICATION_FAILURE_HELP = (/* unused pure expression or super
 const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
 const INPUT_MVN_SERVER_REPOSITORY_ORIGINS = 'mvn-server-repository-origins';
 const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
+const INPUT_MVN_PLUGIN_REPOSITORIES = 'mvn-plugin-repositories';
 const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL = 'mvn-repositories-include-central';
 const INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL = 'mvn-repositories-prioritize-central';
 const INPUT_SERVER_ID = 'server-id';

dist/setup/242.index.js

@@ -378,7 +378,7 @@ class JavaBase {
                         core/* info */.pq(`Java ${foundJava.version} was downloaded`);
                         if (javaRelease.floating) {
                             if (!semver_default().valid(foundJava.version) ||
-                                !(0,util/* isVersionSatisfies */.y)(this.version, foundJava.version)) {
+                                !this.isVersionSatisfied(this.version, foundJava.version)) {
                                 throw new Error(`The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`);
                             }
                             javaRelease = { ...javaRelease, version: foundJava.version };
@@ -501,7 +501,7 @@ class JavaBase {
             return javaRelease;
         }
         if (!semver_default().valid(restored.release.version) ||
-            !(0,util/* isVersionSatisfies */.y)(this.version, restored.release.version)) {
+            !this.isVersionSatisfied(this.version, restored.release.version)) {
             core/* debug */.Yz(`Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`);
             return javaRelease;
         }
@@ -684,10 +684,10 @@ class JavaBase {
         })
             .filter(item => item.stable === this.stable);
         const satisfiedVersions = availableVersions
-            .filter(item => (0,util/* isVersionSatisfies */.y)(this.version, item.version))
+            .filter(item => this.isVersionSatisfied(this.version, item.version))
             .filter(item => item.path)
             .sort((a, b) => {
-            return -semver_default().compareBuild(a.version, b.version);
+            return -this.compareVersions(a.version, b.version);
         });
         if (!satisfiedVersions || satisfiedVersions.length === 0) {
             return null;
@@ -697,6 +697,12 @@ class JavaBase {
             path: satisfiedVersions[0].path
         };
     }
+    isVersionSatisfied(range, version) {
+        return (0,util/* isVersionSatisfies */.y)(range, version);
+    }
+    compareVersions(a, b) {
+        return semver_default().compareBuild(a, b);
+    }
     normalizeVersion(version) {
         let stable = true;
         const latest = false;

dist/setup/63.index.js

@@ -52,14 +52,46 @@ class LibericaDistributions extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
             version: this.convertVersionToSemver(item)
         }));
         const satisfiedVersion = availableVersions
-            .filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_2__/* .isVersionSatisfies */ .y)(range, item.version))
+            .filter(item => this.isVersionSatisfied(range, item.version))
-            .sort((a, b) => -semver__WEBPACK_IMPORTED_MODULE_1___default().compareBuild(a.version, b.version))[0];
+            .sort((a, b) => -this.compareVersions(a.version, b.version))[0];
         if (!satisfiedVersion) {
             const availableVersionStrings = availableVersions.map(item => item.version);
             throw this.createVersionNotFoundError(range, availableVersionStrings);
         }
         return satisfiedVersion;
     }
+    normalizeVersion(version) {
+        const normalized = super.normalizeVersion(version);
+        if (/^\d+\.\d+\.\d+\.\d+(?:-ea)?$/.test(version)) {
+            // Keep patch-only requests distinct from exact SDKMAN build requests.
+            normalized.version = version.replace(/-ea$/, '');
+        }
+        return normalized;
+    }
+    isVersionSatisfied(range, version) {
+        const patchRequest = range.match(/^(\d+\.\d+\.\d+)\.(\d+)$/);
+        if (patchRequest) {
+            const candidate = semver__WEBPACK_IMPORTED_MODULE_1___default().parse(version);
+            if (!candidate || !semver__WEBPACK_IMPORTED_MODULE_1___default().eq(patchRequest[1], candidate)) {
+                return false;
+            }
+            const patch = candidate.build.length > 1 ? candidate.build[0] : '0';
+            return patch === patchRequest[2];
+        }
+        return super.isVersionSatisfied(range, version);
+    }
+    compareVersions(a, b) {
+        const mainComparison = semver__WEBPACK_IMPORTED_MODULE_1___default().compare(a, b);
+        if (mainComparison !== 0) {
+            return mainComparison;
+        }
+        // SDKMAN encodes patch.build, but unpatched releases contain only build.
+        const patchAndBuild = (version) => {
+            const build = new (semver__WEBPACK_IMPORTED_MODULE_1___default().SemVer)(version).build;
+            return (build.length > 1 ? build : ['0', ...build]).join('.');
+        };
+        return semver__WEBPACK_IMPORTED_MODULE_1___default().compareBuild(`0.0.0+${patchAndBuild(a)}`, `0.0.0+${patchAndBuild(b)}`);
+    }
     async getAvailableVersions() {
         if (_actions_core__WEBPACK_IMPORTED_MODULE_3__/* .isDebug */ ._o()) {
             console.time('Retrieving available versions for Liberica took'); // eslint-disable-line no-console
@@ -131,6 +163,10 @@ class LibericaDistributions extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
         const { featureVersion, interimVersion, updateVersion } = version;
         const buildVersion = version.version.split('+')[1] || version.buildVersion;
         const mainVersion = [featureVersion, interimVersion, updateVersion].join('.');
+        const patchVersion = version.version.split('+')[0].split('.')[3];
+        if (patchVersion) {
+            return `${mainVersion}+${patchVersion}.${buildVersion}`;
+        }
         if (buildVersion != 0) {
             return `${mainVersion}+${buildVersion}`;
         }

