fix(ci): set up Java before Kotlin in PR checks

.github/actions/prepare-test/action.yml

@@ -6,11 +6,11 @@ inputs:
     required: true
   use-all-platform-bundle:
     description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: "false"
+    default: 'false'
     required: false
   setup-kotlin:
     description: "If true, we setup kotlin"
-    default: "true"
+    default: 'true'
     required: true
 outputs:
   tools-url:
@@ -73,10 +73,7 @@ runs:
           exit 1
         fi
 
-    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
+    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
-        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
-        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
-        # version on the `ubuntu-latest` runners and CodeQL.
-        version: 2.1.20
+        version: 1.8.21

.github/actions/release-initialise/action.yml

@@ -16,7 +16,7 @@ runs:
       shell: bash
 
     - name: Set up Node
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 24
         cache: 'npm'

.github/dependabot.yml

@@ -16,14 +16,6 @@ updates:
       # This might be fixed when we move to eslint v9.
       - dependency-name: "eslint-plugin-import"
         versions: [">=2.30.0"]
-
-      # Some of our dependencies are lagging behind with support for new versions of
-      # `undici` which is why we have to override it in `package.json`. Dependabot
-      # workflows fail when they try to update a dependency that is explicitly
-      # overriden. Since this happens somewhat routinely at the moment, we are
-      # excluding `undici` here and have to manually update it when needed.
-      - dependency-name: "undici"
-        versions: [">=7.30.1"]
     groups:
       npm-minor:
         patterns:
@@ -34,7 +26,7 @@ updates:
   - package-ecosystem: github-actions
     directories:
       - "/.github/workflows"
-      - "/.github/actions/*/"
+      - "/.github/actions"
     schedule:
       interval: weekly
     cooldown:

.github/workflows/__all-platform-bundle.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   all-platform-bundle:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__analysis-kinds.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analysis-kinds-${{github.ref}}
+  group: analysis-kinds-${{github.ref}}-${{inputs.java-version}}
 jobs:
   analysis-kinds:
     strategy:
@@ -68,6 +78,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__analyze-ref-input.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   analyze-ref-input:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__autobuild-action.yml

@@ -25,6 +25,11 @@ on:
         description: The version of .NET to install
         required: false
         default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -32,12 +37,17 @@ on:
         description: The version of .NET to install
         required: false
         default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}
+  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.java-version}}
 jobs:
   autobuild-action:
     strategy:
@@ -64,6 +74,11 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__autobuild-working-dir.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-working-dir-${{github.ref}}
+  group: autobuild-working-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
   autobuild-working-dir:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-manual.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   build-mode-manual:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-none.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-none-${{github.ref}}
+  group: build-mode-none-${{github.ref}}-${{inputs.java-version}}
 jobs:
   build-mode-none:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-rollback.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-rollback-${{github.ref}}
+  group: build-mode-rollback-${{github.ref}}-${{inputs.java-version}}
 jobs:
   build-mode-rollback:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__bundle-from-nightly.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-nightly-${{github.ref}}
+  group: bundle-from-nightly-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-from-nightly:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__bundle-from-toolcache.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-toolcache-${{github.ref}}
+  group: bundle-from-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-from-toolcache:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__bundle-toolcache.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-toolcache-${{github.ref}}
+  group: bundle-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-toolcache:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cleanup-db-cluster-dir-${{github.ref}}
+  group: cleanup-db-cluster-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cleanup-db-cluster-dir:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__config-export.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-export-${{github.ref}}
+  group: config-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
   config-export:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__config-input.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-input-${{github.ref}}
+  group: config-input-${{github.ref}}-${{inputs.java-version}}
 jobs:
   config-input:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__cpp-deptrace-disabled.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-disabled-${{github.ref}}
+  group: cpp-deptrace-disabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-disabled:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-on-macos-${{github.ref}}
+  group: cpp-deptrace-enabled-on-macos-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-enabled-on-macos:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-enabled.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-${{github.ref}}
+  group: cpp-deptrace-enabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-enabled:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__diagnostics-export.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-export-${{github.ref}}
+  group: diagnostics-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
   diagnostics-export:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__diagnostics-without-db.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-without-db-${{github.ref}}
+  group: diagnostics-without-db-${{github.ref}}-${{inputs.java-version}}
 jobs:
   diagnostics-without-db:
     strategy:
@@ -53,6 +63,11 @@ jobs:
       #
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -122,7 +137,7 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Download workflow artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: test-mode-sarif-*
           path: sarif

.github/workflows/__export-file-baseline-information.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   export-file-baseline-information:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__extractor-ram-threads.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: extractor-ram-threads-${{github.ref}}
+  group: extractor-ram-threads-${{github.ref}}-${{inputs.java-version}}
 jobs:
   extractor-ram-threads:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-custom-queries.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-custom-queries:
     strategy:
@@ -77,6 +87,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround-diagnostic:
     strategy:
@@ -61,6 +71,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround-no-file-program:
     strategy:
@@ -61,6 +71,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround:
     strategy:
@@ -61,6 +71,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-tracing-autobuilder.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,19 +37,24 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-autobuilder:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
@@ -81,6 +91,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,19 +37,24 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-custom-build-steps:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
@@ -81,6 +91,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,19 +37,24 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-legacy-workflow:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
@@ -81,6 +91,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go.yml

