Compare commits

..
Author SHA1 Message Date
copilot-swe-agent[bot]andbrunoborges cdb3217694 Stop GPG agent before verification home cleanup
Co-authored-by: brunoborges <129743+brunoborges@users.noreply.github.com>
2026-09-28 22:42:34 +00:00
copilot-swe-agent[bot] d7e7717fa7 Initial plan 2026-09-28 22:36:19 +00:00
28 changed files with 1205 additions and 2808 deletions

No files matched your search

+1 -1
View File
@@ -1,6 +1,6 @@
---
name: brace-expansion
version: 5.0.12
version: 5.0.9
type: npm
summary: Brace expansion as known from sh/bash
homepage:
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: fast-xml-parser
version: 5.11.1
version: 5.11.0
type: npm
summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
homepage:
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: undici
version: 6.29.0
version: 6.28.0
type: npm
summary: An HTTP/1.1 client, written from scratch for Node.js
homepage: https://undici.nodejs.org
+1 -4
View File
@@ -233,13 +233,10 @@ Additional distribution notes:
| --- | --- |
| Major version | `8`, `11`, `17`, `21`, `25` |
| Specific feature or patch version | `11.0`, `11.0.4`, `17.0`, `8.0.282+8` |
| Exact build, with optional `jdk-` prefix | `27+35`, `27.0+35`, `27.0.0+35`, `jdk-27+35` |
| JEP 322 multi-field versions | `11.0.9.1`, `18.0.1.1`, `26.0.2.1+1` |
| JEP 322 multi-field versions | `11.0.9.1`, `18.0.1.1` |
| Early access | `15-ea`, `15.0.0-ea`, `27-ea` |
| Latest stable GA release | `latest` |
Numeric Java versions can use a `jdk-` prefix. For example, `jdk-27+35`, `27+35`, and `27.0+35` all normalize to `27.0.0+35` and pin that exact build; `jdk-27` and `27` remain major-version ranges. The prefix does not select a distribution or package type. Release availability depends on the selected distribution and platform.
When `check-latest` is `false`, the action first tries the runner tool cache for the requested distribution, package type, architecture, and version range. It downloads Java only when no matching cached version is found. When `check-latest` is `true`, the action checks remote metadata first and downloads if the cached version is not current.
GitHub-hosted runners primarily pre-cache Eclipse Temurin JDKs. See the installed Java versions for [Ubuntu](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md#java), [Windows](https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md#java), and [macOS](https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md#java). On a fresh GitHub-hosted runner, requests for other distributions usually miss the tool cache and resolve from remote metadata. For broad version ranges such as a major version (`21`, `25`), this often behaves similarly to `check-latest: true` because the action downloads the latest available release that satisfies the range.
@@ -374,49 +374,6 @@ describe('findInToolcache', () => {
);
});
describe('exact build requests in tool-cache', () => {
afterEach(() => {
jest.resetAllMocks();
});
it.each(['jdk-27+35', '27+35', '27.0+35', '27.0.0+35'])(
'only matches the requested build for %s',
input => {
const findAllVersions = jest.mocked(tc.findAllVersions);
findAllVersions.mockReturnValue([
'27.0.1-35',
'27.0.0-36',
'27.0.0-ea.35',
'27.0.0-35'
]);
jest
.mocked(util.getToolcachePath)
.mockImplementation(
(toolname, version, architecture) =>
`/hostedtoolcache/${toolname}/${version}/${architecture}`
);
const distribution = new EmptyJavaBase({
version: input,
architecture: 'x64',
packageType: 'jdk',
checkLatest: false
});
expect(distribution['findInToolcache']()).toEqual({
version: '27.0.0+35',
path: '/hostedtoolcache/Java_Empty_jdk/27.0.0-35/x64'
});
findAllVersions.mockReturnValue([
'27.0.1-35',
'27.0.0-36',
'27.0.0-ea.35'
]);
expect(distribution['findInToolcache']()).toBeNull();
}
);
});
describe('setupJava', () => {
const actualJavaVersion = '11.0.9';
const installedJavaVersion = '11.0.8';
@@ -1792,15 +1749,6 @@ describe('normalizeVersion', () => {
const DummyJavaBase = JavaBase as any;
it.each([
['jdk-27+35', {version: '27.0.0+35', stable: true, latest: false}],
['27+35', {version: '27.0.0+35', stable: true, latest: false}],
['27.0+35', {version: '27.0.0+35', stable: true, latest: false}],
['jdk-27', {version: '27', stable: true, latest: false}],
['jdk-27.0', {version: '27.0', stable: true, latest: false}],
['jdk-27-ea', {version: '27', stable: false, latest: false}],
['jdk-27+35-ea', {version: '27.0.0+35', stable: false, latest: false}],
['jdk-27-ea.35', {version: '27.0.0+35', stable: false, latest: false}],
['jdk-26.0.2.1+1', {version: '26.0.2+1.1', stable: true, latest: false}],
['11', {version: '11', stable: true, latest: false}],
['11.0', {version: '11.0', stable: true, latest: false}],
['11.0.10', {version: '11.0.10', stable: true, latest: false}],
@@ -1810,8 +1758,6 @@ describe('normalizeVersion', () => {
['11.0.9.1', {version: '11.0.9+1', stable: true, latest: false}],
['12.0.2.1.0', {version: '12.0.2+1.0', stable: true, latest: false}],
['18.0.1.1-ea', {version: '18.0.1+1', stable: false, latest: false}],
['26.0.2.1+1', {version: '26.0.2+1.1', stable: true, latest: false}],
['25.0.4.1+1', {version: '25.0.4+1.1', stable: true, latest: false}],
['latest', {version: 'x', stable: true, latest: true}],
['LATEST', {version: 'x', stable: true, latest: true}],
[' Latest ', {version: 'x', stable: true, latest: true}]
@@ -1830,24 +1776,6 @@ describe('normalizeVersion', () => {
);
});
it.each([
'jdk-',
'jdk-latest',
'jdk-27.x',
'jdk->=27',
'jdk8u442-b06',
'temurin-27+35',
'jdk-27-ea+35',
'jdk-27+',
'jdk-27+35..1',
'27+35..1',
'jdk-27..0+35'
])('rejects malformed or unsupported release tags: %s', input => {
expect(() =>
DummyJavaBase.prototype.normalizeVersion.call(null, input)
).toThrow(/is not valid SemVer notation for a Java version/);
});
it.each(['latest-ea', 'latest.1', 'LATEST-EA', ' latest-ea '])(
'normalizeVersion should throw a targeted error for latest combined with a qualifier (%s)',
version => {
@@ -82,7 +82,7 @@ describe('getJavaDistribution', () => {
);
});
it.each(['8', '23.x', '23.0.1.1', '23.0.1.1+1', '<24', 'jdk-23+35'])(
it.each(['8', '23.x', '23.0.1.1', '<24'])(
"rejects Temurin java-package 'jdk+jmods' for version %s",
async version => {
await expect(
@@ -96,15 +96,7 @@ describe('getJavaDistribution', () => {
}
);
it.each([
'24',
'24.0.1.1',
'25.0.4.1+1',
'25-ea',
'>=21',
'latest',
'jdk-27+35'
])(
it.each(['24', '24.0.1.1', '25-ea', '>=21', 'latest'])(
"accepts Temurin java-package 'jdk+jmods' for version %s",
async version => {
expect(
@@ -125,17 +117,6 @@ describe('getJavaDistribution', () => {
).toBeNull();
});
it('does not change the distribution or package for a jdk-prefixed version', async () => {
const distribution = await getJavaDistribution(
JavaDistribution.Zulu,
installerOptions('jre', 'jdk-27+35')
);
expect(distribution!['distribution']).toBe('Zulu');
expect(distribution!['packageType']).toBe('jre');
expect(distribution!['version']).toBe('27.0.0+35');
});
it.each(['adopt', 'adopt-hotspot', 'adopt-openj9'])(
'does not support legacy Adopt distribution %s',
async distributionName => {
@@ -14,6 +14,7 @@ import type {IncomingMessage} from 'http';
import {Readable} from 'stream';
import manifestData from '../data/jetbrains.json' with {type: 'json'};
import os from 'os';
// Mock @actions/core before importing source modules that depend on it
jest.unstable_mockModule('@actions/core', () => ({
@@ -80,7 +81,6 @@ describe('getAvailableVersions', () => {
jest.setTimeout(10_000);
let spyHttpClient: any;
let spyHttpClientHead: any;
let spyCoreError: any;
const originalGitHubToken = process.env.GITHUB_TOKEN;
@@ -93,10 +93,6 @@ describe('getAvailableVersions', () => {
headers: {},
result: []
});
spyHttpClientHead = jest.spyOn(HttpClient.prototype, 'head');
spyHttpClientHead.mockResolvedValue({
message: {statusCode: 200}
} as any);
// Mock core.error to suppress error logs
spyCoreError = core.error as jest.Mock;
@@ -137,7 +133,9 @@ describe('getAvailableVersions', () => {
const availableVersions = await distribution['getAvailableVersions']();
expect(availableVersions).not.toBeNull();
expect(availableVersions.length).toBe(manifestData.length + 2);
const length =
os.platform() === 'win32' ? manifestData.length : manifestData.length + 2;
expect(availableVersions.length).toBe(length);
}, 10_000);
it('continues a stable request after an all-prerelease page', async () => {
@@ -360,7 +358,6 @@ describe('getAvailableVersions', () => {
it('retries a GitHub rate limit using Retry-After', async () => {
spyHttpClient.mockRestore();
spyHttpClientHead.mockRestore();
const sleep = jest.fn(async () => undefined);
const requestRaw = jest
.spyOn(HttpClient.prototype, 'requestRaw')
@@ -378,125 +378,6 @@ describe('findPackageForDownload', () => {
expect(resolvedVersion.version).toBe('16.0.2+7');
});
describe('OpenJDK versions and release tags', () => {
const makeRelease = (
semverVersion: string,
openjdkVersion: string,
versionData: Record<string, number>
) => ({
binaries: [
{
package: {
link: `https://example.com/${openjdkVersion}.tar.gz`,
checksum: `checksum-${openjdkVersion}`,
checksum_link: `https://example.com/${openjdkVersion}.sha256.txt`
}
}
],
version_data: {
semver: semverVersion,
openjdk_version: openjdkVersion,
minor: 0,
...versionData
}
});
const respinManifest = [
makeRelease('27.0.1+35', '27.0.1+35', {
major: 27,
security: 1,
build: 35
}),
makeRelease('27.0.0+36', '27+36', {
major: 27,
security: 0,
build: 36
}),
makeRelease('27.0.0+35', '27+35', {
major: 27,
security: 0,
build: 35
}),
makeRelease('26.0.2+101', '26.0.2.1+1', {
major: 26,
security: 2,
patch: 1,
build: 1
}),
makeRelease('26.0.2+10', '26.0.2+10', {
major: 26,
security: 2,
build: 10
}),
makeRelease('25.0.4+101.0.LTS', '25.0.4.1+1-LTS', {
major: 25,
security: 4,
patch: 1,
build: 1
}),
makeRelease('25.0.4+7.0.LTS', '25.0.4+7-LTS', {
major: 25,
security: 4,
build: 7
})
];
it.each([
['jdk-27+35', '27.0.0+35'],
['27+35', '27.0.0+35'],
['27.0+35', '27.0.0+35'],
['jdk-27.0.0+35', '27.0.0+35'],
['jdk-27', '27.0.1+35'],
['27', '27.0.1+35'],
['jdk-26.0.2.1+1', '26.0.2+101'],
['26.0.2.1+1', '26.0.2+101'],
['26.0.2+10', '26.0.2+10'],
['26', '26.0.2+101'],
['26.0.2', '26.0.2+101'],
['25.0.4.1+1', '25.0.4+101.0.LTS'],
['25.0.4+7', '25.0.4+7.0.LTS'],
['25.0.4', '25.0.4+101.0.LTS']
])('%s resolves to %s', async (input, expected) => {
const distribution = new TemurinDistribution(
{
version: input,
architecture: 'x64',
packageType: 'jdk',
checkLatest: false
},
TemurinImplementation.Hotspot
);
distribution['getAvailableVersions'] = async () => respinManifest as any;
const resolvedVersion = await distribution['findPackageForDownload'](
distribution['version']
);
expect(resolvedVersion.version).toBe(expected);
expect(resolvedVersion).not.toHaveProperty('openjdkVersion');
});
it.each(['26.0.2.2+1', 'jdk-27+34', '27+34'])(
'does not match a non-existent build or respin: %s',
async input => {
const distribution = new TemurinDistribution(
{
version: input,
architecture: 'x64',
packageType: 'jdk',
checkLatest: false
},
TemurinImplementation.Hotspot
);
distribution['getAvailableVersions'] = async () =>
respinManifest as any;
await expect(
distribution['findPackageForDownload'](distribution['version'])
).rejects.toThrow(
`No matching version found for SemVer '${distribution['version']}'`
);
}
);
});
it('version is found but binaries list is empty', async () => {
const distribution = new TemurinDistribution(
{
@@ -334,69 +334,6 @@ describe('findPackageForDownload', () => {
);
});
describe('hotfix builds with a 4-segment java_version', () => {
// Mirrors the Azul Metadata API: 25.0.4.1 hotfix is reported as
// java_version=[25,0,4,1], openjdk_build_number=1 (SDKMAN '25.0.4+1.1').