dist/setup/81.index.js

@@ -85,7 +85,7 @@ function getMavenServerSettings() {
                 passwordEnvVar: getInputWithDeprecatedAlias(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_SERVER_PASSWORD_ENV_VAR */ .r4, _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_SERVER_PASSWORD_DEPRECATED */ .Vt, _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_DEFAULT_SERVER_PASSWORD */ .xp)
             }
         ];
-    return addMavenServerRepositoryOrigins(servers, _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .getMultilineInput */ .q3(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_SERVER_REPOSITORY_ORIGINS */ .gR));
+    return addMavenServerRepositoryOrigins(servers, _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .getMultilineInput */ .q3(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_SERVER_REPOSITORY_ORIGINS */ .Pt));
 }
 // only exported for testing purposes
 function parseMavenServerCredentials(entries) {
@@ -169,18 +169,21 @@ function addMavenServerRepositoryOrigins(servers, entries) {
 // only exported for testing purposes
 function getMavenRepositorySettings() {
     const entries = _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .getMultilineInput */ .q3(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_REPOSITORIES */ .W2);
-    if (!entries.some(entry => entry.trim())) {
+    const pluginEntries = _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .getMultilineInput */ .q3(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_PLUGIN_REPOSITORIES */ .gR);
+    if (!entries.some(entry => entry.trim()) &&
+        !pluginEntries.some(entry => entry.trim())) {
         return undefined;
     }
     const includeCentral = (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getBooleanInput */ .Vt)(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL */ .H5, true);
     return {
         repositories: parseMavenRepositories(entries, includeCentral),
+        pluginRepositories: parseMavenRepositories(pluginEntries, includeCentral, _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_PLUGIN_REPOSITORIES */ .gR),
         includeCentral,
         prioritizeCentral: (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getBooleanInput */ .Vt)(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL */ .OT, true)
     };
 }
 // only exported for testing purposes
-function parseMavenRepositories(entries, includeCentral) {
+function parseMavenRepositories(entries, includeCentral, inputName = _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_REPOSITORIES */ .W2) {
     const repositories = [];
     const repositoryIds = new Set();
     entries.forEach((entry, index) => {
@@ -190,7 +193,7 @@ function parseMavenRepositories(entries, includeCentral) {
         const firstSeparator = entry.indexOf(':');
         const lastSeparator = entry.lastIndexOf(':');
         if (firstSeparator <= 0 || lastSeparator <= firstSeparator) {
-            throw new Error(`Invalid mvn-repositories entry at line ${index + 1}. Expected format: repository-id:repository-url:snapshots-enabled`);
+            throw new Error(`Invalid ${inputName} entry at line ${index + 1}. Expected format: repository-id:repository-url:snapshots-enabled`);
         }
         const id = entry.slice(0, firstSeparator).trim();
         const url = entry.slice(firstSeparator + 1, lastSeparator).trim();
@@ -199,13 +202,13 @@ function parseMavenRepositories(entries, includeCentral) {
             .trim()
             .toLowerCase();
         if (!id || !url || !snapshotsValue) {
-            throw new Error(`Invalid mvn-repositories entry at line ${index + 1}. repository-id, repository URL, and snapshots-enabled are required`);
+            throw new Error(`Invalid ${inputName} entry at line ${index + 1}. repository-id, repository URL, and snapshots-enabled are required`);
         }
         if (snapshotsValue !== 'true' && snapshotsValue !== 'false') {
-            throw new Error(`Invalid snapshots-enabled value '${snapshotsValue}' in mvn-repositories entry at line ${index + 1}. Expected true or false`);
+            throw new Error(`Invalid snapshots-enabled value '${snapshotsValue}' in ${inputName} entry at line ${index + 1}. Expected true or false`);
         }
         if (repositoryIds.has(id)) {
-            throw new Error(`Duplicate repository-id '${id}' in mvn-repositories input`);
+            throw new Error(`Duplicate repository-id '${id}' in ${inputName} input`);
         }
         if (includeCentral && id === _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_ID */ .xg) {
             throw new Error(`Repository-id '${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_ID */ .xg}' is reserved when ${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL */ .H5} is enabled`);
@@ -219,6 +222,37 @@ function parseMavenRepositories(entries, includeCentral) {
     });
     return repositories;
 }
+function generateRepositorySection(customRepositories, settings, element) {
+    if (!customRepositories.length && settings.includeCentral) {
+        return [];
+    }
+    const centralRepository = {
+        id: _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_ID */ .xg,
+        url: _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_URL */ .jv,
+        snapshotsEnabled: false
+    };
+    const customCentralConfigured = customRepositories.some(repository => repository.id === _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_ID */ .xg);
+    const repositories = settings.includeCentral
+        ? settings.prioritizeCentral
+            ? [centralRepository, ...customRepositories]
+            : [...customRepositories, centralRepository]
+        : customCentralConfigured
+            ? customRepositories
+            : [...customRepositories, { ...centralRepository, releasesEnabled: false }];
+    const container = element === 'repository' ? 'repositories' : 'pluginRepositories';
+    const lines = [`      <${container}>`];
+    for (const repository of repositories) {
+        lines.push(`        <${element}>`, `          <id>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(repository.id)}</id>`, `          <url>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(repository.url)}</url>`, ...(repository.releasesEnabled === undefined
+            ? []
+            : [
+                '          <releases>',
+                `            <enabled>${repository.releasesEnabled}</enabled>`,
+                '          </releases>'
+            ]), '          <snapshots>', `            <enabled>${repository.snapshotsEnabled}</enabled>`, '          </snapshots>', `        </${element}>`);
+    }
+    lines.push(`      </${container}>`);
+    return lines;
+}
 async function createAuthenticationSettings(servers, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar = undefined, repositorySettings = undefined) {
     _actions_core__WEBPACK_IMPORTED_MODULE_1__/* .info */ .pq(`Creating ${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MVN_SETTINGS_FILE */ .vO} with server-id: ${servers.map(server => server.id).join(', ')}`);
     // when an alternate m2 location is specified use only that location (no .m2 directory)
@@ -258,33 +292,7 @@ function generate(servers, gpgPassphraseEnvVar, repositorySettings) {
     if (repositorySettings || includeGpgPassphraseProfile) {
         lines.push('  <profiles>');
         if (repositorySettings) {
-            const centralRepository = {
+            lines.push('    <profile>', `      <id>${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_REPOSITORIES_PROFILE_ID */ .hq}</id>`, ...generateRepositorySection(repositorySettings.repositories, repositorySettings, 'repository'), ...generateRepositorySection(repositorySettings.pluginRepositories ?? [], repositorySettings, 'pluginRepository'), '    </profile>');
-                id: _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_ID */ .xg,
-                url: _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_URL */ .jv,
-                snapshotsEnabled: false
-            };
-            const customCentralConfigured = repositorySettings.repositories.some(repository => repository.id === _constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_CENTRAL_REPOSITORY_ID */ .xg);
-            const repositories = repositorySettings.includeCentral
-                ? repositorySettings.prioritizeCentral
-                    ? [centralRepository, ...repositorySettings.repositories]
-                    : [...repositorySettings.repositories, centralRepository]
-                : customCentralConfigured
-                    ? repositorySettings.repositories
-                    : [
-                        ...repositorySettings.repositories,
-                        { ...centralRepository, releasesEnabled: false }
-                    ];
-            lines.push('    <profile>', `      <id>${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .MAVEN_REPOSITORIES_PROFILE_ID */ .hq}</id>`, '      <repositories>');
-            for (const repository of repositories) {
-                lines.push('        <repository>', `          <id>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(repository.id)}</id>`, `          <url>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(repository.url)}</url>`, ...(repository.releasesEnabled === undefined
-                    ? []
-                    : [
-                        '          <releases>',
-                        `            <enabled>${repository.releasesEnabled}</enabled>`,
-                        '          </releases>'
-                    ]), '          <snapshots>', `            <enabled>${repository.snapshotsEnabled}</enabled>`, '          </snapshots>', '        </repository>');
-            }
-            lines.push('      </repositories>', '    </profile>');
         }
         if (includeGpgPassphraseProfile) {
             lines.push('    <profile>', `      <id>${_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .GPG_PASSPHRASE_PROFILE_ID */ .K$}</id>`, '      <properties>', `        <gpg.passphraseEnvName>${(0,_xml_js__WEBPACK_IMPORTED_MODULE_8__/* .escapeXmlText */ .I)(gpgPassphraseEnvVar)}</gpg.passphraseEnvName>`, '      </properties>', '    </profile>');