@@ -20,6 +20,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 jobs:
   go-custom-queries:
     name: 'Go: Custom queries'
@@ -30,6 +35,7 @@ jobs:
     with:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround-diagnostic:
     name: 'Go: diagnostic when Go is changed after init step'
     permissions:
@@ -38,6 +44,7 @@ jobs:
     uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround-no-file-program:
     name: 'Go: diagnostic when `file` is not installed'
     permissions:
@@ -46,6 +53,7 @@ jobs:
     uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround:
     name: 'Go: workaround for indirect tracing'
     permissions:
@@ -54,6 +62,7 @@ jobs:
     uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-autobuilder:
     name: 'Go: tracing with autobuilder step'
     permissions:
@@ -62,6 +71,7 @@ jobs:
     uses: ./.github/workflows/__go-tracing-autobuilder.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-custom-build-steps:
     name: 'Go: tracing with custom build steps'
     permissions:
@@ -70,6 +80,7 @@ jobs:
     uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-legacy-workflow:
     name: 'Go: tracing with legacy workflow'
     permissions:
@@ -78,3 +89,4 @@ jobs:
     uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}

.github/workflows/__init-with-registries.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: init-with-registries-${{github.ref}}
+  group: init-with-registries-${{github.ref}}-${{inputs.java-version}}
 jobs:
   init-with-registries:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__javascript-source-root.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: javascript-source-root-${{github.ref}}
+  group: javascript-source-root-${{github.ref}}-${{inputs.java-version}}
 jobs:
   javascript-source-root:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__job-run-uuid-sarif.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: job-run-uuid-sarif-${{github.ref}}
+  group: job-run-uuid-sarif-${{github.ref}}-${{inputs.java-version}}
 jobs:
   job-run-uuid-sarif:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__language-aliases.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: language-aliases-${{github.ref}}
+  group: language-aliases-${{github.ref}}-${{inputs.java-version}}
 jobs:
   language-aliases:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__linux-arm64.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   linux-arm64:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__local-bundle.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   local-bundle:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__multi-language-autodetect.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,19 +47,24 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   multi-language-autodetect:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
@@ -109,6 +119,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__overlay-init-fallback.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: overlay-init-fallback-${{github.ref}}
+  group: overlay-init-fallback-${{github.ref}}-${{inputs.java-version}}
 jobs:
   overlay-init-fallback:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-codescanning-config-inputs-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__packaging-config-inputs-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-config-inputs-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__packaging-config-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-config-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__packaging-inputs-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-inputs-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__per-language-bundle-validation.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}
+  group: per-language-bundle-validation-${{github.ref}}-${{inputs.java-version}}
 jobs:
   per-language-bundle-validation:
     strategy:
@@ -81,6 +91,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__remote-config.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   remote-config:
     strategy:
@@ -77,6 +87,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__resolve-environment-action.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: resolve-environment-action-${{github.ref}}
+  group: resolve-environment-action-${{github.ref}}-${{inputs.java-version}}
 jobs:
   resolve-environment-action:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__rubocop-multi-language.yml

@@ -0,0 +1,89 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - RuboCop multi-language
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+  workflow_call:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: rubocop-multi-language-${{github.ref}}-${{inputs.java-version}}
+jobs:
+  rubocop-multi-language:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: RuboCop multi-language
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        with:
+          ruby-version: 2.6
+      - name: Install Code Scanning integration
+        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+      - name: Install dependencies
+        run: bundle install
+      - name: RuboCop run
+        run: |
+          bash -c "
+            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+            [[ $? -ne 2 ]]
+          "
+      - uses: ./../action/upload-sarif
+        with:
+          sarif_file: rubocop.sarif
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__ruby.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ruby-${{github.ref}}
+  group: ruby-${{github.ref}}-${{inputs.java-version}}
 jobs:
   ruby:
     strategy:
@@ -56,6 +66,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__rust.yml

@@ -19,22 +19,32 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rust-${{github.ref}}
+  group: rust-${{github.ref}}-${{inputs.java-version}}
 jobs:
   rust:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.22.1
@@ -54,6 +64,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__split-workflow.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   split-workflow:
     strategy:
@@ -85,6 +95,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__start-proxy.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: start-proxy-${{github.ref}}
+  group: start-proxy-${{github.ref}}-${{inputs.java-version}}
 jobs:
   start-proxy:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__submit-sarif-failure.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: submit-sarif-failure-${{github.ref}}
+  group: submit-sarif-failure-${{github.ref}}-${{inputs.java-version}}
 jobs:
   submit-sarif-failure:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__swift-autobuild.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-autobuild-${{github.ref}}
+  group: swift-autobuild-${{github.ref}}-${{inputs.java-version}}
 jobs:
   swift-autobuild:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__swift-custom-build.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   swift-custom-build:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__unset-environment.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   unset-environment:
     strategy:
@@ -77,6 +87,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__upload-ref-sha-input.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   upload-ref-sha-input:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__upload-sarif.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   upload-sarif:
     strategy:
@@ -82,6 +92,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__with-checkout-path.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   with-checkout-path:
     strategy:
@@ -76,6 +86,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/debug-artifacts-failure-safe.yml