const hotfixManifest = [
{
package_uuid: 'uuid-25.0.4+7',
name: 'zulu25.36.15-ca-jdk25.0.4-linux_x64.tar.gz',
download_url:
'https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-linux_x64.tar.gz',
java_version: [25, 0, 4],
openjdk_build_number: 7,
distro_version: [25, 36, 15, 0],
latest: false,
availability_type: 'ca'
},
{
package_uuid: 'uuid-25.0.4+1.1',
name: 'zulu25.36.205-ca-jdk25.0.4.1-linux_x64.tar.gz',
download_url:
'https://cdn.azul.com/zulu/bin/zulu25.36.205-ca-jdk25.0.4.1-linux_x64.tar.gz',
java_version: [25, 0, 4, 1],
openjdk_build_number: 1,
distro_version: [25, 36, 205, 0],
latest: true,
availability_type: 'ca'
},
{
package_uuid: 'uuid-25.0.3+9',
name: 'zulu25.34.17-ca-jdk25.0.3-linux_x64.tar.gz',
download_url:
'https://cdn.azul.com/zulu/bin/zulu25.34.17-ca-jdk25.0.3-linux_x64.tar.gz',
java_version: [25, 0, 3],
openjdk_build_number: 9,
distro_version: [25, 34, 17, 0],
latest: false,
availability_type: 'ca'
}
] as IZuluVersions[];
it.each([
['25.0.4+1.1', '25.0.4+1.1', 'uuid-25.0.4+1.1'],
['25', '25.0.4+1.1', 'uuid-25.0.4+1.1'],
['25.0.4', '25.0.4+1.1', 'uuid-25.0.4+1.1'],
['25.0.4+7', '25.0.4+7', 'uuid-25.0.4+7'],
['25.0.3', '25.0.3+9', 'uuid-25.0.3+9']
])('version is %s -> %s', async (input, expected, uuid) => {
const distribution = new ZuluDistribution({
version: input,
architecture: 'x64',
packageType: 'jdk',
checkLatest: false
});
distribution['getAvailableVersions'] = async () => hotfixManifest;
const result = await distribution['findPackageForDownload'](
distribution['version']
);
expect(result.version).toBe(expected);
expect(result.url).toBe(
hotfixManifest.find(item => item.package_uuid === uuid)!.download_url
);
});
});
it('should throw an error', async () => {
const distribution = new ZuluDistribution({
version: '18',
-18
View File
@@ -102,24 +102,6 @@ describe('Java platform capabilities', () => {
}
);
it.each(['jdk-27+35', '27+35', 'jdk-27-ea.35'])(
'enforces version-dependent architecture restrictions for %s',
version => {
expect(() =>
validateJavaPlatform('corretto', 'linux', 'x86', version)
).toThrow(/x86 \(<12\)/);
}
);
it.each(['jdk-11+9', '11+9', 'jdk-11-ea.9'])(
'accepts compatible numeric release tags: %s',
version => {
expect(validateJavaPlatform('corretto', 'linux', 'x86', version)).toBe(
'x86'
);
}
);
it('allows local archives on any platform and architecture', () => {
expect(validateJavaPlatform('jdkfile', 'aix', 'mips64', '21')).toBe(
'mips64'
-33
View File
@@ -43,7 +43,6 @@ const core = await import('@actions/core');
const {
convertVersionToSemver,
normalizeJavaVersionToSemver,
getNextPageUrlFromLinkHeader,
getVersionFromFileContent,
isVersionSatisfies,
@@ -189,37 +188,6 @@ describe('convertVersionToSemver', () => {
});
});
describe('normalizeJavaVersionToSemver', () => {
it.each([
['jdk-27+35', '27.0.0+35'],
['27+35', '27.0.0+35'],
['27.0+35', '27.0.0+35'],
['jdk-27.0+35', '27.0.0+35'],
['jdk-27.0.0+35', '27.0.0+35'],
['jdk-27', '27'],
['jdk-27.0', '27.0'],
['jdk-27.0.1', '27.0.1'],
['27+35.0.LTS', '27.0.0+35.0.LTS'],
['jdk-26.0.2.1+1', '26.0.2+1.1'],
['jdk-11.0.9.1', '11.0.9+1'],
['17', '17'],
['17.0.8', '17.0.8'],
['17.0.8+7', '17.0.8+7'],
['11.0.9.1', '11.0.9+1'],
['12.0.2.1.0', '12.0.2+1.0'],
['26.0.2.1+1', '26.0.2+1.1'],
['17.0.8.1+1080.1', '17.0.8+1.1080.1'],
['>=11.0.9.1', '>=11.0.9.1'],
['17.x', '17.x'],
['>=17 <28', '>=17 <28'],
['jdk-27.x', 'jdk-27.x'],
['jdk-latest', 'jdk-latest'],
['temurin-27+35', 'temurin-27+35']
])('%s -> %s', (input: string, expected: string) => {
expect(normalizeJavaVersionToSemver(input)).toBe(expected);
});
});
describe('getNextPageUrlFromLinkHeader', () => {
it.each([
[
@@ -309,7 +277,6 @@ describe('getVersionFromFileContent', () => {
['java=17.0.9-graalce', '17.0.9', 'graalvm'],
['java=11.0.25-librca', '11.0.25', 'liberica'],
['java=25.0.4+1.1-librca', '25.0.4+1.1', 'liberica'],
['java=25.0.4+1.1-zulu', '25.0.4+1.1', 'zulu'],
['java=11.0.25-ms', '11.0.25', 'microsoft'],
['java=21.0.5-oracle', '21.0.5', 'oracle'],
['java=11.0.25-sapmchn', '11.0.25', 'sapmachine'],
+29 -165
View File
@@ -18360,102 +18360,9 @@ function readAttributeStr(xmlData, i) {
}
/**
* Walk `attrStr` once, left to right, splitting it into attribute tokens.
*
* This replaces a regex that used to do the same job
* (`(\s*)([^\s=]+)(\s*=)?(\s*(['"])(([\s\S])*?)\5)?`). That regex led with an
* optional whitespace group followed by a required "non-whitespace" group.
* On a long run of whitespace that never resolves into an attribute name
* (e.g. a tag with thousands of trailing spaces before `>`), the engine
* backtracks the whitespace group one character at a time before giving up
* and moving to the next starting position — one full backtrack per
* position, which is quadratic in the length of the run.
*
* A single forward-only scan can never backtrack, so it can't be made slow
* this way no matter how much whitespace the input contains — it's always
* proportional to the length of the string, once.
*
* Each returned token mirrors the shape the old regex match array had, so
* the validation logic below (which reads token[1]..token[6]) didn't need
* to change:
* token.startIndex - where this token begins in attrStr
* token[1] - leading whitespace before the name
* token[2] - the attribute name
* token[3] - whitespace + '=' if present, else undefined
* token[4] - marker (any defined value) if a quoted value was found
* token[5] - the quote character used ('"' or "'")
* token[6] - the value's text, without the surrounding quotes
*
* A malformed leading character (e.g. a stray '=' with no name before it)
* is simply skipped over, one character at a time — the same outcome the
* old regex produced by failing to match at that position and retrying at
* the next one.
* Select all the attributes whether valid or invalid.