dist/setup/index.js

@@ -7217,7 +7217,7 @@ function defaultFactory (origin, opts) {
 }
 
 class Agent extends DispatcherBase {
-  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, ...options } = {}) {
+  constructor ({ factory = defaultFactory, maxRedirections = 0, connect, tls, ...options } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
@@ -7236,11 +7236,15 @@ class Agent extends DispatcherBase {
       connect = { ...connect }
     }
 
+    if (tls && typeof tls !== 'function') {
+      tls = { ...tls }
+    }
+
     this[kInterceptors] = options.interceptors?.Agent && Array.isArray(options.interceptors.Agent)
       ? options.interceptors.Agent
       : [createRedirectInterceptor({ maxRedirections })]
 
-    this[kOptions] = { ...util.deepClone(options), connect }
+    this[kOptions] = { ...util.deepClone(options), connect, tls }
     this[kOptions].interceptors = options.interceptors
       ? { ...options.interceptors }
       : undefined
@@ -8273,8 +8277,6 @@ async function connectH1 (client, socket) {
   socket[kParser] = new Parser(client, socket, llhttpInstance)
 
   addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     const parser = this[kParser]
 
     // On Mac OS, we get an ECONNRESET even if there is a full body to be forwarded
@@ -9204,8 +9206,6 @@ async function connectH2 (client, socket) {
   socket[kHTTP2Session] = session
 
   util.addListener(socket, 'error', function (err) {
-    assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
     this[kError] = err
 
     this[kClient][kOnError](err)
@@ -9279,8 +9279,6 @@ function resumeH2 (client) {
 }
 
 function onHttp2SessionError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   this[kSocket][kError] = err
   this[kClient][kOnError](err)
 }
@@ -9978,9 +9976,10 @@ class Client extends DispatcherBase {
     // h2
     maxConcurrentStreams,
     allowH2,
-    webSocket
+    webSocket,
+    eventSource
   } = {}) {
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -10501,6 +10500,7 @@ module.exports = Client
 
 
 
+const buffer = __nccwpck_require__(4573)
 const Dispatcher = __nccwpck_require__(883)
 const {
   ClientDestroyedError,
@@ -10513,6 +10513,7 @@ const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kInterceptedDispatch = Symbol('Intercepted Dispatch')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   constructor (opts) {
@@ -10523,6 +10524,7 @@ class DispatcherBase extends Dispatcher {
     this[kClosed] = false
     this[kOnClosed] = []
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   get webSocketOptions () {
@@ -10532,6 +10534,12 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   get destroyed () {
     return this[kDestroyed]
   }
@@ -16890,6 +16898,7 @@ module.exports = {
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 
+const buffer = __nccwpck_require__(4573)
 const { Transform } = __nccwpck_require__(7075)
 const { isASCIINumber, isValidLastEventId } = __nccwpck_require__(4811)
 