@@ -6,13 +6,13 @@ env:
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -30,10 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - stable-v2.20.7
-          - default
-          - linked
-          - nightly-latest
+        - stable-v2.20.7
+        - default
+        - linked
+        - nightly-latest
     name: Upload debug artifacts after failure in analyze
     continue-on-error: true
     env:
@@ -43,12 +43,7 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
-
-    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
-    # We could install that older version on the newer runners, or use the older runner.
-    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
-
+    runs-on: ubuntu-latest
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
@@ -65,7 +60,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: "9.x"
+          dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
@@ -97,7 +92,6 @@ jobs:
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       - name: Check expected artifacts exist
         run: |
-          VERSIONS="stable-v2.20.7 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             echo "Artifacts from version $version:"

.github/workflows/debug-artifacts-safe.yml

@@ -5,13 +5,13 @@ env:
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -29,10 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - stable-v2.20.7
-          - default
-          - linked
-          - nightly-latest
+        - stable-v2.20.7
+        - default
+        - linked
+        - nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -41,12 +41,7 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-
-    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
-    # We could install that older version on the newer runners, or use the older runner.
-    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
-
+    runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -61,7 +56,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: "9.x"
+          dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init

.github/workflows/deflake.yml

@@ -60,6 +60,7 @@ on:
       - "PR Check - Proxy test"
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
+      - "PR Check - RuboCop multi-language"
       - "PR Check - Ruby analysis"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"

.github/workflows/pr-dequeued.yml

@@ -21,23 +21,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REASON: ${{ github.event.reason }}
+          USER: ${{ github.event.pull_request.user.login }}
         run: |
-          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
-          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
-          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
-          enqueuer=$(gh api graphql \
-            -F number="$PR_NUMBER" \
-            -f query='
-              query($number: Int!) {
-                repository(owner: "github", name: "codeql-action") {
-                  pullRequest(number: $number) {
-                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
-                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
-                    }
-                  }
-                }
-              }' \
-            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
-          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
+          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
             "Please resolve any issues if required and enqueue the PR again." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

README.md

@@ -76,6 +76,7 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
+| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 