*/
function scanAttributeTokens(attrStr) {
const tokens = [];
const len = attrStr.length;
let i = 0;
while (i < len) {
const tokenStart = i;
// Leading whitespace before the name.
while (i < len && isWhiteSpace(attrStr[i])) i++;
if (i >= len) break; // trailing whitespace only — nothing left to read
if (attrStr[i] === '=') {
// No name before this '=' — not a valid attribute start. Move past
// just this one character and try again from the next position.
i = tokenStart + 1;
continue;
}
const leadingWs = attrStr.slice(tokenStart, i);
// Attribute name — everything up to the next whitespace or '='.
const nameStart = i;
while (i < len && !isWhiteSpace(attrStr[i]) && attrStr[i] !== '=') i++;
const name = attrStr.slice(nameStart, i);
// Optional whitespace + '='.
let equalsGroup; // whitespace + '=' text, or undefined if absent
let j = i;
while (j < len && isWhiteSpace(attrStr[j])) j++;
if (j < len && attrStr[j] === '=') {
equalsGroup = attrStr.slice(i, j + 1);
i = j + 1;
}
// Optional whitespace + quoted value.
let quoteChar;
let value;
let k = i;
while (k < len && isWhiteSpace(attrStr[k])) k++;
if (k < len && (attrStr[k] === '"' || attrStr[k] === "'")) {
const valueStart = k + 1;
const closeIdx = attrStr.indexOf(attrStr[k], valueStart);
if (closeIdx !== -1) {
quoteChar = attrStr[k];
value = attrStr.slice(valueStart, closeIdx);
i = closeIdx + 1;
}
// No closing quote found anywhere in the rest of the string — leave
// quoteChar/value undefined, same as the old regex's group failing
// to match a backreference-less run.
}
const token = { startIndex: tokenStart };
token[1] = leadingWs;
token[2] = name;
token[3] = equalsGroup;
token[4] = quoteChar !== undefined ? true : undefined;
token[5] = quoteChar;
token[6] = value;
tokens.push(token);
}
return tokens;
}
const validAttrStrRegxp = new RegExp('(\\s*)([^\\s=]+)(\\s*=)?(\\s*([\'"])(([\\s\\S])*?)\\5)?', 'g');
//attr, ="sd", a="amit's", a="sd"b="saf", ab cd=""
@@ -18464,7 +18371,7 @@ function validateAttributeString(attrStr, options) {
//if(attrStr.trim().length === 0) return true; //empty string
const matches = scanAttributeTokens(attrStr);
const matches = getAllMatches(attrStr, validAttrStrRegxp);
const attrNames = {};
for (let i = 0; i < matches.length; i++) {
@@ -18566,6 +18473,7 @@ function getLineNumberForPosition(xmlData, index) {
function getPositionFromMatch(match) {
return match.startIndex + match[1].length;
}
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/fxp.js
@@ -59590,24 +59498,6 @@ const EXPANSION_MAX = 100_000;
// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
// characters) so legitimate input is unaffected.
const EXPANSION_MAX_LENGTH = 4_000_000;
// `expand_` recurses once per level of brace *nesting* - both when expanding a
// set's comma members and when re-wrapping a set whose body is a single part.
// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
// level per chained group), which left nesting depth unbounded: about 3,100
// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
// will follow nesting. It sits far above any realistic pattern and well below
// the depth at which the stack runs out.
const EXPANSION_MAX_DEPTH = 1_000;
// Bash keeps a quirk where a brace group followed by a comma set still expands
// (`{a},b}`). The parser implements it by rewriting the string and restarting
// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
// full passes over a string that itself grows by one `escClose` sentinel each
// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
// times the scan may restart. Real `{a},b}` input needs a handful.
const EXPANSION_MAX_REWRITES = 1_000;
function numeric(str) {
return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
}
@@ -59627,52 +59517,37 @@ function unescapeBraces(str) {
.replace(escCommaPattern, ',')
.replace(escPeriodPattern, '.');
}
// Like `target.push(...items)` but doesn't overflow the stack
function pushAll(target, items) {
for (let i = 0; i < items.length; i++) {
target.push(items[i]);
}
}
/**
* Basically just str.split(","), but handling cases
* where we have nested braced sections, which should be
* treated as individual members, like {a,{b,c},d}
*/
function parseCommaParts(str) {
const parts = [];
// Walk the brace groups iteratively. Recursing on `post` once per group let a
// chain of them exhaust the stack - the parsing-side counterpart to
// the `expand_` overflow fixed for CVE-2026-14257, and not something `max` or
// `maxLength` can bound, since it happens before expansion.
//
// The part the next chunk continues
let carry = '';
for (;;) {
const m = balanced('{', '}', str);
if (!m) {
const tail = str.split(',');
tail[0] = carry + tail[0];
pushAll(parts, tail);
return parts;
}
const { pre, body, post } = m;
const p = pre.split(',');
p[0] = carry + p[0];
p[p.length - 1] += '{' + body + '}';
if (!post.length) {
pushAll(parts, p);
return parts;
}
carry = p.pop();
pushAll(parts, p);
str = post;
if (!str) {
return [''];
}
const parts = [];
const m = balanced('{', '}', str);
if (!m) {
return str.split(',');
}
const { pre, body, post } = m;
const p = pre.split(',');
p[p.length - 1] += '{' + body + '}';
const postParts = parseCommaParts(post);
if (post.length) {
;
p[p.length - 1] += postParts.shift();
p.push.apply(p, postParts);
}
parts.push.apply(parts, p);
return parts;
}
function expand(str, options = {}) {
if (!str) {
return [];
}
const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH, maxDepth = EXPANSION_MAX_DEPTH, maxRewrites = EXPANSION_MAX_REWRITES, } = options;
const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
// I don't know why Bash 4.3 does this, but it does.
// Anything starting with {} will have the first two bytes preserved
// but *only* at the top level, so {},a}b will not expand to anything,
@@ -59682,7 +59557,7 @@ function expand(str, options = {}) {
if (str.slice(0, 2) === '{}') {
str = '\\{\\}' + str.slice(2);
}
return expand_(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
}
function embrace(str) {
return '{' + str + '}';
@@ -59777,13 +59652,7 @@ function expandSequence(body, isAlphaSequence, max, maxLength) {
}
return N;
}
function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
// Too deeply nested to keep following: treat the rest as literal, the same
// way a group that cannot expand is already handled. Truncating rather than
// throwing keeps `expand` total, matching `max` and `maxLength`.
if (depth > maxDepth) {
return [str];
}
function expand_(str, max, maxLength, isTop) {
// Consume the string's top-level brace groups left to right, threading a
// running set of combined prefixes (`acc`). Expanding the tail iteratively -
// rather than recursing on `m.post` once per group - keeps the native stack
@@ -59795,9 +59664,6 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
// comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
// is on the final strings, so it is applied to whichever `combine` produces
// them (the one with no brace set left in the tail).
// How many times the `{a},b}` rewrite below has restarted the scan. Each pass
// re-reads the whole string, so leaving this unbounded is quadratic.
let rewrites = 0;
let dropEmpties = false;
let firstGroup = true;
for (;;) {
@@ -59822,8 +59688,7 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
const isOptions = m.body.indexOf(',') >= 0;
if (!isSequence && !isOptions) {
// {a},b}
if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
rewrites++;
if (m.post.match(/,(?!,).*\}/)) {
str = m.pre + '{' + m.body + escClose + m.post;
isTop = true;
continue;
@@ -59843,7 +59708,7 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
let n = parseCommaParts(m.body);
if (n.length === 1 && n[0] !== undefined) {
// x{{a,b}}y ==> x{a}y x{b}y
n = expand_(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
n = expand_(n[0], max, maxLength, false).map(embrace);
//XXX is this necessary? Can't seem to hit it in tests.
/* c8 ignore start */
if (n.length === 1) {
@@ -59869,13 +59734,12 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
values = [];
let valuesLength = 0;
outer: for (let j = 0; j < n.length; j++) {
const expanded = expand_(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false);
const expanded = expand_(n[j], max, maxLength, false);
for (let k = 0; k < expanded.length; k++) {
const v = expanded[k];
if (dropsEmpties && !v)
continue;
if (values.length >= max ||
valuesLength + v.length > maxLength) {
if (values.length >= max || valuesLength + v.length > maxLength) {
break outer;
}
values.push(v);
+187 -475
View File
@@ -6009,77 +6009,11 @@ class Request {
}
}
/**
* @param {number|null} statusCode
* @param {Buffer[]|null} headers
* @param {import('node:stream').Duplex} socket
* @param {string} [statusText]
*/
onUpgrade (statusCode, headers, socket, statusText = '') {
this.onFinally()
onUpgrade (statusCode, headers, socket) {
assert(!this.aborted)
assert(!this.completed)
if (statusCode !== null) {
this.#publishUpgradeHeaders(statusCode, headers, statusText)
}
const result = this[kHandler].onUpgrade(statusCode, headers, socket)
if (!this.aborted) {
this.completed = true
if (statusCode !== null) {
this.#publishUpgradeTrailers()
}
}
return result
}
/**
* @param {number} statusCode
* @param {import('node:http2').IncomingHttpHeaders} headers
* @param {(headers: import('node:http2').IncomingHttpHeaders) => Buffer[]} parseHeaders
* @param {string} [statusText]
*/
onUpgradeResponse (statusCode, headers, parseHeaders, statusText = '') {
assert(!this.aborted)
assert(this.completed)
if (channels.headers.hasSubscribers) {
this.#publishUpgradeHeaders(statusCode, parseHeaders(headers), statusText)
}
this.#publishUpgradeTrailers()
}
/**
* @param {Error} error
*/
onUpgradeError (error) {
assert(!this.aborted)
assert(this.completed)
if (channels.error.hasSubscribers) {
channels.error.publish({ request: this, error })
}
}
/**
* @param {number} statusCode
* @param {Buffer[]} headers
* @param {string} statusText
*/
#publishUpgradeHeaders (statusCode, headers, statusText) {
if (channels.headers.hasSubscribers) {
channels.headers.publish({ request: this, response: { statusCode, headers, statusText } })
}
}
#publishUpgradeTrailers () {
if (channels.trailers.hasSubscribers) {
channels.trailers.publish({ request: this, trailers: [] })
}
return this[kHandler].onUpgrade(statusCode, headers, socket)
}
onComplete (trailers) {
@@ -7978,7 +7912,7 @@ class Parser {
}
onUpgrade (head) {
const { upgrade, client, socket, headers, statusCode, statusText } = this
const { upgrade, client, socket, headers, statusCode } = this
assert(upgrade)
assert(client[kSocket] === socket)
@@ -8013,10 +7947,9 @@ class Parser {
client.emit('disconnect', client[kUrl], [client], new InformationalError('upgrade'))
try {
request.onUpgrade(statusCode, headers, socket, statusText)
} catch (error) {
util.errorRequest(client, request, error)
util.destroy(socket, error)
request.onUpgrade(statusCode, headers, socket)
} catch (err) {
util.destroy(socket, err)
}
client[kResume]()
@@ -8423,7 +8356,7 @@ async function connectH1 (client, socket) {
function clearIdleSocketValidation (socket) {
if (socket[kIdleSocketValidationTimeout]) {
clearImmediate(socket[kIdleSocketValidationTimeout])
clearTimeout(socket[kIdleSocketValidationTimeout])
socket[kIdleSocketValidationTimeout] = null
}
@@ -8432,23 +8365,15 @@ function clearIdleSocketValidation (socket) {
function scheduleIdleSocketValidation (client, socket) {
socket[kIdleSocketValidation] = 1
// Yield to the check phase (after poll) so unsolicited bytes / FIN / RST
// already pending on this idle keep-alive socket are processed before the
// next request is written (GHSA-35p6-xmwp-9g52).