@@ -16914,11 +16923,19 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
 const RETRY = Buffer.from('retry')
 
+// Each data field creates a string node, and each unconsumed input chunk keeps
+// a Buffer wrapper. The absolute ceiling protects the large default byte limit.
+const minParserItems = 1024
+const maxParserItems = 131072
+const bytesPerParserItem = 128
+
 function isASCIINumberBytes (buffer, start) {
   if (start >= buffer.length) {
     return false
@@ -16957,6 +16974,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -17005,6 +17028,13 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  lineLength = 0
+  eventSize = 0
+  eventFieldSizes = { data: 0, event: 0, id: 0, retry: 0 }
+  dataLineCount = 0
+  maxEventSize
+  maxDataLines
+  maxBufferedChunks
 
   event = {
     data: undefined,
@@ -17015,6 +17045,7 @@ class EventSourceStream extends Transform {
 
   /**
    * @param {object} options
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} options.eventSourceSettings
    * @param {Function} [options.push]
    */
@@ -17026,6 +17057,12 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
+    const parserItemLimit = this.maxEventSize > 0
+      ? Math.min(maxParserItems, Math.max(minParserItems, Math.floor(this.maxEventSize / bytesPerParserItem)))
+      : 0
+    this.maxDataLines = parserItemLimit
+    this.maxBufferedChunks = parserItemLimit
     if (options.push) {
       this.push = options.push
     }
@@ -17043,6 +17080,14 @@ class EventSourceStream extends Transform {
       return
     }
 
+    // A leading line ending can immediately release the currently buffered
+    // line, even when it uses the final allowed chunk slot.
+    if (this.maxEventSize > 0 &&
+        this.chunks.length >= this.maxBufferedChunks &&
+        chunk[0] !== LF && chunk[0] !== CR) {
+      callback(createMaxEventSizeExceededError())
+      return
+    }
     this.chunks.push(chunk)
 
     // Strip leading byte-order-mark if we opened the stream and started
@@ -17121,7 +17166,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
+        try {
           this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -17130,15 +17180,28 @@ class EventSourceStream extends Transform {
         continue
       }
 
+      // readLine() is only called after CR or LF. Reject an unfinished line
+      // before it can retain an unbounded number of decoded chunks. The seven
+      // extra bytes allow the longest field prefix ("event: " or "retry: ").
+      if (this.maxEventSize > 0 && ++this.lineLength > this.maxEventSize + 7) {
+        callback(createMaxEventSizeExceededError())
+        return
+      }
       this.advanceCursor()
     }
 
     callback()
   }
 
+  _destroy (error, callback) {
+    this.chunks.length = 0
+    this.clearEvent()
+    super._destroy(error, callback)
+  }
+
   /**
    * @param {Buffer} line
-   * @param {EventStreamEvent} event
+   * @param {EventSourceStreamEvent} event
    */
   parseLine (line, event) {
     // If the line is empty (a blank line)
@@ -17172,6 +17235,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      if (this.maxEventSize > 0 && this.dataLineCount >= this.maxDataLines) {
+        throw createMaxEventSizeExceededError()
+      }
+      const valueBytes = line.length - valueStart
+      const dataSize = this.eventFieldSizes.data + (event.data === undefined ? 0 : 1) + valueBytes
+      this.setEventFieldSize('data', dataSize)
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -17179,11 +17249,13 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.dataLineCount++
       return
     }
 
     if (isFieldName(line, fieldLength, RETRY)) {
       if (isASCIINumberBytes(line, valueStart)) {
+        this.setEventFieldSize('retry', line.length - valueStart)
         event.retry = line.toString('utf8', valueStart)
       }
       return
@@ -17191,18 +17263,27 @@ class EventSourceStream extends Transform {
 
     if (isFieldName(line, fieldLength, ID)) {
       if (isValidLastEventIdBytes(line, valueStart)) {
+        this.setEventFieldSize('id', line.length - valueStart)
         event.id = line.toString('utf8', valueStart)
       }
       return
     }
 
     if (isFieldName(line, fieldLength, EVENT)) {
-      const value = line.toString('utf8', valueStart)
+      if (valueStart < line.length) {
+        this.setEventFieldSize('event', line.length - valueStart)
+        event.event = line.toString('utf8', valueStart)
+      }
+    }
+  }
 
-      if (value.length > 0) {
+  setEventFieldSize (field, size) {
-        event.event = value
+    const eventSize = this.eventSize - this.eventFieldSizes[field] + size
-      }
+    if (this.maxEventSize > 0 && eventSize > this.maxEventSize) {
+      throw createMaxEventSizeExceededError()
     }
+    this.eventSize = eventSize
+    this.eventFieldSizes[field] = size
   }
 
   /**
@@ -17235,6 +17316,12 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventSize = 0
+    this.dataLineCount = 0
+    this.eventFieldSizes.data = 0
+    this.eventFieldSizes.event = 0
+    this.eventFieldSizes.id = 0
+    this.eventFieldSizes.retry = 0
   }
 
   hasPendingEvent () {
@@ -17270,14 +17357,16 @@ class EventSourceStream extends Transform {
   syncLineStartToCursor () {
     this.lineChunkIndex = this.chunkIndex
     this.linePos = this.pos
+    this.lineLength = 0
     this.dropConsumedChunks()
   }
 
   dropConsumedChunks () {
-    while (this.lineChunkIndex > 0) {
+    if (this.lineChunkIndex > 0) {
-      this.chunks.shift()
+      const consumed = this.lineChunkIndex
-      this.lineChunkIndex--
+      this.chunks.splice(0, consumed)
-      this.chunkIndex--
+      this.lineChunkIndex = 0
+      this.chunkIndex -= consumed
     }
 
     if (this.chunkIndex === this.chunks.length) {
@@ -17402,6 +17491,7 @@ const { isNetworkError } = __nccwpck_require__(9051)
 const { delay } = __nccwpck_require__(4811)
 const { kEnumerableProperty } = __nccwpck_require__(3440)
 const { environmentSettingsObject } = __nccwpck_require__(3168)
+const { getGlobalDispatcher } = __nccwpck_require__(2581)
 
 let experimentalWarned = false
 
@@ -17683,6 +17773,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -17861,7 +17952,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   }
 ])
 