package-lock.json

@@ -30,12 +30,12 @@
         "follow-redirects": "^1.16.1",
         "get-folder-size": "^5.0.0",
         "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.5.0",
+        "js-yaml": "^5.4.3",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
         "node-forge": "^1.4.0",
         "semver": "^7.8.5",
-        "undici": "^7.30.1",
+        "undici": "^6.28.0",
         "uuid": "^14.0.3"
       },
       "devDependencies": {
@@ -50,21 +50,29 @@
         "@types/node-forge": "^1.3.14",
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.8.0",
-        "@types/sinon": "^22.0.1",
+        "@types/sinon": "^22.0.0",
         "ava": "^6.4.1",
         "esbuild": "^0.28.2",
         "eslint": "^9.39.5",
         "eslint-import-resolver-typescript": "^4.4.5",
         "eslint-plugin-github": "^6.1.2",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.4.0",
+        "eslint-plugin-jsdoc": "^65.3.4",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^13.0.6",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
         "sinon": "^22.1.0",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.72.0"
+        "typescript-eslint": "^8.71.2"
+      }
+    },
+    "node_modules/@aashutoshrathi/word-wrap": {
+      "version": "1.2.6",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
     "node_modules/@actions/artifact": {
@@ -950,89 +958,18 @@
         "tslib": "^2.4.0"
       }
     },
-    "node_modules/@es-joy/escodegen": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/escodegen/-/escodegen-4.2.0.tgz",
-      "integrity": "sha512-jWqqS3StW6vGwJeT8yu6alS4nipOBi3kD/pR63+9hG2NfGafCJ4viDME15mVf+fyupyptcUJDXfv63gFF5Gzfg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@es-joy/estraverse": "^7.1.1",
-        "@es-joy/jsdoccomment": "^0.62.0",
-        "esprima": "^4.0.1",
-        "esutils": "^2.0.3",
-        "optionator": "^0.9.4"
-      },
-      "bin": {
-        "escodegen": "bin/escodegen.js",
-        "esgenerate": "bin/esgenerate.js"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "optionalDependencies": {
-        "source-map": "~0.7.6"
-      }
-    },
-    "node_modules/@es-joy/escodegen/node_modules/@es-joy/jsdoccomment": {
-      "version": "0.62.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.62.0.tgz",
-      "integrity": "sha512-yWi6sm7INEwnfS7IJvE0dU+RTrwzLPFcY7e7eGpu/l5Q9lWfQ2ROwZ0qVnc242jw2TUPsfHX3XMIISkGBv57RQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.8",
-        "@typescript-eslint/types": "^8.44.1",
-        "comment-parser": "1.4.1",
-        "esquery": "^1.6.0",
-        "jsdoc-type-pratt-parser": "~5.9.0"
-      },
-      "engines": {
-        "node": ">=20.11.0"
-      }
-    },
-    "node_modules/@es-joy/escodegen/node_modules/comment-parser": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.1.tgz",
-      "integrity": "sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12.0.0"
-      }
-    },
-    "node_modules/@es-joy/escodegen/node_modules/jsdoc-type-pratt-parser": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-5.9.2.tgz",
-      "integrity": "sha512-TYzkACp/wPvDJLRY7qpHXtrhgwoAaojIOnLaaVNi+AbPU2u1kkjfKd9hXXTq0qSAGsyYXvwUXt99h9I5iCmjjw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/@es-joy/estraverse": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@es-joy/estraverse/-/estraverse-7.1.1.tgz",
-      "integrity": "sha512-h2d737iS0LFAqypZOmXizu54qAbHofI/RpD30Zom03O6BCXKHuFevWKPcGarZbGq82h7qSBb5G6kLdhTMO+caw==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.100.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.100.0.tgz",
-      "integrity": "sha512-QuIT5kMg3XWN22Wa1rcXmR/GkfSg6Ygs/ikMiHihdSpu+o3O59LygkFV9srKa5xHplBFwNd5ZCo3bywL4k7qMQ==",
+      "version": "0.98.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.98.0.tgz",
+      "integrity": "sha512-QS+b7I2aaSM+gZfDz1b9E4B367JJ2qTjFXRKF289iKkh9sYdZ21Q5MiF/Duzouy3J0C4VhM3I/8f2F4+zT8gYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.72.0",
+        "@typescript-eslint/types": "^8.70.0",
         "comment-parser": "1.4.9",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~9.3.0"
+        "jsdoc-type-pratt-parser": "~9.2.2"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
@@ -2744,15 +2681,20 @@
       "license": "MIT"
     },
     "node_modules/@types/sinon": {
-      "version": "22.0.1",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.1.tgz",
-      "integrity": "sha512-MThluJXPmpBY+Z5S3565F2z+hjkCXnBrr36j2mitVQ7JUtxA+A+YQhs+0Q6J8jxb0SVJvydO+6NWfj9EBzpiBQ==",
+      "version": "22.0.0",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.0.tgz",
+      "integrity": "sha512-TDbVpbccc2HfiqHR09Argj3mHV1KMW7sCCKj52fsl8lbRLkEn7fB1966EWhOKWUBcqfBueZuPoA7/OK1CKiy3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@sinonjs/fake-timers": "^15.4.0"
+        "@types/sinonjs__fake-timers": "*"
       }
     },
+    "node_modules/@types/sinonjs__fake-timers": {
+      "version": "8.1.2",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -2760,17 +2702,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.72.0.tgz",
-      "integrity": "sha512-aysKgysPX9XOv/dk95UkvUDe++Q3n3dJPG9CEWT3RUccxfkPJ+Qn6nhKPDhZXU6Ofo9kgwGWwKyQCnZIXTgngg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
+      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/type-utils": "8.72.0",
-        "@typescript-eslint/utils": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/type-utils": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -2783,7 +2725,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.72.0",
+        "@typescript-eslint/parser": "^8.71.2",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -2799,16 +2741,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.72.0.tgz",
-      "integrity": "sha512-0O+x3ynciD6zuXb1CKSu165haQV6ey53DKhHHUnujP7U+XlltJG+/keT0Xhd1HXCze+IHf7Tvt39ovyepX/LNw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
+      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2842,14 +2784,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.72.0.tgz",
-      "integrity": "sha512-bzHngBbmIgzj6TsTjVUCntGx6FFLgE7mPjpO0PzHycOaZHXqS43XnrkFIHRS16LLr/xO6FHSXG3GJFo/F4bSBQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
+      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.72.0",
-        "@typescript-eslint/types": "^8.72.0",
+        "@typescript-eslint/tsconfig-utils": "^8.71.2",
+        "@typescript-eslint/types": "^8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2882,14 +2824,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.72.0.tgz",
-      "integrity": "sha512-JewPyJOYcXBSAS7PIgufscHOwZqhTGyBRiQJhhuDln66tMchxvvt7nJ90JKKIoOelmdHA3kAQbm9cEUHc4JSEA==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
+      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0"
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2900,9 +2842,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.72.0.tgz",
