chore(deps): bump actions/setup-java from 5 to 6 by dependabot[bot] · Pull Request #703 · checkout/checkout-sdk-java

dependabot · 2026-10-29T05:54:24Z

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

dist: Migrate from Zulu Discovery API to Azul Metadata API by @jameswald in actions/setup-java#1010

feat: add .mvn/extensions.xml to Maven cache key pattern by @brunoborges with @Copilot in actions/setup-java#1041

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-java#1078

Map Zulu x86 architecture to i686 for Azul Metadata API by @brunoborges in actions/setup-java#1079

Rename jdkFile input to jdk-file with deprecated alias by @brunoborges in actions/setup-java#1083

Infer distribution from asdf .tool-versions vendor prefix by @brunoborges in actions/setup-java#1084

Add Maven compiler problem matcher for javac diagnostics by @brunoborges in actions/setup-java#1086

feat: expose cache-primary-key output (#597) by @brunoborges in actions/setup-java#1088

docs: clarify V6 ESM migration is not a user-facing breaking change by @brunoborges in actions/setup-java#1090

Support multi-field Java versions like 18.0.1.1 by @brunoborges in actions/setup-java#1092

docs: document seeding the Maven cache for plugin dependencies by @brunoborges in actions/setup-java#1094

docs: clarify Maven cache paths and key hash inputs by @brunoborges in actions/setup-java#1096

Support pinning java-version as "latest" by @brunoborges in actions/setup-java#1093

chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @dependabot[bot] in actions/setup-java#1101

chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @dependabot[bot] in actions/setup-java#1103

chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in actions/setup-java#1105

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in actions/setup-java#1106

chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 by @dependabot[bot] in actions/setup-java#1104

dist: Cover Tencent Kona JDK 25 by @johnshajiang in actions/setup-java#1108

chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in actions/setup-java#1102

Preserve Maven toolchains across repeated setup-java runs (#1099) by @brunoborges in actions/setup-java#1111

dist: Support Liberica NIK (#878) by @asm0dey in actions/setup-java#1112

Fix template injection (zizmor alert #118) in e2e-versions.yml by @brunoborges with @Copilot in actions/setup-java#1114

Fix template injection in e2e-versions.yml (zizmor alert #122) by @brunoborges with @Copilot in actions/setup-java#1120

Disable persisted checkout credentials in e2e workflow by @brunoborges with @Copilot in actions/setup-java#1115

feat: Update recommended configuration for GPG signing by @wetneb in actions/setup-java#608

Cache Maven and Gradle wrapper distributions separately from the dependency cache by @brunoborges in actions/setup-java#1097

Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @brunoborges in actions/setup-java#1124

Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @brunoborges in actions/setup-java#1123

Extract repeated directory-check assertions into check-dir.sh helper by @brunoborges in actions/setup-java#1127

Consolidate duplicate jobs in e2e-versions workflow by @brunoborges in actions/setup-java#1125

Use YAML anchors to reduce boilerplate in e2e-versions workflow by @brunoborges in actions/setup-java#1126

Updated msft json for now by @jmjaffe37 in actions/setup-java#1129

Document missing action inputs in README by @brunoborges in actions/setup-java#1130

chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in actions/setup-java#1128

Add an option to disable Java problem matchers by @brunoborges in actions/setup-java#1133

docs: update setup-java examples by @HarithaVattikuti in actions/setup-java#1131

Clarify credential environment variable inputs by @brunoborges in actions/setup-java#1134

chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @dependabot[bot] in actions/setup-java#1135

chore(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in actions/setup-java#1143

chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @dependabot[bot] in actions/setup-java#1142

chore(deps-dev): bump @typescript-eslint/parser from 8.64.0 to 8.65.0 by @dependabot[bot] in actions/setup-java#1138

chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @dependabot[bot] in actions/setup-java#1136

chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in actions/setup-java#1137

chore(deps): fix npm audited vulnerabilities by @mhoffrog in actions/setup-java#1140