@@ -22957,8 +23049,10 @@ async function httpNetworkFetch (
   // 19. Run these steps in parallel:
 
   //    1. Run these steps, but abort when fetchParams is canceled:
-  fetchParams.controller.onAborted = onAborted
+  if (!fetchParams.controller.resume) {
     fetchParams.controller.on('terminated', onAborted)
+  }
+
   fetchParams.controller.resume = async () => {
     // 1. While true
     while (true) {
@@ -23127,8 +23221,6 @@ async function httpNetworkFetch (
           }
           location = headersList.get('location', true)
 
-          this.body = new Readable({ read: resume })
-
           const decoders = []
 
           const willFollow = location && request.redirect === 'follow' &&
@@ -23146,7 +23238,7 @@ async function httpNetworkFetch (
             // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
             const maxContentEncodings = 5
             if (codings.length > maxContentEncodings) {
-              reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+              this.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
               return true
             }
 
@@ -23179,6 +23271,8 @@ async function httpNetworkFetch (
             }
           }
 
+          this.body = new Readable({ read: resume })
+
           const onError = this.onError.bind(this)
 
           resolve({
@@ -23225,10 +23319,6 @@ async function httpNetworkFetch (
             fetchParams.controller.off('terminated', this.abort)
           }
 
-          if (fetchParams.controller.onAborted) {
-            fetchParams.controller.off('terminated', fetchParams.controller.onAborted)
-          }
-
           fetchParams.controller.ended = true
 
           this.body.push(null)
@@ -29703,6 +29793,20 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          const socket = this.ws[kResponse].socket
+          if (this.#loop && socket.writableNeedDrain) {
+            this.#loop = false
+            socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {
@@ -31046,6 +31150,7 @@ module.exports = {
 /* harmony export */   OD: () => (/* binding */ INPUT_DEFAULT_GPG_PRIVATE_KEY),
 /* harmony export */   OT: () => (/* binding */ INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL),
 /* harmony export */   PG: () => (/* binding */ MACOS_JAVA_CONTENT_POSTFIX),
+/* harmony export */   Pt: () => (/* binding */ INPUT_MVN_SERVER_REPOSITORY_ORIGINS),
 /* harmony export */   QM: () => (/* binding */ INPUT_JAVA_VERSION),
 /* harmony export */   RX: () => (/* binding */ INPUT_DEFAULT_GPG_PASSPHRASE),
 /* harmony export */   TS: () => (/* binding */ INPUT_OVERWRITE_SETTINGS),
@@ -31060,7 +31165,7 @@ module.exports = {
 /* harmony export */   af: () => (/* binding */ INPUT_JAVA_VERSION_FILE),
 /* harmony export */   db: () => (/* binding */ INPUT_GPG_PASSPHRASE_ENV_VAR),
 /* harmony export */   fd: () => (/* binding */ INPUT_SERVER_ID),
-/* harmony export */   gR: () => (/* binding */ INPUT_MVN_SERVER_REPOSITORY_ORIGINS),
+/* harmony export */   gR: () => (/* binding */ INPUT_MVN_PLUGIN_REPOSITORIES),
 /* harmony export */   g_: () => (/* binding */ INPUT_DISTRIBUTION),
 /* harmony export */   gk: () => (/* binding */ INPUT_CACHE),
 /* harmony export */   hq: () => (/* binding */ MAVEN_REPOSITORIES_PROFILE_ID),
@@ -31109,6 +31214,7 @@ const SIGNATURE_VERIFICATION_FAILURE_HELP = `If this is a legitimate vendor sign
 const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
 const INPUT_MVN_SERVER_REPOSITORY_ORIGINS = 'mvn-server-repository-origins';
 const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
+const INPUT_MVN_PLUGIN_REPOSITORIES = 'mvn-plugin-repositories';
 const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL = 'mvn-repositories-include-central';
 const INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL = 'mvn-repositories-prioritize-central';
 const INPUT_SERVER_ID = 'server-id';

docs/advanced-usage.md

@@ -83,6 +83,12 @@ steps:
 
 ### Liberica
 
+Exact patch releases use SDKMAN's `X.Y.Z+P.B` notation, including in `.sdkmanrc`.
+For example, `java=17.0.20+1.1-librca` selects BellSoft's `17.0.20.1+1` release.
+Alternatively, `java-version: '17.0.20.1'` selects the newest build of patch 1,
+whereas `java-version: '17.0.20+1'` selects the exact unpatched build 1.
+Floating versions such as `17` prefer newer patches before comparing build numbers.
+
 ```yaml
 steps:
   - uses: actions/checkout@v7
@@ -1003,14 +1009,92 @@ This configuration adds the following active profile to `settings.xml`:
 </activeProfiles>
 ```
 