-      "integrity": "sha512-0vbxCf7xLVPSjcOdm6eQbgViH8EDJ8xnl1laLT9yoqSz2YmcSfSg5Vdl0JUvZf6rcuJ0ZivJIuMD4edTg8obaA==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
+      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2917,15 +2859,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.72.0.tgz",
-      "integrity": "sha512-gEXxmmbSTSOVTC37IYYvremOM31v+UN2W772bJxmVYPhAOPSUxtacyb7wkm1EhkYKU6KzFJsdU44DCV4to0LWw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
+      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/utils": "8.72.0",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -2960,9 +2902,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.72.0.tgz",
-      "integrity": "sha512-Adfoy59kxNEjT5E5fnyrp7GpHYuWs8ONbdohu4ez6IU46qDq8LltG90tLmkucZB2uhYL8mqBjtXqGd8yhfjXqQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
+      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2974,16 +2916,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.72.0.tgz",
-      "integrity": "sha512-gwLfFgWcw15tN2KXDCJvxEOQjPn+P3j/n3eSqkZ5sX4VpW9Cosodr+tWwBZRvJT3TcKx6HnPRGZMCNAiP1Xhug==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
+      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.72.0",
-        "@typescript-eslint/tsconfig-utils": "8.72.0",
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0",
+        "@typescript-eslint/project-service": "8.71.2",
+        "@typescript-eslint/tsconfig-utils": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -3059,16 +3001,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.72.0.tgz",
-      "integrity": "sha512-0up3oArJZBYnzOaEXKo8DmI43QvMZyPoFEt9LWzRJcyl/RcJjfKKPebknN1VbTgXBf3M/KggUh5uUMdURLnseg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
+      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0"
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3083,13 +3025,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.72.0.tgz",
-      "integrity": "sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
+      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/types": "8.71.2",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -3634,7 +3576,6 @@
     },
     "node_modules/argparse": {
       "version": "2.0.1",
-      "dev": true,
       "license": "Python-2.0"
     },
     "node_modules/aria-query": {
@@ -5424,16 +5365,15 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.4.0.tgz",
-      "integrity": "sha512-bRiU6LfCFmLL7GuePKvA6ZIcXLonhZGCg2TgQLmkcExeVdAirQp2Hsf3xeSUTmlKwAAsREVEOLbZYD8F7oA69g==",
+      "version": "65.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
+      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/escodegen": "^4.2.0",
-        "@es-joy/jsdoccomment": "~0.100.0",
+        "@es-joy/jsdoccomment": "~0.98.0",
         "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.72.0",
+        "@typescript-eslint/utils": "^8.70.1",
         "are-docs-informative": "^0.1.1",
         "comment-parser": "1.4.9",
         "debug": "^4.4.3",
@@ -7181,9 +7121,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz",
-      "integrity": "sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==",
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
+      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
       "funding": [
         {
           "type": "github",
@@ -7196,28 +7136,12 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "argparse": "^3.0.3"
+        "argparse": "^2.0.1"
       },
       "bin": {
         "js-yaml": "bin/js-yaml.mjs"
       }
     },
-    "node_modules/js-yaml/node_modules/argparse": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.3.tgz",
-      "integrity": "sha512-Sn98ftV3KfsO8xfLPHG6oT8y+b0yvbrLgZjgPDXsharNY15tTAjqIsIju4S32nl6/iEUNNE4v+yL2Zhm8ooP3w==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodeca"
-        }
-      ],
-      "license": "PSF-2.0"
-    },
     "node_modules/jschardet": {
       "version": "3.1.4",
       "resolved": "https://registry.npmjs.org/jschardet/-/jschardet-3.1.4.tgz",
@@ -7229,18 +7153,36 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.3.0.tgz",
-      "integrity": "sha512-JZ8lKMCZXDlM1jAjAK5tTmtFJtgv6iFQQfjE3Fza6jBRACUueaEXLY17n1u05JO1lcPkNxgP+ddEDtiPsk5ktg==",
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.2.tgz",
+      "integrity": "sha512-eFY7Rlscvv/BpY6UsVsjKwMhu1tJO/F4U/vC9g3yeRy/JqszuO1UP6Vdq+85G+3FP6fEw/sWR8a5ftPFY86csw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.9"
+        "@types/estree": "^1.0.9",
+        "@types/node": "^26.4.0"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
       }
     },
+    "node_modules/jsdoc-type-pratt-parser/node_modules/@types/node": {
+      "version": "26.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.9.0"
+      }
+    },
+    "node_modules/jsdoc-type-pratt-parser/node_modules/undici-types": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -8401,18 +8343,16 @@
       }
     },
     "node_modules/optionator": {
-      "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "version": "0.9.3",
       "dev": true,
       "license": "MIT",
       "dependencies": {
+        "@aashutoshrathi/word-wrap": "^1.2.3",
         "deep-is": "^0.1.3",
         "fast-levenshtein": "^2.0.6",
         "levn": "^0.4.1",
         "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0",
-        "word-wrap": "^1.2.5"
+        "type-check": "^0.4.0"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -9336,17 +9276,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.7.6",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
-      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true,
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -10052,16 +9981,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.72.0.tgz",
-      "integrity": "sha512-r26Fkc8As+mZvqp7SLsMmNFyYUup/6CjK7/eHBHmhOw6GH6n6YFxHVFrG0jN1c5CMpDzelLPxvgeCOzx7BjN+A==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
+      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.72.0",
-        "@typescript-eslint/parser": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/utils": "8.72.0"
+        "@typescript-eslint/eslint-plugin": "8.71.2",
+        "@typescript-eslint/parser": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10095,12 +10024,12 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.30.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
-      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "license": "MIT",
       "engines": {
-        "node": ">=20.18.1"
+        "node": ">=18.17"
       }
     },
     "node_modules/undici-types": {
@@ -10380,16 +10309,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/word-wrap": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
@@ -10569,7 +10488,6 @@
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-        "glob": "^13.0.6",
         "lite-matter": "^0.1.2",
         "mdast-util-from-markdown": "^2.1.0",
         "semver": "^7.8.5",

