Bump actions/checkout from 6 to 7

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
fix: reject non-semver candidate versions in isVersionSatisfies (#1009 )
2026-06-22 07:41:13 +03:00 · 2026-06-22 03:43:15 +00:00 · 2026-06-17 22:47:02 -05:00 · 2026-06-17 07:58:23 -07:00 · 2026-06-17 07:52:02 -07:00
11 changed files with 62 additions and 32 deletions
@@ -10,5 +10,9 @@ on:

 jobs:
  call-codeQL-analysis:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
    name: CodeQL analysis
    uses: actions/reusable-workflows/.github/workflows/codeql-analysis.yml@main
@@ -24,7 +24,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for gradle
        uses: ./
        id: setup-java
@@ -51,7 +51,7 @@ jobs:
    needs: gradle1-save
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for gradle
        uses: ./
        id: setup-java
@@ -76,7 +76,7 @@ jobs:
    needs: gradle1-save
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for gradle
        uses: ./
        id: setup-java
@@ -24,7 +24,7 @@ jobs:
        os: [macos-15-intel, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for gradle
        uses: ./
        id: setup-java
@@ -50,7 +50,7 @@ jobs:
    needs: gradle-save
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for gradle
        uses: ./
        id: setup-java
@@ -73,7 +73,7 @@ jobs:
        os: [macos-15-intel, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for maven
        uses: ./
        id: setup-java
@@ -97,7 +97,7 @@ jobs:
    needs: maven-save
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for maven
        uses: ./
        id: setup-java
@@ -124,7 +124,7 @@ jobs:
        os: [macos-15-intel, windows-latest, ubuntu-22.04]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for sbt
        uses: ./
        id: setup-java
@@ -174,7 +174,7 @@ jobs:
    needs: sbt-save
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run setup-java with the cache for sbt
        uses: ./
        id: setup-java
@@ -21,7 +21,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Download Adopt OpenJDK file
        run: |
          if ($IsLinux) {
@@ -58,7 +58,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Download Zulu OpenJDK file
        run: |
          if ($IsLinux) {
@@ -95,7 +95,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Download Eclipse Temurin file
        run: |
          if ($IsLinux) {
@@ -25,7 +25,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -60,7 +60,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Create fake settings.xml
        run: |
          $xmlDirectory = Join-Path $HOME ".m2"
@@ -96,7 +96,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Create fake settings.xml
        run: |
          $xmlDirectory = Join-Path $HOME ".m2"
@@ -133,7 +133,7 @@ jobs:
        os: [macos-latest, windows-latest, ubuntu-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -73,7 +73,7 @@ jobs:
            version: '24-ea'
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -99,7 +99,7 @@ jobs:
        version: ['21', '17']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Install bash
        run: apk add --no-cache bash
      - name: setup-java
@@ -149,7 +149,7 @@ jobs:
            version: '17.0.7'
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -184,7 +184,7 @@ jobs:
            os: macos-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -220,7 +220,7 @@ jobs:
            os: macos-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -259,7 +259,7 @@ jobs:
        version: ['17-ea', '15.0.0-ea.14']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -281,7 +281,7 @@ jobs:
        version: ['17-ea']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -303,7 +303,7 @@ jobs:
        version: ['17-ea', '21-ea']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -390,7 +390,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -418,7 +418,7 @@ jobs:
        version: ['11']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: setup-java
        uses: ./
        id: setup-java
@@ -441,7 +441,7 @@ jobs:
        java-version-file: ['.java-version', '.tool-versions']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Create .java-version file
        shell: bash
        run: echo "17" > .java-version
@@ -470,7 +470,7 @@ jobs:
        java-version-file: ['.java-version', '.tool-versions']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Create .java-version file
        shell: bash
        run: echo "11" > .java-version
@@ -498,7 +498,7 @@ jobs:
        java-version-file: ['.java-version', '.tool-versions']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Create .java-version file
        shell: bash
        run: echo "17.0.10" > .java-version
@@ -526,7 +526,7 @@ jobs:
        java-version-file: ['.java-version', '.tool-versions', '.sdkmanrc']
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Create .java-version file
        shell: bash
        run: echo "openjdk64-17.0.10" > .java-version
@@ -15,7 +15,7 @@ jobs:

    steps:
      - name: Checking out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Publish
        id: publish
        uses: actions/publish-immutable-action@v0.0.4
@@ -29,7 +29,11 @@ describe('isVersionSatisfies', () => {
    ['2.5.1+3', '2.5.1+3', true],
    ['2.5.1+3', '2.5.1+2', false],
    ['15.0.0+14', '15.0.0+14.1.202003190635', false],
-    ['15.0.0+14.1.202003190635', '15.0.0+14.1.202003190635', true]
+    ['15.0.0+14.1.202003190635', '15.0.0+14.1.202003190635', true],
+    // 4-segment versions (e.g. JetBrains Runtime '17.0.8.1+1080.1') are not
+    // valid semver — they should be rejected, not throw.
+    ['25.0.3+480.61', '17.0.8.1+1080.1', false],
+    ['17', '17.0.8.1+1080.1', false]
  ])(
    '%s, %s -> %s',
    (inputRange: string, inputVersion: string, expected: boolean) => {
@@ -52208,6 +52208,13 @@ function getDownloadArchiveExtension() {
 exports.getDownloadArchiveExtension = getDownloadArchiveExtension;
 function isVersionSatisfies(range, version) {
    var _a;
+    // Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
+    // like '17.0.8.1+1080.1' that semver rejects. If the candidate version
+    // isn't valid semver, it can't match — bail out rather than letting
+    // compareBuild / satisfies throw.
+    if (!semver.valid(version)) {
+        return false;
+    }
    if (semver.valid(range)) {
        // if full version with build digit is provided as a range (such as '1.2.3+4')
        // we should check for exact equal via compareBuild
@@ -81039,6 +81039,13 @@ function getDownloadArchiveExtension() {
 exports.getDownloadArchiveExtension = getDownloadArchiveExtension;
 function isVersionSatisfies(range, version) {
    var _a;
+    // Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
+    // like '17.0.8.1+1080.1' that semver rejects. If the candidate version
+    // isn't valid semver, it can't match — bail out rather than letting
+    // compareBuild / satisfies throw.
+    if (!semver.valid(version)) {
+        return false;
+    }
    if (semver.valid(range)) {
        // if full version with build digit is provided as a range (such as '1.2.3+4')
        // we should check for exact equal via compareBuild
@@ -55,6 +55,14 @@ export function getDownloadArchiveExtension() {
 }

 export function isVersionSatisfies(range: string, version: string): boolean {
+  // Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
+  // like '17.0.8.1+1080.1' that semver rejects. If the candidate version
+  // isn't valid semver, it can't match — bail out rather than letting
+  // compareBuild / satisfies throw.
+  if (!semver.valid(version)) {
+    return false;
+  }
+
  if (semver.valid(range)) {
    // if full version with build digit is provided as a range (such as '1.2.3+4')
    // we should check for exact equal via compareBuild
Author	SHA1	Message	Date
dependabot[bot]	7222542397	Bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-22 03:43:15 +00:00
Sean Proctor	baa1691374	fix: reject non-semver candidate versions in isVersionSatisfies (#1009 ) Distributions like JetBrains Runtime publish 4-segment versions such as '17.0.8.1+1080.1' that the semver package rejects. Both compareBuild and satisfies throw on these, which surfaced to users as "Error: Invalid Version: 17.0.8.1+1080.1" and aborted the whole install when any available version was non-semver. Guard with an early semver.valid check so unparseable versions are treated as a non-match. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-17 22:47:02 -05:00
George Adams	bc52a13212	fix CodeQL permissions (#1025 )	2026-06-17 07:58:23 -07:00
Josh Soref	c9b6aee07e	Fix codeql workflow permissions (#993 ) Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2026-06-17 07:52:02 -07:00