Fix formatting issues in README.md by @brunoborges in actions/setup-java#1144

Remediate npm audit findings and rebuild distributions by @brunoborges with @Copilot in actions/setup-java#1145

Set GRAALVM_HOME for GraalVM distributions by @brunoborges with @Copilot in actions/setup-java#1146

... (truncated)

Commits

b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
2a69be2 feat: support Maven server credential origins (#1282)
d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
a78ec39 Stop GPG agent before removing signature-verification home (#1273)
97c5a5e Support Temurin on Linux RISC-V (#1269)
1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
Additional commits viewable in compare view

agent-wall-e · 2026-10-29T05:54:30Z

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

security_sensitive_path:.github/workflows/build-master.yml
security_sensitive_path:.github/workflows/build-pull-request.yml
security_sensitive_path:.github/workflows/build-release.yml
security_sensitive_path:.github/workflows/codeql-analysis.yml

Operational gates

✅ jira_ticket
✅ independent_review

Files analysed: 4

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-29T05:54:30Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`security_sensitive_path` — `.github/workflows/build-master.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `.github/workflows/build-pull-request.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `.github/workflows/build-release.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `.github/workflows/codeql-analysis.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e · 2026-10-29T05:54:36Z

🟢 Advisory review: Looks good to me

This PR still needs a human approval — wall-e cannot auto-approve it. For what it's worth, I read the diff and found nothing I'd block on.

Bumps actions/setup-java from v5 to v6 across four workflow files; the change is a straightforward version pin update with no configuration changes.

What I checked

All four workflow files consistently updated from @v5 to @v6, matching the stated intent.
The temurin distribution and java-version '11' inputs are unchanged and remain valid in v6 (no breaking input changes introduced by v6 per the release notes).
The deprecated jdkFile→jdk-file rename in v6 is irrelevant here since none of the workflows use that input.

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

agent-wall-e · 2026-11-02T11:09:14Z

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

security_sensitive_path:.github/workflows/build-master.yml
security_sensitive_path:.github/workflows/build-pull-request.yml
security_sensitive_path:.github/workflows/build-release.yml
security_sensitive_path:.github/workflows/codeql-analysis.yml

Operational gates

✅ jira_ticket
✅ independent_review

Files analysed: 4

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-11-02T11:09:14Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`security_sensitive_path` — `.github/workflows/build-master.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `.github/workflows/build-pull-request.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `.github/workflows/build-release.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `.github/workflows/codeql-analysis.yml`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

sonarqubecloud · 2026-11-02T11:10:04Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 29, 2026

dependabot Bot changed the title ~~chore(deps): bump actions/setup-java from 2 to 6~~ chore(deps): bump actions/setup-java from 5 to 6 Nov 2, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions/setup-java-6 branch from 2db7ed7 to 20d2744 Compare November 2, 2026 11:09

Navigation Menu

Repository navigation

chore(deps): bump actions/setup-java from 5 to 6 - #703

chore(deps): bump actions/setup-java from 5 to 6#703
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions/setup-java-6

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading

Uh oh!

agent-wall-e Bot commented Oct 29, 2026

Uh oh!

agent-wall-e Bot commented Oct 29, 2026

Uh oh!

agent-wall-e Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

agent-wall-e Bot commented Nov 2, 2026

Uh oh!

agent-wall-e Bot commented Nov 2, 2026

Uh oh!

sonarqubecloud Bot commented Nov 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.0

What's Changed

Uh oh!

agent-wall-e Bot commented Oct 29, 2026

🔴 Risk Classification: MAJOR

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Oct 29, 2026

Uh oh!

agent-wall-e Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Advisory review: Looks good to me

What I checked

Uh oh!

agent-wall-e Bot commented Nov 2, 2026

🔴 Risk Classification: MAJOR

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Nov 2, 2026

Uh oh!

sonarqubecloud Bot commented Nov 2, 2026

Quality Gate passed

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading

agent-wall-e Bot commented Oct 29, 2026 •

edited

Loading