package.json

@@ -38,12 +38,12 @@
     "follow-redirects": "^1.16.1",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.5.0",
+    "js-yaml": "^5.4.3",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
     "node-forge": "^1.4.0",
     "semver": "^7.8.5",
-    "undici": "^7.30.1",
+    "undici": "^6.28.0",
     "uuid": "^14.0.3"
   },
   "devDependencies": {
@@ -58,21 +58,21 @@
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.8.0",
-    "@types/sinon": "^22.0.1",
+    "@types/sinon": "^22.0.0",
     "ava": "^6.4.1",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.4.0",
+    "eslint-plugin-jsdoc": "^65.3.4",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.72.0"
+    "typescript-eslint": "^8.71.2"
   },
   "overrides": {
     "@actions/tool-cache": {
@@ -94,6 +94,6 @@
       "semver": ">=6.3.1"
     },
     "glob": "^13.0.6",
-    "undici": "^7.30.1"
+    "undici": "^6.28.0"
   }
 }

pr-checks/check-diagnostics.ts

@@ -1,8 +1,6 @@
 import fs from "fs";
-import path from "path";
 
 import * as core from "@actions/core";
-import { globSync } from "glob";
 
 import * as sarif from "../src/sarif";
 
@@ -36,83 +34,59 @@ function checkStatusPageNotification(n: sarif.Notification) {
   }
 }
 
-function checkSarif(sarifFile: string) {
-  core.info(`Checking SARIF file at '${sarifFile}'`);
-
-  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
-  const run = log.runs[0];
-
-  if (run.invocations === undefined) {
-    throw new Error("run.invocations is undefined");
-  }
-
-  const toolExecutionNotifications =
-    run.invocations[0].toolExecutionNotifications;
-
-  if (toolExecutionNotifications === undefined) {
-    throw new Error("toolExecutionNotifications is undefined");
-  }
-
-  const statusPageNotifications = toolExecutionNotifications.filter(
-    (n) =>
-      n.descriptor?.id === DIAGNOSTIC_ID &&
-      n.properties?.visibility?.statusPage,
-  );
-  if (statusPageNotifications.length !== 1) {
-    core.setFailed(
-      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-        `${JSON.stringify(toolExecutionNotifications)}.`,
-    );
-  }
-  checkStatusPageNotification(statusPageNotifications[0]);
-
-  const notifications = run.tool.driver.notifications;
-
-  if (notifications === undefined) {
-    throw new Error("notifications is undefined");
-  }
-
-  const diagnosticNotification = notifications.filter(
-    (n) =>
-      n.id === DIAGNOSTIC_ID &&
-      n.name === DIAGNOSTIC_ID &&
-      n.fullDescription?.text === DIAGNOSTIC_NAME,
-  );
-  if (diagnosticNotification.length !== 1) {
-    core.setFailed(
-      "Expected exactly one notification for this diagnostic in the " +
-        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-        `${diagnosticNotification.length}. All notifications: ` +
-        `${JSON.stringify(notifications)}.`,
-    );
-  }
-}
-
 const sarifPath = process.env["SARIF_PATH"];
 
 if (sarifPath === undefined) {
-  throw new Error(
-    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
+  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
+}
+
+const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
+const run = log.runs[0];
+
+if (run.invocations === undefined) {
+  throw new Error("run.invocations is undefined");
+}
+
+const toolExecutionNotifications =
+  run.invocations[0].toolExecutionNotifications;
+
+if (toolExecutionNotifications === undefined) {
+  throw new Error("toolExecutionNotifications is undefined");
+}
+
+const statusPageNotifications = toolExecutionNotifications.filter(
+  (n) =>
+    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
+);
+if (statusPageNotifications.length !== 1) {
+  core.setFailed(
+    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+      `${JSON.stringify(toolExecutionNotifications)}.`,
+  );
+}
+checkStatusPageNotification(statusPageNotifications[0]);
+
+const notifications = run.tool.driver.notifications;
+
+if (notifications === undefined) {
+  throw new Error("notifications is undefined");
+}
+
+const diagnosticNotification = notifications.filter(
+  (n) =>
+    n.id === DIAGNOSTIC_ID &&
+    n.name === DIAGNOSTIC_ID &&
+    n.fullDescription?.text === DIAGNOSTIC_NAME,
+);
+if (diagnosticNotification.length !== 1) {
+  core.setFailed(
+    "Expected exactly one notification for this diagnostic in the " +
+      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+      `${diagnosticNotification.length}. All notifications: ` +
+      `${JSON.stringify(notifications)}.`,
   );
 }
 
-if (fs.statSync(sarifPath).isDirectory()) {
-  const sarifFiles = globSync("**/*.sarif", {
-    cwd: path.resolve(sarifPath),
-    absolute: true,
-  });
-
-  if (sarifFiles.length < 1) {
-    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
-  }
-
-  for (const sarifFile of sarifFiles) {
-    checkSarif(sarifFile);
-  }
-} else {
-  checkSarif(sarifPath);
-}
-
 core.info("Finished diagnostic export test");

pr-checks/checks/diagnostics-without-db.yml

@@ -53,7 +53,7 @@ validationJobs:
     installNode: true
     steps:
       - name: Download workflow artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: test-mode-sarif-*
           path: sarif