//
// setTimeout(0) pays Node's ~1ms timer floor on every sequential reuse
// (#5493). setImmediate avoids that, but an *unref'd* Immediate lets poll
// block for ~500ms when the event loop is otherwise idle (#5600 / #5606).
// A ref'd Immediate both keeps the pending request alive and makes poll
// return immediately — the hybrid those issues asked for.
socket[kIdleSocketValidationTimeout] = setImmediate(() => {
socket[kIdleSocketValidationTimeout] = setTimeout(() => {
socket[kIdleSocketValidationTimeout] = null
socket[kIdleSocketValidation] = 2
if (client[kSocket] === socket && !socket.destroyed) {
client[kResume]()
}
})
}, 0)
socket[kIdleSocketValidationTimeout].unref?.()
}
/**
@@ -8597,22 +8522,12 @@ function writeH1 (client, request) {
const socket = client[kSocket]
clearIdleSocketValidation(socket)
/**
* @param {Error} [error]
*/
const abort = (error) => {
if (request.aborted) {
const abort = (err) => {
if (request.aborted || request.completed) {
return
}
if (request.completed) {
if (request.upgrade || request.method === 'CONNECT') {
util.destroy(socket, new InformationalError('aborted'))
}
return
}
util.errorRequest(client, request, error || new RequestAbortedError())
util.errorRequest(client, request, err || new RequestAbortedError())
util.destroy(body)
util.destroy(socket, new InformationalError('aborted'))
@@ -9069,7 +8984,6 @@ module.exports = connectH1
const assert = __nccwpck_require__(4589)
const { errorMonitor } = __nccwpck_require__(8474)
const { pipeline } = __nccwpck_require__(7075)
const util = __nccwpck_require__(3440)
const {
@@ -9146,15 +9060,6 @@ function parseH2Headers (headers) {
return result
}
/**
* @param {import('node:http2').IncomingHttpHeaders} headers
* @returns {Buffer[]}
*/
function parseH2ResponseHeaders (headers) {
const { [HTTP2_HEADER_STATUS]: _statusCode, ...realHeaders } = headers
return parseH2Headers(realHeaders)
}
async function connectH2 (client, socket) {
client[kSocket] = socket
@@ -9375,32 +9280,22 @@ function writeH2 (client, request) {
headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname}${port ? `:${port}` : ''}`
headers[HTTP2_HEADER_METHOD] = method
/**
* @param {Error} [error]
*/
const abort = (error) => {
if (request.aborted) {
const abort = (err) => {
if (request.aborted || request.completed) {
return
}
if (request.completed) {
if (method === 'CONNECT' && stream != null) {
util.destroy(stream, error || new RequestAbortedError())
}
return
}
err = err || new RequestAbortedError()
error = error || new RequestAbortedError()
util.errorRequest(client, request, error)
util.errorRequest(client, request, err)
if (stream != null) {
util.destroy(stream, error)
util.destroy(stream, err)
}
// We do not destroy the socket as we can continue using the session
// the stream get's destroyed and the session remains to create new streams
util.destroy(body, error)
util.destroy(body, err)
client[kQueue][client[kRunningIdx]++] = null
client[kResume]()
}
@@ -9419,57 +9314,25 @@ function writeH2 (client, request) {
if (method === 'CONNECT') {
session.ref()
// We are already connected, streams are pending, first request
// will create a new stream. We trigger a request to create the stream and wait until
// `ready` event is triggered
// We disabled endStream to allow the user to write to the stream
stream = session.request(headers, { endStream: false, signal })
let upgradeResponseFinished = false
/**
* @param {import('node:http2').IncomingHttpHeaders} headers
*/
const onResponse = (headers) => {
upgradeResponseFinished = true
stream.off(errorMonitor, onUpgradeError)
request.onUpgradeResponse(Number(headers[HTTP2_HEADER_STATUS]), headers, parseH2ResponseHeaders)
}
/**
* @param {Error} error
*/
const onUpgradeError = (error) => {
upgradeResponseFinished = true
stream.off('response', onResponse)
request.onUpgradeError(error)
}
const onReady = () => {
try {
request.onUpgrade(null, null, stream)
} catch (error) {
stream.off('response', onResponse)
abort(error)
return
}
if (request.aborted) {
return
}
stream.off('error', abort)
stream.once(errorMonitor, onUpgradeError)
if (stream.id && !stream.pending) {
request.onUpgrade(null, null, stream)
++session[kOpenStreams]
client[kQueue][client[kRunningIdx]++] = null
} else {
stream.once('ready', () => {
request.onUpgrade(null, null, stream)
++session[kOpenStreams]
client[kQueue][client[kRunningIdx]++] = null
})
}
stream.once('response', onResponse)
stream.once('error', abort)
++session[kOpenStreams]
onReady()
stream.once('close', () => {
if (!upgradeResponseFinished && request.completed) {
stream.off('response', onResponse)
stream.off(errorMonitor, onUpgradeError)
request.onUpgradeError(new InformationalError(`HTTP/2: "stream error" received - code ${stream.rstCode}`))
}
session[kOpenStreams] -= 1
if (session[kOpenStreams] === 0) session.unref()
})
@@ -12168,7 +12031,6 @@ class RetryHandler {
this.end = null
this.etag = null
this.resume = null
this.headersSent = false
// Handle possible onConnect duplication
this.handler.onConnect(reason => {
@@ -12181,20 +12043,6 @@ class RetryHandler {
})
}
checkpointResponseEnd (headers, resume) {
if (this.end == null && this.opts.method !== 'HEAD') {
const contentLength = headers['content-length']
this.end = contentLength != null ? Number(contentLength) - 1 : null
assert(
this.end == null || Number.isFinite(this.end),
'invalid content-length'
)
}
this.resume = this.end != null ? resume : null
}
onRequestSent () {
if (this.handler.onRequestSent) {
this.handler.onRequestSent()
@@ -12283,12 +12131,7 @@ class RetryHandler {
this.retryCount += 1
if (statusCode >= 300) {
// Only expose a response if no earlier attempt has reached the caller.
// Otherwise abort this attempt so the error settles the existing body
// instead of replacing it with a new response.
if (!this.headersSent && this.retryOpts.statusCodes.includes(statusCode) === false) {
this.headersSent = true
this.checkpointResponseEnd(headers, resume)
if (this.retryOpts.statusCodes.includes(statusCode) === false) {
return this.handler.onHeaders(
statusCode,
rawHeaders,
@@ -12357,15 +12200,8 @@ class RetryHandler {
const { start, size, end = size - 1 } = contentRange
if (this.start !== start || (this.end != null && this.end !== end)) {
this.abort(
new RequestRetryError('Content-Range mismatch', statusCode, {
headers,
data: { count: this.retryCount }
})
)
return false
}
assert(this.start === start, 'content-range mismatch')
assert(this.end == null || this.end === end, 'content-range mismatch')
this.resume = resume
return true
@@ -12377,7 +12213,6 @@ class RetryHandler {
const range = parseRangeHeader(headers['content-range'])
if (range == null) {
this.headersSent = true
return this.handler.onHeaders(
statusCode,
rawHeaders,
@@ -12416,7 +12251,6 @@ class RetryHandler {
)
this.resume = resume
this.headersSent = true
this.etag = headers.etag != null ? headers.etag : null
// Weak etags are not useful for comparison nor cache
@@ -12456,7 +12290,7 @@ class RetryHandler {
}
onError (err) {
if (this.aborted || isDisturbed(this.opts.body) || (this.headersSent && this.resume == null)) {
if (this.aborted || isDisturbed(this.opts.body)) {
return this.handler.onError(err)
}
@@ -16914,49 +16748,6 @@ const COLON = 0x3A
*/
const SPACE = 0x20
const DATA = Buffer.from('data')
const EVENT = Buffer.from('event')
const ID = Buffer.from('id')
const RETRY = Buffer.from('retry')
function isASCIINumberBytes (buffer, start) {
if (start >= buffer.length) {
return false
}
for (let i = start; i < buffer.length; i++) {
if (buffer[i] < 0x30 || buffer[i] > 0x39) {
return false
}
}
return true
}
function isValidLastEventIdBytes (buffer, start) {
for (let i = start; i < buffer.length; i++) {
if (buffer[i] === 0x00) {
return false
}
}
return true
}
function isFieldName (line, length, field) {
if (length !== field.length) {
return false
}
for (let i = 0; i < length; i++) {
if (line[i] !== field[i]) {
return false
}
}
return true
}
/**
* @typedef {object} EventSourceStreamEvent
* @type {object}
@@ -16997,14 +16788,11 @@ class EventSourceStream extends Transform {
eventEndCheck = false
/**
* @type {Buffer[]}
* @type {Buffer}
*/
chunks = []
buffer = null
chunkIndex = 0
pos = 0
lineChunkIndex = 0
linePos = 0
event = {
data: undefined,
@@ -17043,20 +16831,92 @@ class EventSourceStream extends Transform {
return
}
this.chunks.push(chunk)
// Cache the chunk in the buffer, as the data might not be complete while
// processing it
// TODO: Investigate if there is a more performant way to handle
// incoming chunks
// see: https://github.com/nodejs/undici/issues/2630
if (this.buffer) {
this.buffer = Buffer.concat([this.buffer, chunk])
} else {
this.buffer = chunk
}
// Strip leading byte-order-mark if we opened the stream and started
// the processing of the incoming data
if (this.checkBOM) {
if (this.handleBOM()) {
callback()
return
switch (this.buffer.length) {
case 1:
// Check if the first byte is the same as the first byte of the BOM
if (this.buffer[0] === BOM[0]) {
// If it is, we need to wait for more data
callback()
return
}
// Set the checkBOM flag to false as we don't need to check for the
// BOM anymore
this.checkBOM = false
// The buffer only contains one byte so we need to wait for more data
callback()
return
case 2:
// Check if the first two bytes are the same as the first two bytes
// of the BOM
if (
this.buffer[0] === BOM[0] &&
this.buffer[1] === BOM[1]
) {
// If it is, we need to wait for more data, because the third byte
// is needed to determine if it is the BOM or not
callback()
return
}
// Set the checkBOM flag to false as we don't need to check for the
// BOM anymore
this.checkBOM = false
break
case 3:
// Check if the first three bytes are the same as the first three
// bytes of the BOM
if (
this.buffer[0] === BOM[0] &&
this.buffer[1] === BOM[1] &&
this.buffer[2] === BOM[2]
) {
// If it is, we can drop the buffered data, as it is only the BOM
this.buffer = Buffer.alloc(0)
// Set the checkBOM flag to false as we don't need to check for the
// BOM anymore
this.checkBOM = false
// Await more data
callback()
return
}
// If it is not the BOM, we can start processing the data
this.checkBOM = false
break
default:
// The buffer is longer than 3 bytes, so we can drop the BOM if it is
// present
if (
this.buffer[0] === BOM[0] &&
this.buffer[1] === BOM[1] &&
this.buffer[2] === BOM[2]
) {
// Remove the BOM from the buffer
this.buffer = this.buffer.subarray(3)
}
// Set the checkBOM flag to false as we don't need to check for the
this.checkBOM = false
break
}
}
while (this.hasCurrentByte()) {
const byte = this.currentByte()
while (this.pos < this.buffer.length) {
// If the previous line ended with an end-of-line, we need to check
// if the next character is also an end-of-line.