-Maven Central is included first by default. Set
+Maven Central is included first by default. The Central controls apply to both
-`mvn-repositories-prioritize-central: false` to place custom repositories
+dependency and plugin repositories. Set
-first, or set `mvn-repositories-include-central: false` to disable Central. The
+`mvn-repositories-prioritize-central: false` to place custom repositories first
-generated profile overrides the Central repository inherited from Maven's Super
+within each configured list, or set `mvn-repositories-include-central: false` to
-POM with releases and snapshots disabled. When automatic Central inclusion is
+disable Central for both types. The generated profile overrides the dependency
-off, the ID `central` may instead be declared explicitly in `mvn-repositories`
+and plugin Central repositories inherited from Maven's Super POM with releases
-to replace it with a user-specified repository; otherwise that ID is reserved
+and snapshots disabled, even if only one custom repository list is supplied.
-to prevent duplicate entries.
+These controls have no effect when neither list contains a nonblank entry.
+
+When automatic Central inclusion is off, the ID `central` may instead be
+declared explicitly in `mvn-repositories` or `mvn-plugin-repositories` to replace
+it with a user-specified repository for that type. Declaring it in one list
+does not enable Central in the other. Otherwise that ID is reserved to prevent
+duplicate entries. Other repositories declared in your project's POM are not
+disabled by these controls.
+
+### Resolving Maven plugins from custom repositories
+
+Maven resolves build plugins through `<pluginRepositories>`, separately from
+dependency `<repositories>`. Use `mvn-plugin-repositories` to configure plugin
+resolution with the same multiline `repository-id:repository-url:snapshots-enabled`
+format. It can be supplied without `mvn-repositories`; dependency repositories
+are not automatically used as plugin repositories.
+
+For example, configure the same private repository for dependencies and plugins
+and disable inherited Maven Central for both:
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v6
+    with:
+      distribution: 'temurin'
+      java-version: '21'
+      mvn-server-credentials: |
+        private:PRIVATE_REPOSITORY_USERNAME:PRIVATE_REPOSITORY_TOKEN
+      mvn-repositories: |
+        private:https://maven.example.com/releases:false
+      mvn-plugin-repositories: |
+        private:https://maven.example.com/releases:false
+      mvn-repositories-include-central: false
+  - run: mvn --batch-mode verify
+    env:
+      PRIVATE_REPOSITORY_USERNAME: ${{ secrets.PRIVATE_REPOSITORY_USERNAME }}
+      PRIVATE_REPOSITORY_TOKEN: ${{ secrets.PRIVATE_REPOSITORY_TOKEN }}
+```
+
+The matching ID `private` selects the same server credentials for both types.
+IDs must be unique within each list, but can be shared across the two lists.
+Public repositories do not require a matching credential entry.
+
+Alongside dependency repositories, the active `setup-java-repositories` profile
+contains:
+
+```xml
+<pluginRepositories>
+  <pluginRepository>
+    <id>private</id>
+    <url>https://maven.example.com/releases</url>
+    <snapshots>
+      <enabled>false</enabled>
+    </snapshots>
+  </pluginRepository>
+  <pluginRepository>
+    <id>central</id>
+    <url>https://repo.maven.apache.org/maven2</url>
+    <releases>
+      <enabled>false</enabled>
+    </releases>
+    <snapshots>
+      <enabled>false</enabled>
+    </snapshots>
+  </pluginRepository>
+</pluginRepositories>
+```
+
+Omitting a Central override would leave the Super POM's plugin repository
+enabled. In particular, `mvn-repositories-include-central: false` now disables
+inherited plugin Central even for existing workflows that only configure
+`mvn-repositories`. To download plugins in such workflows, configure a plugin
+repository or explicitly declare `central` in `mvn-plugin-repositories`.
+
+With Central included, it is placed before custom plugin repositories by
+default; `mvn-repositories-prioritize-central: false` places it after them.
+All repository generation respects `settings-path` and `overwrite-settings`;
+an existing settings file is left untouched when `overwrite-settings: false`.
 
 ### GPG
 

package-lock.json

@@ -4320,13 +4320,13 @@
       "license": "ISC"
     },
     "node_modules/handlebars": {
-      "version": "4.7.9",
+      "version": "4.7.10",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.10.tgz",
-      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
+      "integrity": "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "minimist": "^1.2.5",
+        "minimist": "^1.2.8",
         "neo-async": "^2.6.2",
         "source-map": "^0.6.1",
         "wordwrap": "^1.0.0"
@@ -6375,9 +6375,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.29.0",
+      "version": "6.29.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",
-      "integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
+      "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

src/auth.ts

@@ -25,6 +25,7 @@ export interface MavenRepository {
 
 export interface MavenRepositorySettings {
   repositories: MavenRepository[];
+  pluginRepositories?: MavenRepository[];
   includeCentral: boolean;
   prioritizeCentral: boolean;
 }
@@ -245,7 +246,13 @@ export function addMavenServerRepositoryOrigins(
 export function getMavenRepositorySettings():
   MavenRepositorySettings | undefined {
   const entries = core.getMultilineInput(constants.INPUT_MVN_REPOSITORIES);
-  if (!entries.some(entry => entry.trim())) {
+  const pluginEntries = core.getMultilineInput(
+    constants.INPUT_MVN_PLUGIN_REPOSITORIES
+  );
+  if (
+    !entries.some(entry => entry.trim()) &&
+    !pluginEntries.some(entry => entry.trim())
+  ) {
     return undefined;
   }
 