pr-checks/checks/rubocop-multi-language.yml

@@ -0,0 +1,23 @@
+name: "RuboCop multi-language"
+description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
+# This check doesn't use CodeQL, so the `version` matrix variable is unused.
+versions:
+  - default
+steps:
+  - name: Set up Ruby
+    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+    with:
+      ruby-version: 2.6
+  - name: Install Code Scanning integration
+    run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+  - name: Install dependencies
+    run: bundle install
+  - name: RuboCop run
+    run: |
+      bash -c "
+        bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+        [[ $? -ne 2 ]]
+      "
+  - uses: ./../action/upload-sarif
+    with:
+      sarif_file: rubocop.sarif

pr-checks/package.json

@@ -9,7 +9,6 @@
     "@octokit/core": "^7.0.8",
     "@octokit/plugin-paginate-rest": ">=16.0.0",
     "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-    "glob": "^13.0.6",
     "lite-matter": "^0.1.2",
     "mdast-util-from-markdown": "^2.1.0",
     "semver": "^7.8.5",

pr-checks/sync.ts

@@ -137,15 +137,7 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 
-/** A type representing version identifiers. */
-type Version =
-  | "default"
-  | "linked"
-  | "nightly-latest"
-  // This is an approximation, but sufficient validation for our needs here.
-  | `stable-v${number}.${number}.${number}`;
-
-/** The default set of CodeQL Bundle versions to use for the PR checks. */
+// The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
   // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
   "stable-v2.20.7",
@@ -167,10 +159,7 @@ const defaultTestVersions = [
   "linked",
   // A nightly build directly from the our private repo, built in the last 24 hours.
   "nightly-latest",
-] as const satisfies Version[];
-
-/** A type representing the default test versions. */
-type DefaultTestVersion = (typeof defaultTestVersions)[number];
+];
 
 /** The default versions we use for languages / frameworks, if not specified as a workflow input. */
 const defaultLanguageVersions = {
@@ -324,11 +313,9 @@ const languageSetups: LanguageSetups = {
   },
 };
 
-/**
- * This is essentially an arbitrary version of `yq`, which happened to be the one that
- * `choco` fetched when we moved away from using that here.
- * See https://github.com/github/codeql-action/pull/3423
- */
+// This is essentially an arbitrary version of `yq`, which happened to be the one that
+// `choco` fetched when we moved away from using that here.
+// See https://github.com/github/codeql-action/pull/3423
 const YQ_VERSION = "v4.50.1";
 
 const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
@@ -455,23 +442,10 @@ function generateJobMatrix(
           : [operatingSystemConfig["runner-image"]];
 
       for (const runnerImage of runnerImagesForOs) {
-        // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
-        // We could install that older version on the newer runners, or use the older runner.
-        // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-        // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
-        // is removed from `defaultTestVersions`.
-        const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
-        if (
-          runnerImage === "ubuntu-latest" &&
-          version === requiresOlderRunnerImage
-        ) {
-          matrix.push({ os: "ubuntu-24.04", version });
-        } else {
-          matrix.push({
-            os: runnerImage,
-            version,
-          });
-        }
+        matrix.push({
+          os: runnerImage,
+          version,
+        });
       }
     }
   }
@@ -569,8 +543,12 @@ function generateJob(
     ? checkSpecification.useAllPlatformBundle
     : "false";
 
-  // Determine which languages or frameworks have to be installed.
-  const setupInfo = getSetupSteps(checkSpecification);
+  // Kotlin requires a compatible JDK rather than the runner image's default.
+  const setupInfo = getSetupSteps({
+    ...checkSpecification,
+    installJava:
+      checkSpecification.installJava ?? !("container" in checkSpecification),
+  });
   const workflowInputs = setupInfo.inputs;
 
   // Construct the workflow steps needed for this check.

src/actions-util.ts

@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
  * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
  * value of `RUNNER_TEMP` otherwise.
  */
-export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
+export function getTemporaryDirectory(env: Env = getEnv()): string {
   return (
     env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
   );
@@ -361,10 +361,9 @@ const MAX_STDERR_BUFFER_SIZE = 20000;
  * Runs a CLI tool.
  *
  * @returns Standard output produced by the tool.
- * @throws A {@link CommandInvocationError} if the tool exits with a non-zero status code.
+ * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
  */
 export async function runTool(
-  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
@@ -375,7 +374,6 @@ export async function runTool(
     process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
   }
   const exitCode = await new toolrunner.ToolRunner(cmd, args, {
-    env: env.getDefined(),
     ignoreReturnCode: true,
     listeners: {
       stdout: (data: Buffer) => {

src/api-compatibility.json

@@ -1 +1 @@
-{"maximumVersion":"3.23","minimumVersion":"3.19"}
+{"maximumVersion":"3.23","minimumVersion":"3.18"}

src/cli/output-cache.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";
 
 import { getTemporaryDirectory } from "../actions-util";
-import { ReadOnlyEnv } from "../environment";
+import { Env } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";
 