if (this.eventEndCheck) {
@@ -17069,9 +16929,10 @@ class EventSourceStream extends Transform {
if (this.crlfCheck) {
// If the current character is a line feed, we can remove it
// from the buffer and reset the crlfCheck flag
if (byte === LF) {
if (this.buffer[this.pos] === LF) {
this.buffer = this.buffer.subarray(this.pos + 1)
this.pos = 0
this.crlfCheck = false
this.consumeCurrentByte()
// It is possible that the line feed is not the end of the
// event. We need to check if the next character is an
@@ -17087,17 +16948,19 @@ class EventSourceStream extends Transform {
this.crlfCheck = false
}
if (byte === LF || byte === CR) {
if (this.buffer[this.pos] === LF || this.buffer[this.pos] === CR) {
// If the current character is a carriage return, we need to
// set the crlfCheck flag to true, as we need to check if the
// next character is a line feed so we can remove it from the
// buffer
if (byte === CR) {
if (this.buffer[this.pos] === CR) {
this.crlfCheck = true
}
this.consumeCurrentByte()
if (this.hasPendingEvent()) {
this.buffer = this.buffer.subarray(this.pos + 1)
this.pos = 0
if (
this.event.data !== undefined || this.event.event || this.event.id || this.event.retry) {
this.processEvent(this.event)
}
this.clearEvent()
@@ -17111,18 +16974,22 @@ class EventSourceStream extends Transform {
// If the current character is an end-of-line, we can process the
// line
if (byte === LF || byte === CR) {
if (this.buffer[this.pos] === LF || this.buffer[this.pos] === CR) {
// If the current character is a carriage return, we need to
// set the crlfCheck flag to true, as we need to check if the
// next character is a line feed
if (byte === CR) {
if (this.buffer[this.pos] === CR) {
this.crlfCheck = true
}
// In any case, we can process the line as we reached an
// end-of-line character
this.parseLine(this.readLine(), this.event)
this.consumeCurrentByte()
this.parseLine(this.buffer.subarray(0, this.pos), this.event)
// Remove the processed line from the buffer
this.buffer = this.buffer.subarray(this.pos + 1)
// Reset the position as we removed the processed line from the buffer
this.pos = 0
// A line was processed and this could be the end of the event. We need
// to check if the next line is empty to determine if the event is
// finished.
@@ -17130,7 +16997,7 @@ class EventSourceStream extends Transform {
continue
}
this.advanceCursor()
this.pos++
}
callback()
@@ -17155,53 +17022,64 @@ class EventSourceStream extends Transform {
return
}
let fieldLength = line.length
let valueStart = line.length
let field = ''
let value = ''
// If the line contains a U+003A COLON character (:)
if (colonPosition !== -1) {
fieldLength = colonPosition
// Collect the characters on the line before the first U+003A COLON
// character (:), and let field be that string.
// TODO: Investigate if there is a more performant way to extract the
// field
// see: https://github.com/nodejs/undici/issues/2630
field = line.subarray(0, colonPosition).toString('utf8')
// Collect the characters on the line after the first U+003A COLON
// character (:), and let value be that string.
// If value starts with a U+0020 SPACE character, remove it from value.
valueStart = colonPosition + 1
let valueStart = colonPosition + 1
if (line[valueStart] === SPACE) {
++valueStart
}
// TODO: Investigate if there is a more performant way to extract the
// value
// see: https://github.com/nodejs/undici/issues/2630
value = line.subarray(valueStart).toString('utf8')
// Otherwise, the string is not empty but does not contain a U+003A COLON
// character (:)
} else {
// Process the field using the steps described below, using the whole
// line as the field name, and the empty string as the field value.
field = line.toString('utf8')
value = ''
}
if (isFieldName(line, fieldLength, DATA)) {
const value = line.toString('utf8', valueStart)
if (event.data === undefined) {
event.data = value
} else {
event.data += `\n${value}`
}
return
}
if (isFieldName(line, fieldLength, RETRY)) {
if (isASCIINumberBytes(line, valueStart)) {
event.retry = line.toString('utf8', valueStart)
}
return
}
if (isFieldName(line, fieldLength, ID)) {
if (isValidLastEventIdBytes(line, valueStart)) {
event.id = line.toString('utf8', valueStart)
}
return
}
if (isFieldName(line, fieldLength, EVENT)) {
const value = line.toString('utf8', valueStart)
if (value.length > 0) {
event.event = value
}
// Modify the event with the field name and value. The value is also
// decoded as UTF-8
switch (field) {
case 'data':
if (event[field] === undefined) {
event[field] = value
} else {
event[field] += `\n${value}`
}
break
case 'retry':
if (isASCIINumber(value)) {
event[field] = value
}
break
case 'id':
if (isValidLastEventId(value)) {
event[field] = value
}
break
case 'event':
if (value.length > 0) {
event[field] = value
}
break
}
}
@@ -17231,152 +17109,13 @@ class EventSourceStream extends Transform {
}
clearEvent () {
this.event.data = undefined
this.event.event = undefined
this.event.id = undefined
this.event.retry = undefined
}
hasPendingEvent () {
return this.event.data !== undefined ||
this.event.event !== undefined ||
this.event.id !== undefined ||
this.event.retry !== undefined
}
hasCurrentByte () {
return this.chunkIndex < this.chunks.length &&
this.pos < this.chunks[this.chunkIndex].length
}
currentByte () {
return this.chunks[this.chunkIndex][this.pos]
}
consumeCurrentByte () {
this.advanceCursor()
this.syncLineStartToCursor()
}
advanceCursor () {
this.pos++
while (this.chunkIndex < this.chunks.length && this.pos >= this.chunks[this.chunkIndex].length) {
this.chunkIndex++
this.pos = 0
this.event = {
data: undefined,
event: undefined,
id: undefined,
retry: undefined
}
}
syncLineStartToCursor () {
this.lineChunkIndex = this.chunkIndex
this.linePos = this.pos
this.dropConsumedChunks()
}
dropConsumedChunks () {
while (this.lineChunkIndex > 0) {
this.chunks.shift()
this.lineChunkIndex--
this.chunkIndex--
}
if (this.chunkIndex === this.chunks.length) {
this.chunks.length = 0
this.chunkIndex = 0
this.pos = 0
this.lineChunkIndex = 0
this.linePos = 0
}
}
readLine () {
if (this.lineChunkIndex === this.chunkIndex) {
return this.chunks[this.chunkIndex].subarray(this.linePos, this.pos)
}
const chunks = []
let length = 0
for (let i = this.lineChunkIndex; i <= this.chunkIndex; i++) {
const chunk = this.chunks[i]
const start = i === this.lineChunkIndex ? this.linePos : 0
const end = i === this.chunkIndex ? this.pos : chunk.length
const slice = chunk.subarray(start, end)
length += slice.length
chunks.push(slice)
}
return Buffer.concat(chunks, length)
}
peekBufferedByte (offset) {
let chunkIndex = this.lineChunkIndex
let pos = this.linePos
while (chunkIndex < this.chunks.length) {
const chunk = this.chunks[chunkIndex]
const remaining = chunk.length - pos
if (offset < remaining) {
return chunk[pos + offset]
}
offset -= remaining
chunkIndex++
pos = 0
}
}
discardLeadingBytes (count) {
while (count > 0 && this.lineChunkIndex < this.chunks.length) {
const chunk = this.chunks[this.lineChunkIndex]
const remaining = chunk.length - this.linePos
if (count < remaining) {
this.linePos += count
count = 0
} else {
count -= remaining
this.lineChunkIndex++
this.linePos = 0
}
}
this.chunkIndex = this.lineChunkIndex
this.pos = this.linePos
this.dropConsumedChunks()
}
handleBOM () {
const first = this.peekBufferedByte(0)
const second = this.peekBufferedByte(1)
const third = this.peekBufferedByte(2)
if (second === undefined) {
if (first === BOM[0]) {
return true
}
this.checkBOM = false
return true
}
if (third === undefined) {
if (first === BOM[0] && second === BOM[1]) {
return true
}
this.checkBOM = false
return false
}
if (first === BOM[0] && second === BOM[1] && third === BOM[2]) {
this.discardLeadingBytes(3)
}
this.checkBOM = false
return !this.hasCurrentByte()
}
}
module.exports = {
@@ -28644,7 +28383,7 @@ function establishWebSocketConnection (url, protocols, client, ws, onEstablish,
// is specified, the server needs to include the same field and one of
// the selected subprotocol values in its response for the connection to
// be established.
if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
if (!requestProtocols.includes(secProtocol)) {
failWebsocketConnection(ws, 'Protocol was not set in the opening handshake.')
return
}
@@ -29405,12 +29144,7 @@ class PerMessageDeflate {
if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
callback(new MessageSizeExceededError())
// The inflater may still hold buffered input that can emit a late
// zlib error. Remove the data listener, then deterministically stop
// the stream so a subsequent 'error' cannot fire without a listener
// (which would terminate the process as an unhandled error event).
this.#inflate.removeAllListeners()
this.#inflate.destroy()
this.#inflate = null
return
}
@@ -31114,7 +30848,7 @@ const DISTRIBUTIONS_ONLY_MAJOR_VERSION = (/* unused pure expression or super */
/* harmony export */ Vt: () => (/* binding */ getBooleanInput),
/* harmony export */ lN: () => (/* binding */ isJdkCacheEnabled)
/* harmony export */ });
/* unused harmony exports getVersionFromToolcachePath, extractJdkFile, cacheJdkDir, getJavaVersionFromReleaseFile, getDownloadArchiveExtension, isVersionSatisfies, getToolcachePath, isGhes, getVersionFromFileContent, convertVersionToSemver, normalizeJavaVersionToSemver, getArtifactFingerprint, getGitHubToken, getGitHubHttpHeaders, MAX_PAGINATION_PAGES, getNextPageUrlFromLinkHeader, validatePaginationUrl, renameWinArchive, getLatestMajorVersion */
/* unused harmony exports getVersionFromToolcachePath, extractJdkFile, cacheJdkDir, getJavaVersionFromReleaseFile, getDownloadArchiveExtension, isVersionSatisfies, getToolcachePath, isGhes, getVersionFromFileContent, convertVersionToSemver, getArtifactFingerprint, getGitHubToken, getGitHubHttpHeaders, MAX_PAGINATION_PAGES, getNextPageUrlFromLinkHeader, validatePaginationUrl, renameWinArchive, getLatestMajorVersion */
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(857);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__nccwpck_require__.n(os__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6928);
@@ -31513,28 +31247,6 @@ function convertVersionToSemver(version) {
}
return mainVersion;
}
/**
* Normalize numeric Java versions, optionally prefixed with 'jdk-'. Pad
* abbreviated build requests ('27+35' -> '27.0.0+35') to preserve exact
* matching, and move extra JEP 322 fields into build metadata
* ('26.0.2.1+1' -> '26.0.2+1.1'). Leave ranges unchanged.