@@ -255,6 +262,11 @@ export function getMavenRepositorySettings():
   );
   return {
     repositories: parseMavenRepositories(entries, includeCentral),
+    pluginRepositories: parseMavenRepositories(
+      pluginEntries,
+      includeCentral,
+      constants.INPUT_MVN_PLUGIN_REPOSITORIES
+    ),
     includeCentral,
     prioritizeCentral: getBooleanInput(
       constants.INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL,
@@ -266,7 +278,8 @@ export function getMavenRepositorySettings():
 // only exported for testing purposes
 export function parseMavenRepositories(
   entries: string[],
-  includeCentral: boolean
+  includeCentral: boolean,
+  inputName = constants.INPUT_MVN_REPOSITORIES
 ): MavenRepository[] {
   const repositories: MavenRepository[] = [];
   const repositoryIds = new Set<string>();
@@ -280,7 +293,7 @@ export function parseMavenRepositories(
     const lastSeparator = entry.lastIndexOf(':');
     if (firstSeparator <= 0 || lastSeparator <= firstSeparator) {
       throw new Error(
-        `Invalid mvn-repositories entry at line ${index + 1}. Expected format: repository-id:repository-url:snapshots-enabled`
+        `Invalid ${inputName} entry at line ${index + 1}. Expected format: repository-id:repository-url:snapshots-enabled`
       );
     }
 
@@ -292,18 +305,16 @@ export function parseMavenRepositories(
       .toLowerCase();
     if (!id || !url || !snapshotsValue) {
       throw new Error(
-        `Invalid mvn-repositories entry at line ${index + 1}. repository-id, repository URL, and snapshots-enabled are required`
+        `Invalid ${inputName} entry at line ${index + 1}. repository-id, repository URL, and snapshots-enabled are required`
       );
     }
     if (snapshotsValue !== 'true' && snapshotsValue !== 'false') {
       throw new Error(
-        `Invalid snapshots-enabled value '${snapshotsValue}' in mvn-repositories entry at line ${index + 1}. Expected true or false`
+        `Invalid snapshots-enabled value '${snapshotsValue}' in ${inputName} entry at line ${index + 1}. Expected true or false`
       );
     }
     if (repositoryIds.has(id)) {
-      throw new Error(
+      throw new Error(`Duplicate repository-id '${id}' in ${inputName} input`);
-        `Duplicate repository-id '${id}' in mvn-repositories input`
-      );
     }
     if (includeCentral && id === constants.MAVEN_CENTRAL_REPOSITORY_ID) {
       throw new Error(
@@ -322,6 +333,56 @@ export function parseMavenRepositories(
   return repositories;
 }
 
+function generateRepositorySection(
+  customRepositories: MavenRepository[],
+  settings: MavenRepositorySettings,
+  element: 'repository' | 'pluginRepository'
+): string[] {
+  if (!customRepositories.length && settings.includeCentral) {
+    return [];
+  }
+
+  const centralRepository: MavenRepository = {
+    id: constants.MAVEN_CENTRAL_REPOSITORY_ID,
+    url: constants.MAVEN_CENTRAL_REPOSITORY_URL,
+    snapshotsEnabled: false
+  };
+  const customCentralConfigured = customRepositories.some(
+    repository => repository.id === constants.MAVEN_CENTRAL_REPOSITORY_ID
+  );
+  const repositories = settings.includeCentral
+    ? settings.prioritizeCentral
+      ? [centralRepository, ...customRepositories]
+      : [...customRepositories, centralRepository]
+    : customCentralConfigured
+      ? customRepositories
+      : [...customRepositories, {...centralRepository, releasesEnabled: false}];
+  const container =
+    element === 'repository' ? 'repositories' : 'pluginRepositories';
+  const lines = [`      <${container}>`];
+
+  for (const repository of repositories) {
+    lines.push(
+      `        <${element}>`,
+      `          <id>${escapeXmlText(repository.id)}</id>`,
+      `          <url>${escapeXmlText(repository.url)}</url>`,
+      ...(repository.releasesEnabled === undefined
+        ? []
+        : [
+            '          <releases>',
+            `            <enabled>${repository.releasesEnabled}</enabled>`,
+            '          </releases>'
+          ]),
+      '          <snapshots>',
+      `            <enabled>${repository.snapshotsEnabled}</enabled>`,
+      '          </snapshots>',
+      `        </${element}>`
+    );
+  }
+  lines.push(`      </${container}>`);
+  return lines;
+}
+
 export async function createAuthenticationSettings(
   servers: MavenServerCredentials[],
   settingsDirectory: string,
@@ -389,49 +450,21 @@ export function generate(
   if (repositorySettings || includeGpgPassphraseProfile) {
     lines.push('  <profiles>');
     if (repositorySettings) {
-      const centralRepository: MavenRepository = {
-        id: constants.MAVEN_CENTRAL_REPOSITORY_ID,
-        url: constants.MAVEN_CENTRAL_REPOSITORY_URL,
-        snapshotsEnabled: false
-      };
-      const customCentralConfigured = repositorySettings.repositories.some(
-        repository => repository.id === constants.MAVEN_CENTRAL_REPOSITORY_ID
-      );
-      const repositories = repositorySettings.includeCentral
-        ? repositorySettings.prioritizeCentral
-          ? [centralRepository, ...repositorySettings.repositories]
-          : [...repositorySettings.repositories, centralRepository]
-        : customCentralConfigured
-          ? repositorySettings.repositories
-          : [
-              ...repositorySettings.repositories,
-              {...centralRepository, releasesEnabled: false}
-            ];
-
       lines.push(
         '    <profile>',
         `      <id>${constants.MAVEN_REPOSITORIES_PROFILE_ID}</id>`,
-        '      <repositories>'
+        ...generateRepositorySection(
+          repositorySettings.repositories,
+          repositorySettings,
+          'repository'
+        ),
+        ...generateRepositorySection(
+          repositorySettings.pluginRepositories ?? [],
+          repositorySettings,
+          'pluginRepository'
+        ),
+        '    </profile>'
       );
-      for (const repository of repositories) {
-        lines.push(
-          '        <repository>',
-          `          <id>${escapeXmlText(repository.id)}</id>`,
-          `          <url>${escapeXmlText(repository.url)}</url>`,
-          ...(repository.releasesEnabled === undefined
-            ? []
-            : [
-                '          <releases>',
-                `            <enabled>${repository.releasesEnabled}</enabled>`,
-                '          </releases>'
-              ]),
-          '          <snapshots>',
-          `            <enabled>${repository.snapshotsEnabled}</enabled>`,
-          '          </snapshots>',
-          '        </repository>'
-        );
-      }
-      lines.push('      </repositories>', '    </profile>');
     }
     if (includeGpgPassphraseProfile) {
       lines.push(