*/
function normalizeJavaVersionToSemver(version) {
const match = /^(?:jdk-)?(\d+(?:\.\d+)*)(?:\+([0-9A-Za-z.-]+))?$/.exec(version);
if (!match) {
return version;
}
const versionParts = match[1].split('.');
if (match[2]) {
while (versionParts.length < 3) {
versionParts.push('0');
}
}
const converted = convertVersionToSemver(versionParts.join('.'));
return match[2]
? `${converted}${versionParts.length > 3 ? '.' : '+'}${match[2]}`
: converted;
}
/**
* Builds a validator for the bytes currently served by a URL from the response
* headers of a HEAD request. A vendor's `/latest/` URL never changes, so this
+8 -3
View File
@@ -728,9 +728,14 @@ class JavaBase {
version = version.replace('-ea.', '+');
stable = false;
}
// Normalize Java release tags and JEP 322 versions without losing exact
// build constraints ('jdk-27+35' -> '27.0.0+35'). Leave ranges unchanged.
version = (0,util/* normalizeJavaVersionToSemver */.zZ)(version);
// Java uses a versioning scheme (JEP 322) that can contain more numeric
// fields than SemVer allows, e.g. '18.0.1.1' or '11.0.9.1'. Convert such
// exact versions to SemVer build notation ('18.0.1+1') so they are
// accepted. Ranges and versions that already carry build metadata are
// left untouched.
if (/^\d+(\.\d+){3,}$/.test(version)) {
version = (0,util/* convertVersionToSemver */.ZY)(version);
}
if (!semver_default().validRange(version)) {
throw new Error(`The string '${version}' is not valid SemVer notation for a Java version. Please check README file for code snippets and more detailed information`);
}
+3 -31
View File
@@ -109,7 +109,7 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
const formattedVersion = this.stable
? item.version_data.semver
: item.version_data.semver.replace('-beta+', '+');
const release = {
return {
version: formattedVersion,
url: item.binaries[0].package.link,
signatureUrl: item.binaries[0].package.signature_link,
@@ -119,29 +119,15 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
source: item.binaries[0].package.checksum_link
}
};
return {
release,
openjdkVersion: getOpenJdkSemverVersion(item.version_data)
};
});
// The Adoptium API `semver` folds the JEP 322 patch field into the build
// number ('26.0.2.1+1' -> '26.0.2+101') and appends extra metadata for LTS
// releases ('25.0.4+7' -> '25.0.4+7.0.LTS'). Exact versions requested by
// users follow the OpenJDK notation instead, so also match them against a
// key derived from the OpenJDK version fields ('26.0.2+1.1', '25.0.4+7').
const isExactBuildRequest = (semver_default().parse(version)?.build.length ?? 0) > 0;
const satisfiedVersions = availableVersionsWithBinaries
.filter(({ release, openjdkVersion }) => (0,util/* isVersionSatisfies */.y)(version, release.version) ||
(isExactBuildRequest &&
openjdkVersion !== null &&
semver_default().compareBuild(version, openjdkVersion) === 0))
.map(({ release }) => release)
.filter(item => (0,util/* isVersionSatisfies */.y)(version, item.version))
.sort((a, b) => {
return -semver_default().compareBuild(a.version, b.version);
});
const resolvedFullVersion = satisfiedVersions.length > 0 ? satisfiedVersions[0] : null;
if (!resolvedFullVersion) {
const availableVersionStrings = availableVersionsWithBinaries.map(({ release }) => release.version);
const availableVersionStrings = availableVersionsWithBinaries.map(item => item.version);
throw this.createVersionNotFoundError(version, availableVersionStrings);
}
return resolvedFullVersion;
@@ -293,20 +279,6 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
return architecture === 'armv7' ? 'arm' : architecture;
}
}
/**
* Builds a SemVer version from the OpenJDK version fields reported by the
* Adoptium API, e.g. '26.0.2.1+1' -> '26.0.2+1.1' and '25.0.4+7-LTS' ->
* '25.0.4+7'. Returns null if the fields cannot form a valid SemVer version.
*/
function getOpenJdkSemverVersion(versionData) {
const { major, minor, security, patch, build } = versionData;
if (build === undefined || build === null) {
return null;
}
const buildMetadata = patch ? `${patch}.${build}` : `${build}`;
const version = `${major}.${minor}.${security}+${buildMetadata}`;
return semver_default().valid(version) ? version : null;
}
/***/ }),
+4 -96
View File
@@ -418,102 +418,9 @@ function readAttributeStr(xmlData, i) {
}
/**
* Walk `attrStr` once, left to right, splitting it into attribute tokens.
*
* This replaces a regex that used to do the same job
* (`(\s*)([^\s=]+)(\s*=)?(\s*(['"])(([\s\S])*?)\5)?`). That regex led with an
* optional whitespace group followed by a required "non-whitespace" group.
* On a long run of whitespace that never resolves into an attribute name
* (e.g. a tag with thousands of trailing spaces before `>`), the engine
* backtracks the whitespace group one character at a time before giving up
* and moving to the next starting position — one full backtrack per
* position, which is quadratic in the length of the run.
*
* A single forward-only scan can never backtrack, so it can't be made slow
* this way no matter how much whitespace the input contains — it's always
* proportional to the length of the string, once.
*
* Each returned token mirrors the shape the old regex match array had, so
* the validation logic below (which reads token[1]..token[6]) didn't need
* to change:
* token.startIndex - where this token begins in attrStr
* token[1] - leading whitespace before the name
* token[2] - the attribute name
* token[3] - whitespace + '=' if present, else undefined
* token[4] - marker (any defined value) if a quoted value was found
* token[5] - the quote character used ('"' or "'")
* token[6] - the value's text, without the surrounding quotes
*
* A malformed leading character (e.g. a stray '=' with no name before it)
* is simply skipped over, one character at a time — the same outcome the
* old regex produced by failing to match at that position and retrying at
* the next one.
* Select all the attributes whether valid or invalid.
*/
function scanAttributeTokens(attrStr) {
const tokens = [];
const len = attrStr.length;
let i = 0;
while (i < len) {
const tokenStart = i;
// Leading whitespace before the name.
while (i < len && isWhiteSpace(attrStr[i])) i++;
if (i >= len) break; // trailing whitespace only — nothing left to read
if (attrStr[i] === '=') {
// No name before this '=' — not a valid attribute start. Move past
// just this one character and try again from the next position.
i = tokenStart + 1;
continue;
}
const leadingWs = attrStr.slice(tokenStart, i);
// Attribute name — everything up to the next whitespace or '='.
const nameStart = i;
while (i < len && !isWhiteSpace(attrStr[i]) && attrStr[i] !== '=') i++;
const name = attrStr.slice(nameStart, i);
// Optional whitespace + '='.
let equalsGroup; // whitespace + '=' text, or undefined if absent
let j = i;
while (j < len && isWhiteSpace(attrStr[j])) j++;
if (j < len && attrStr[j] === '=') {
equalsGroup = attrStr.slice(i, j + 1);
i = j + 1;
}
// Optional whitespace + quoted value.
let quoteChar;
let value;
let k = i;
while (k < len && isWhiteSpace(attrStr[k])) k++;
if (k < len && (attrStr[k] === '"' || attrStr[k] === "'")) {
const valueStart = k + 1;
const closeIdx = attrStr.indexOf(attrStr[k], valueStart);
if (closeIdx !== -1) {
quoteChar = attrStr[k];
value = attrStr.slice(valueStart, closeIdx);
i = closeIdx + 1;
}
// No closing quote found anywhere in the rest of the string — leave
// quoteChar/value undefined, same as the old regex's group failing
// to match a backreference-less run.
}
const token = { startIndex: tokenStart };
token[1] = leadingWs;
token[2] = name;
token[3] = equalsGroup;
token[4] = quoteChar !== undefined ? true : undefined;
token[5] = quoteChar;
token[6] = value;
tokens.push(token);
}
return tokens;
}
const validAttrStrRegxp = new RegExp('(\\s*)([^\\s=]+)(\\s*=)?(\\s*([\'"])(([\\s\\S])*?)\\5)?', 'g');
//attr, ="sd", a="amit's", a="sd"b="saf", ab cd=""
@@ -522,7 +429,7 @@ function validateAttributeString(attrStr, options) {
//if(attrStr.trim().length === 0) return true; //empty string
const matches = scanAttributeTokens(attrStr);
const matches = (0,_util_js__WEBPACK_IMPORTED_MODULE_0__/* .getAllMatches */ .Xe)(attrStr, validAttrStrRegxp);
const attrNames = {};
for (let i = 0; i < matches.length; i++) {
@@ -625,6 +532,7 @@ function getPositionFromMatch(match) {
return match.startIndex + match[1].length;
}
/***/ }),
/***/ 6009:
+25 -69
View File
@@ -52431,24 +52431,6 @@ const EXPANSION_MAX = 100_000;
// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
// characters) so legitimate input is unaffected.
const EXPANSION_MAX_LENGTH = 4_000_000;
// `expand_` recurses once per level of brace *nesting* - both when expanding a
// set's comma members and when re-wrapping a set whose body is a single part.
// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
// level per chained group), which left nesting depth unbounded: about 3,100
// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
// will follow nesting. It sits far above any realistic pattern and well below
// the depth at which the stack runs out.
const EXPANSION_MAX_DEPTH = 1_000;
// Bash keeps a quirk where a brace group followed by a comma set still expands
// (`{a},b}`). The parser implements it by rewriting the string and restarting
// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
// full passes over a string that itself grows by one `escClose` sentinel each
// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
// times the scan may restart. Real `{a},b}` input needs a handful.
const EXPANSION_MAX_REWRITES = 1_000;
function numeric(str) {
return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
}
@@ -52468,52 +52450,37 @@ function unescapeBraces(str) {
.replace(escCommaPattern, ',')
.replace(escPeriodPattern, '.');
}
// Like `target.push(...items)` but doesn't overflow the stack
function pushAll(target, items) {
for (let i = 0; i < items.length; i++) {
target.push(items[i]);
}
}
/**
* Basically just str.split(","), but handling cases
* where we have nested braced sections, which should be
* treated as individual members, like {a,{b,c},d}
*/
function parseCommaParts(str) {
const parts = [];
// Walk the brace groups iteratively. Recursing on `post` once per group let a
// chain of them exhaust the stack - the parsing-side counterpart to
// the `expand_` overflow fixed for CVE-2026-14257, and not something `max` or
// `maxLength` can bound, since it happens before expansion.
//
// The part the next chunk continues
let carry = '';
for (;;) {
const m = balanced('{', '}', str);
if (!m) {
const tail = str.split(',');
tail[0] = carry + tail[0];
pushAll(parts, tail);
return parts;
}
const { pre, body, post } = m;
const p = pre.split(',');
p[0] = carry + p[0];
p[p.length - 1] += '{' + body + '}';
if (!post.length) {
pushAll(parts, p);
return parts;
}
carry = p.pop();
pushAll(parts, p);
str = post;
if (!str) {
return [''];
}
const parts = [];
const m = balanced('{', '}', str);
if (!m) {
return str.split(',');
}
const { pre, body, post } = m;
const p = pre.split(',');
p[p.length - 1] += '{' + body + '}';
const postParts = parseCommaParts(post);
if (post.length) {
;
p[p.length - 1] += postParts.shift();
p.push.apply(p, postParts);
}
parts.push.apply(parts, p);
return parts;
}
function expand(str, options = {}) {
if (!str) {
return [];
}
const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH, maxDepth = EXPANSION_MAX_DEPTH, maxRewrites = EXPANSION_MAX_REWRITES, } = options;
const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
// I don't know why Bash 4.3 does this, but it does.
// Anything starting with {} will have the first two bytes preserved
// but *only* at the top level, so {},a}b will not expand to anything,
@@ -52523,7 +52490,7 @@ function expand(str, options = {}) {
if (str.slice(0, 2) === '{}') {
str = '\\{\\}' + str.slice(2);
}
return expand_(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
}
function embrace(str) {
return '{' + str + '}';
@@ -52618,13 +52585,7 @@ function expandSequence(body, isAlphaSequence, max, maxLength) {
}
return N;
}
function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
// Too deeply nested to keep following: treat the rest as literal, the same
// way a group that cannot expand is already handled. Truncating rather than
// throwing keeps `expand` total, matching `max` and `maxLength`.
if (depth > maxDepth) {
return [str];
}
function expand_(str, max, maxLength, isTop) {
// Consume the string's top-level brace groups left to right, threading a
// running set of combined prefixes (`acc`). Expanding the tail iteratively -
// rather than recursing on `m.post` once per group - keeps the native stack
@@ -52636,9 +52597,6 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
// comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
// is on the final strings, so it is applied to whichever `combine` produces
// them (the one with no brace set left in the tail).
// How many times the `{a},b}` rewrite below has restarted the scan. Each pass
// re-reads the whole string, so leaving this unbounded is quadratic.
let rewrites = 0;
let dropEmpties = false;
let firstGroup = true;
for (;;) {
@@ -52663,8 +52621,7 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
const isOptions = m.body.indexOf(',') >= 0;
if (!isSequence && !isOptions) {
// {a},b}
if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
rewrites++;
if (m.post.match(/,(?!,).*\}/)) {
str = m.pre + '{' + m.body + escClose + m.post;
isTop = true;
continue;
@@ -52684,7 +52641,7 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
let n = parseCommaParts(m.body);
if (n.length === 1 && n[0] !== undefined) {
// x{{a,b}}y ==> x{a}y x{b}y
n = expand_(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
n = expand_(n[0], max, maxLength, false).map(embrace);
//XXX is this necessary? Can't seem to hit it in tests.
/* c8 ignore start */
if (n.length === 1) {
@@ -52710,13 +52667,12 @@ function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
values = [];
let valuesLength = 0;
outer: for (let j = 0; j < n.length; j++) {
const expanded = expand_(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false);
const expanded = expand_(n[j], max, maxLength, false);
for (let k = 0; k < expanded.length; k++) {
const v = expanded[k];
if (dropsEmpties && !v)
continue;
if (values.length >= max ||
valuesLength + v.length > maxLength) {
if (values.length >= max || valuesLength + v.length > maxLength) {
break outer;
}
values.push(v);
+20 -32
View File
@@ -13,26 +13,19 @@ export const modules = {
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var _base_installer_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6242);
/* harmony import */ var _platform_types_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(7444);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(4527);
/* harmony import */ var semver__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2088);
/* harmony import */ var semver__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(semver__WEBPACK_IMPORTED_MODULE_3__);
/* harmony import */ var _base_installer_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(6242);
/* harmony import */ var _platform_types_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(7444);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
function compareNumberArrays(a, b) {
const length = Math.max(a.length, b.length);
for (let i = 0; i < length; i++) {
const diff = (a[i] ?? 0) - (b[i] ?? 0);
if (diff !== 0) {
return diff;
}
}
return 0;
}
class ZuluDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/* .JavaBase */ .O {
class ZuluDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4__/* .JavaBase */ .O {
constructor(installerOptions) {
super('Zulu', installerOptions);
}
@@ -46,24 +39,19 @@ class ZuluDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/*
? [...item.java_version, item.openjdk_build_number]
: item.java_version;
return {
version: (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .convertVersionToSemver */ .ZY)(javaVersion),
version: (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .convertVersionToSemver */ .ZY)(javaVersion),
url: item.download_url,
javaVersion: item.java_version,
buildNumber: item.openjdk_build_number ?? 0,
distroVersion: item.distro_version,
zuluVersion: (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .convertVersionToSemver */ .ZY)(item.distro_version),
packageUuid: item.package_uuid
};
});
const satisfiedVersions = availableVersions
.filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .isVersionSatisfies */ .y)(version, item.version))
.filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .isVersionSatisfies */ .y)(version, item.version))
.sort((a, b) => {
// Compare numerically rather than via semver build metadata: Azul
// hotfix releases carry a 4th java_version segment (e.g. 25.0.4.1+1,
// rendered as '25.0.4+1.1') that must rank above 25.0.4+7, whereas
// semver.compareBuild would order the build identifiers '7' > '1'.
return (-compareNumberArrays(a.javaVersion, b.javaVersion) ||
b.buildNumber - a.buildNumber ||
-compareNumberArrays(a.distroVersion, b.distroVersion));
// Azul provides two versions: java_version and distro_version
// we should sort by both fields by descending
return (-semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(a.version, b.version) ||
-semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(a.zuluVersion, b.zuluVersion));
})
.map((item) => ({
version: item.version,
@@ -97,21 +85,21 @@ class ZuluDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/*
_actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
let javaArchivePath = await this.downloadAndVerify(javaRelease);
_actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Extracting Java archive...`);
const extension = (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getDownloadArchiveExtension */ .ag)();
const extension = (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getDownloadArchiveExtension */ .ag)();
if (process.platform === 'win32') {
javaArchivePath = (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .renameWinArchive */ .n2)(javaArchivePath);
javaArchivePath = (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .renameWinArchive */ .n2)(javaArchivePath);
}
const extractedJavaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .extractJdkFile */ .PE)(javaArchivePath, extension);
const extractedJavaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .extractJdkFile */ .PE)(javaArchivePath, extension);
const archiveName = fs__WEBPACK_IMPORTED_MODULE_2___default().readdirSync(extractedJavaPath)[0];
const archivePath = path__WEBPACK_IMPORTED_MODULE_1___default().join(extractedJavaPath, archiveName);
const javaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .cacheJdkDir */ .Vj)(archivePath, this.toolcacheFolderName, this.getToolcacheVersionName(javaRelease.version), this.architecture);
const javaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .cacheJdkDir */ .Vj)(archivePath, this.toolcacheFolderName, this.getToolcacheVersionName(javaRelease.version), this.architecture);
return { version: javaRelease.version, path: javaPath };
}
async getAvailableVersions() {
const arch = this.getArchitectureOptions();
const [bundleType, features] = this.packageType.split('+');
const platform = this.getPlatformOption();
const extension = (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getDownloadArchiveExtension */ .ag)();
const extension = (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getDownloadArchiveExtension */ .ag)();
const javafx = features?.includes('fx') ?? false;
const crac = features?.includes('crac') ?? false;
const releaseStatus = this.stable ? 'ga' : 'ea';
@@ -197,7 +185,7 @@ class ZuluDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__/*
// The new Metadata API's "linux" value returns both glibc and musl
// packages, so target the libc the runner actually has. A glibc JDK
// cannot run on Alpine.