src/constants.ts

@@ -19,6 +19,7 @@ export const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
 export const INPUT_MVN_SERVER_REPOSITORY_ORIGINS =
   'mvn-server-repository-origins';
 export const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
+export const INPUT_MVN_PLUGIN_REPOSITORIES = 'mvn-plugin-repositories';
 export const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL =
   'mvn-repositories-include-central';
 export const INPUT_MVN_REPOSITORIES_PRIORITIZE_CENTRAL =

src/distributions/base-installer.ts

@@ -241,7 +241,7 @@ export abstract class JavaBase {
             if (javaRelease.floating) {
               if (
                 !semver.valid(foundJava.version) ||
-                !isVersionSatisfies(this.version, foundJava.version)
+                !this.isVersionSatisfied(this.version, foundJava.version)
               ) {
                 throw new Error(
                   `The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`
@@ -401,7 +401,7 @@ export abstract class JavaBase {
     }
     if (
       !semver.valid(restored.release.version) ||
-      !isVersionSatisfies(this.version, restored.release.version)
+      !this.isVersionSatisfied(this.version, restored.release.version)
     ) {
       core.debug(
         `Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`
@@ -622,10 +622,10 @@ export abstract class JavaBase {
       .filter(item => item.stable === this.stable);
 
     const satisfiedVersions = availableVersions
-      .filter(item => isVersionSatisfies(this.version, item.version))
+      .filter(item => this.isVersionSatisfied(this.version, item.version))
       .filter(item => item.path)
       .sort((a, b) => {
-        return -semver.compareBuild(a.version, b.version);
+        return -this.compareVersions(a.version, b.version);
       });
     if (!satisfiedVersions || satisfiedVersions.length === 0) {
       return null;
@@ -637,6 +637,14 @@ export abstract class JavaBase {
     };
   }
 
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    return isVersionSatisfies(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    return semver.compareBuild(a, b);
+  }
+
   protected normalizeVersion(version: string) {
     let stable = true;
     const latest = false;

src/distributions/liberica/installer.ts

@@ -9,7 +9,6 @@ import {
   cacheJdkDir,
   extractJdkFile,
   getDownloadArchiveExtension,
-  isVersionSatisfies,
   renameWinArchive
 } from '../../util.js';
 import * as core from '@actions/core';
@@ -66,8 +65,8 @@ export class LibericaDistributions extends JavaBase {
     }));
 
     const satisfiedVersion = availableVersions
-      .filter(item => isVersionSatisfies(range, item.version))
+      .filter(item => this.isVersionSatisfied(range, item.version))
-      .sort((a, b) => -semver.compareBuild(a.version, b.version))[0];
+      .sort((a, b) => -this.compareVersions(a.version, b.version))[0];
 
     if (!satisfiedVersion) {
       const availableVersionStrings = availableVersions.map(
@@ -79,6 +78,45 @@ export class LibericaDistributions extends JavaBase {
     return satisfiedVersion;
   }
 
+  protected normalizeVersion(version: string) {
+    const normalized = super.normalizeVersion(version);
+    if (/^\d+\.\d+\.\d+\.\d+(?:-ea)?$/.test(version)) {
+      // Keep patch-only requests distinct from exact SDKMAN build requests.
+      normalized.version = version.replace(/-ea$/, '');
+    }
+    return normalized;
+  }
+
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    const patchRequest = range.match(/^(\d+\.\d+\.\d+)\.(\d+)$/);
+    if (patchRequest) {
+      const candidate = semver.parse(version);
+      if (!candidate || !semver.eq(patchRequest[1], candidate)) {
+        return false;
+      }
+      const patch = candidate.build.length > 1 ? candidate.build[0] : '0';
+      return patch === patchRequest[2];
+    }
+    return super.isVersionSatisfied(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    const mainComparison = semver.compare(a, b);
+    if (mainComparison !== 0) {
+      return mainComparison;
+    }
+
+    // SDKMAN encodes patch.build, but unpatched releases contain only build.
+    const patchAndBuild = (version: string): string => {
+      const build = new semver.SemVer(version).build;
+      return (build.length > 1 ? build : ['0', ...build]).join('.');
+    };
+    return semver.compareBuild(
+      `0.0.0+${patchAndBuild(a)}`,
+      `0.0.0+${patchAndBuild(b)}`
+    );
+  }
+
   private async getAvailableVersions(): Promise<LibericaVersion[]> {
     if (core.isDebug()) {
       console.time('Retrieving available versions for Liberica took'); // eslint-disable-line no-console
@@ -171,6 +209,10 @@ export class LibericaDistributions extends JavaBase {
     const mainVersion = [featureVersion, interimVersion, updateVersion].join(
       '.'
     );
+    const patchVersion = version.version.split('+')[0].split('.')[3];
+    if (patchVersion) {
+      return `${mainVersion}+${patchVersion}.${buildVersion}`;
+    }
     if (buildVersion != 0) {
       return `${mainVersion}+${buildVersion}`;
     }