return (0,_platform_types_js__WEBPACK_IMPORTED_MODULE_4__/* .isAlpineLinux */ .G6)() ? 'linux_musl' : 'linux_glibc';
return (0,_platform_types_js__WEBPACK_IMPORTED_MODULE_5__/* .isAlpineLinux */ .G6)() ? 'linux_musl' : 'linux_glibc';
default:
return process.platform;
}
+224 -499
View File
File diff suppressed because it is too large. Load diff
+642 -987
View File
File diff suppressed because it is too large. Load diff
+11 -11
View File
@@ -49,27 +49,27 @@
"@actions/http-client": "^4.0.1",
"@actions/io": "^3.0.2",
"@actions/tool-cache": "^4.0.0",
"fast-xml-parser": "^5.11.1",
"fast-xml-parser": "^5.11.0",
"semver": "^7.8.5"
},
"devDependencies": {
"@eslint/js": "^10.0.1",
"@jest/globals": "^30.5.2",
"@types/node": "^26.6.2",
"@jest/globals": "^30.4.1",
"@types/node": "^26.2.0",
"@types/semver": "^7.8.0",
"@typescript-eslint/eslint-plugin": "^8.70.1",
"@typescript-eslint/eslint-plugin": "^8.67.0",
"@typescript-eslint/parser": "^8.65.0",
"@vercel/ncc": "^0.45.0",
"eslint": "^10.11.0",
"eslint": "^10.8.1",
"eslint-config-prettier": "^10.1.8",
"eslint-plugin-jest": "^29.16.6",
"eslint-plugin-jest": "^29.16.1",
"eslint-plugin-n": "^18.3.0",
"globals": "^17.12.0",
"globals": "^17.11.0",
"husky": "^9.1.7",
"jest": "^30.5.2",
"lint-staged": "^17.5.1",
"prettier": "^3.9.9",
"ts-jest": "^29.4.13",
"jest": "^30.4.2",
"lint-staged": "^17.3.0",
"prettier": "^3.9.5",
"ts-jest": "^29.4.11",
"typescript": "^6.0.3"
},
"bugs": {
+10 -5
View File
@@ -5,9 +5,9 @@ import semver from 'semver';
import path from 'path';
import * as httpm from '@actions/http-client';
import {
convertVersionToSemver,
getToolcachePath,
isVersionSatisfies,
normalizeJavaVersionToSemver
isVersionSatisfies
} from '../util.js';
import type {
ChecksumAlgorithm,
@@ -673,9 +673,14 @@ export abstract class JavaBase {
stable = false;
}
// Normalize Java release tags and JEP 322 versions without losing exact
// build constraints ('jdk-27+35' -> '27.0.0+35'). Leave ranges unchanged.
version = normalizeJavaVersionToSemver(version);
// Java uses a versioning scheme (JEP 322) that can contain more numeric
// fields than SemVer allows, e.g. '18.0.1.1' or '11.0.9.1'. Convert such
// exact versions to SemVer build notation ('18.0.1+1') so they are
// accepted. Ranges and versions that already carry build metadata are
// left untouched.
if (/^\d+(\.\d+){3,}$/.test(version)) {
version = convertVersionToSemver(version);
}
if (!semver.validRange(version)) {
throw new Error(
+7 -4
View File
@@ -1,5 +1,5 @@
import semver from 'semver';
import {normalizeJavaVersionToSemver} from '../util.js';
import {convertVersionToSemver} from '../util.js';
export enum JavaDistribution {
Temurin = 'temurin',
@@ -98,9 +98,12 @@ function canResolveTemurinJmods(version: string): boolean {
return true;
}
const normalizedRange = normalizeJavaVersionToSemver(
normalizedVersion.replace(/-ea$/, '').replace('-ea.', '+')
);
let normalizedRange = normalizedVersion
.replace(/-ea$/, '')
.replace('-ea.', '+');
if (/^\d+(\.\d+){3,}$/.test(normalizedRange)) {
normalizedRange = convertVersionToSemver(normalizedRange);
}
if (!semver.validRange(normalizedRange)) {
// JavaBase owns general version validation and its targeted error messages.
return true;
+15 -5
View File
@@ -1,6 +1,5 @@
import fs from 'fs';
import semver from 'semver';
import {normalizeJavaVersionToSemver} from '../util.js';
import {JavaDistribution} from './package-types.js';
export type JavaPlatform = 'linux' | 'macos' | 'windows' | 'solaris';
@@ -290,20 +289,31 @@ function isJavaDistribution(value: string): value is JavaDistribution {
}
function isVersionCompatible(version: string, supportedRange: string): boolean {
const normalizedVersion = version.trim().toLowerCase();
let normalizedVersion = version.trim().toLowerCase();
if (normalizedVersion === 'latest') {
return true;
}
if (/^\d+(\.\d+){3,}$/.test(normalizedVersion)) {
normalizedVersion = normalizeExtendedVersionToSemver(normalizedVersion);
}
const requestedRange = semver.validRange(
normalizeJavaVersionToSemver(
normalizedVersion.replace(/-ea$/, '').replace('-ea.', '+')
)
normalizedVersion.replace(/-ea$/, '')
);
const capabilityRange = semver.validRange(supportedRange);
if (!requestedRange || !capabilityRange) {
return true;
}
function normalizeExtendedVersionToSemver(version: string): string {
const versionParts = version.split('.');
const mainVersion = versionParts.slice(0, 3).join('.');
if (versionParts.length > 3) {
return `${mainVersion}+${versionParts.slice(3).join('.')}`;
}
return version;
}
return semver.intersects(requestedRange, capabilityRange, {
includePrerelease: true
});
+4 -39
View File
@@ -70,7 +70,7 @@ export class TemurinDistribution extends JavaBase {
const formattedVersion = this.stable
? item.version_data.semver
: item.version_data.semver.replace('-beta+', '+');
const release: JavaDownloadRelease = {
return {
version: formattedVersion,
url: item.binaries[0].package.link,
signatureUrl: item.binaries[0].package.signature_link,
@@ -79,29 +79,11 @@ export class TemurinDistribution extends JavaBase {
value: item.binaries[0].package.checksum,
source: item.binaries[0].package.checksum_link
}
};
return {
release,
openjdkVersion: getOpenJdkSemverVersion(item.version_data)
};
} as JavaDownloadRelease;
});
// The Adoptium API `semver` folds the JEP 322 patch field into the build
// number ('26.0.2.1+1' -> '26.0.2+101') and appends extra metadata for LTS
// releases ('25.0.4+7' -> '25.0.4+7.0.LTS'). Exact versions requested by
// users follow the OpenJDK notation instead, so also match them against a
// key derived from the OpenJDK version fields ('26.0.2+1.1', '25.0.4+7').
const isExactBuildRequest = (semver.parse(version)?.build.length ?? 0) > 0;
const satisfiedVersions = availableVersionsWithBinaries
.filter(
({release, openjdkVersion}) =>
isVersionSatisfies(version, release.version) ||
(isExactBuildRequest &&
openjdkVersion !== null &&
semver.compareBuild(version, openjdkVersion) === 0)
)
.map(({release}) => release)
.filter(item => isVersionSatisfies(version, item.version))
.sort((a, b) => {
return -semver.compareBuild(a.version, b.version);
});
@@ -110,7 +92,7 @@ export class TemurinDistribution extends JavaBase {
satisfiedVersions.length > 0 ? satisfiedVersions[0] : null;
if (!resolvedFullVersion) {
const availableVersionStrings = availableVersionsWithBinaries.map(
({release}) => release.version
item => item.version
);
throw this.createVersionNotFoundError(version, availableVersionStrings);
}
@@ -327,20 +309,3 @@ export class TemurinDistribution extends JavaBase {
return architecture === 'armv7' ? 'arm' : architecture;
}
}
/**
* Builds a SemVer version from the OpenJDK version fields reported by the
* Adoptium API, e.g. '26.0.2.1+1' -> '26.0.2+1.1' and '25.0.4+7-LTS' ->
* '25.0.4+7'. Returns null if the fields cannot form a valid SemVer version.
*/
function getOpenJdkSemverVersion(
versionData: ITemurinAvailableVersions['version_data']
): string | null {
const {major, minor, security, patch, build} = versionData;
if (build === undefined || build === null) {
return null;
}
const buildMetadata = patch ? `${patch}.${build}` : `${build}`;
const version = `${major}.${minor}.${security}+${buildMetadata}`;
return semver.valid(version) ? version : null;
}
-1
View File
@@ -34,7 +34,6 @@ export interface ITemurinAvailableVersions {
minor: number;
openjdk_version: string;
security: string;
patch?: number;
semver: string;
};
}
+6 -21
View File
@@ -2,6 +2,7 @@ import * as core from '@actions/core';
import path from 'path';
import fs from 'fs';
import semver from 'semver';
import {JavaBase} from '../base-installer.js';
import {IZuluPackageDetails, IZuluVersions} from './models.js';
@@ -29,17 +30,6 @@ interface ZuluResolvedRelease {
packageUuid: string;
}
function compareNumberArrays(a: number[], b: number[]): number {
const length = Math.max(a.length, b.length);
for (let i = 0; i < length; i++) {
const diff = (a[i] ?? 0) - (b[i] ?? 0);
if (diff !== 0) {
return diff;
}
}
return 0;
}
export class ZuluDistribution extends JavaBase {
constructor(installerOptions: JavaInstallerOptions) {
super('Zulu', installerOptions);
@@ -60,9 +50,7 @@ export class ZuluDistribution extends JavaBase {
return {
version: convertVersionToSemver(javaVersion),
url: item.download_url,
javaVersion: item.java_version,
buildNumber: item.openjdk_build_number ?? 0,
distroVersion: item.distro_version,
zuluVersion: convertVersionToSemver(item.distro_version),
packageUuid: item.package_uuid
};
});
@@ -70,14 +58,11 @@ export class ZuluDistribution extends JavaBase {
const satisfiedVersions = availableVersions
.filter(item => isVersionSatisfies(version, item.version))
.sort((a, b) => {
// Compare numerically rather than via semver build metadata: Azul
// hotfix releases carry a 4th java_version segment (e.g. 25.0.4.1+1,
// rendered as '25.0.4+1.1') that must rank above 25.0.4+7, whereas
// semver.compareBuild would order the build identifiers '7' > '1'.
// Azul provides two versions: java_version and distro_version
// we should sort by both fields by descending
return (
-compareNumberArrays(a.javaVersion, b.javaVersion) ||
b.buildNumber - a.buildNumber ||
-compareNumberArrays(a.distroVersion, b.distroVersion)
-semver.compareBuild(a.version, b.version) ||
-semver.compareBuild(a.zuluVersion, b.zuluVersion)
);
})
.map((item): ZuluResolvedRelease => ({
-25
View File
@@ -510,31 +510,6 @@ export function convertVersionToSemver(version: number[] | string) {
return mainVersion;
}
/**
* Normalize numeric Java versions, optionally prefixed with 'jdk-'. Pad
* abbreviated build requests ('27+35' -> '27.0.0+35') to preserve exact
* matching, and move extra JEP 322 fields into build metadata
* ('26.0.2.1+1' -> '26.0.2+1.1'). Leave ranges unchanged.
*/
export function normalizeJavaVersionToSemver(version: string): string {
const match = /^(?:jdk-)?(\d+(?:\.\d+)*)(?:\+([0-9A-Za-z.-]+))?$/.exec(
version
);
if (!match) {
return version;
}
const versionParts = match[1].split('.');
if (match[2]) {
while (versionParts.length < 3) {
versionParts.push('0');
}
}
const converted = convertVersionToSemver(versionParts.join('.'));
return match[2]
? `${converted}${versionParts.length > 3 ? '.' : '+'}${match[2]}`
: converted;
}
/**
* Builds a validator for the bytes currently served by a URL from the response
* headers of a HEAD request. A vendor's `/latest/` URL never changes, so this