@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
  * Returns the path to the temporary file that backs the
  * on-disk cache of CLI responses between workflow steps.
  */
-export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
+export function getCommandCacheFilePath(env: Env): string {
   return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }
 

src/codeql.ts

@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, Env, ReadOnlyEnv } from "./environment";
+import { EnvVar, getEnv, exportEnvVar } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -260,17 +260,17 @@ const CODEQL_MINIMUM_VERSION = "2.20.7";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.22.4";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
@@ -499,14 +499,13 @@ export async function getCodeQLForCmd(
   logger: Logger,
   cmd: string,
   checkVersion: boolean,
-  env: Env = getEnv(),
 ): Promise<CodeQL> {
   const codeql: CodeQL = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
+      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
       let result = outputCache.getCachedCodeQlVersion(
         logger,
         cacheFilePath,
@@ -514,7 +513,6 @@ export async function getCodeQLForCmd(
       );
       if (result === undefined) {
         result = await runCliJson<VersionInfo>(
-          env,
           cmd,
           ["version", "--format=json"],
           {
@@ -598,7 +596,6 @@ export async function getCodeQLForCmd(
         : ["--no-calculate-baseline"];
 
       await runCli(
-        env,
         cmd,
         [
           "database",
@@ -634,7 +631,7 @@ export async function getCodeQLForCmd(
       }
     },
     async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix(env);
+      applyAutobuildAzurePipelinesTimeoutFix();
 
       const autobuildCmd = path.join(
         await this.resolveExtractor(language),
@@ -644,11 +641,8 @@ export async function getCodeQLForCmd(
 
       // Bump the verbosity of the autobuild command if we're in debug mode
       if (config.debugMode) {
-        env.set(
-          EnvVar.CLI_VERBOSITY,
-          env.getOptional(EnvVar.CLI_VERBOSITY) ??
-            EXTRACTION_DEBUG_MODE_VERBOSITY,
-        );
+        process.env[EnvVar.CLI_VERBOSITY] =
+          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
       }
 
       // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -665,10 +659,10 @@ export async function getCodeQLForCmd(
       // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
       // the Actions runtime introduces its own workaround for SIP
       // (https://github.com/actions/runner/pull/416).
-      await runCli(env, autobuildCmd);
+      await runCli(autobuildCmd);
     },
     async extractScannedLanguage(config: Config, language: Language) {
-      await runCli(env, cmd, [
+      await runCli(cmd, [
         "database",
         "trace-command",
         "--index-traceless-dbs",
@@ -680,10 +674,10 @@ export async function getCodeQLForCmd(
     },
     async extractUsingBuildMode(config: Config, language: Language) {
       if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix(env);
+        applyAutobuildAzurePipelinesTimeoutFix();
       }
       try {
-        await runCli(env, cmd, [
+        await runCli(cmd, [
           "database",
           "trace-command",
           "--use-build-mode",
@@ -722,7 +716,7 @@ export async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["database", "finalize"]),
         databasePath,
       ];
-      await runCli(env, cmd, args);
+      await runCli(cmd, args);
     },
     async resolveLanguages(
       {
@@ -731,7 +725,7 @@ export async function getCodeQLForCmd(
         filterToLanguagesWithQueries: boolean;
       } = { filterToLanguagesWithQueries: false },
     ) {
-      return runCliJson<ResolveLanguagesOutput>(env, cmd, [
+      return runCliJson<ResolveLanguagesOutput>(cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
@@ -760,11 +754,7 @@ export async function getCodeQLForCmd(
       if (workingDir !== undefined) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      return await runCliJson<ResolveBuildEnvironmentOutput>(
-        env,
-        cmd,
-        codeqlArgs,
-      );
+      return await runCliJson<ResolveBuildEnvironmentOutput>(cmd, codeqlArgs);
     },
     async databaseRunQueries(
       databasePath: string,
@@ -783,7 +773,7 @@ export async function getCodeQLForCmd(
           ignoringOptions: ["--expect-discarded-cache"],
         }),
       ];
-      await runCli(env, cmd, codeqlArgs);
+      await runCli(cmd, codeqlArgs);
     },
     async databaseInterpretResults(
       databasePath: string,
@@ -816,7 +806,7 @@ export async function getCodeQLForCmd(
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions(env)),
+        ...(await getJobRunUuidSarifOptions()),
         ...getExtraOptionsFromEnv(["database", "interpret-results"]),
       ];
       if (sarifRunPropertyFlag !== undefined) {
@@ -836,7 +826,7 @@ export async function getCodeQLForCmd(
       }
       // Capture the stdout, which contains the analysis summary. Don't stream it to the Actions
       // logs to avoid printing it twice.
-      return await runCli(env, cmd, codeqlArgs, {
+      return await runCli(cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -853,7 +843,7 @@ export async function getCodeQLForCmd(
           `--cache-cleanup=${cleanupLevel}`,
           ...getExtraOptionsFromEnv(["database", "cleanup"]),
         ];
-        await runCli(env, cmd, codeqlArgs);
+        await runCli(cmd, codeqlArgs);
       }
     },
     async databaseBundle(
@@ -887,9 +877,7 @@ export async function getCodeQLForCmd(
           ]),
         );
       }
-      await new toolrunner.ToolRunner(cmd, args, {
-        env: env.getDefined(),
-      }).exec();
+      await new toolrunner.ToolRunner(cmd, args).exec();
     },
     async databaseExportDiagnostics(
       databasePath: string,
@@ -910,9 +898,7 @@ export async function getCodeQLForCmd(
       if (automationDetailsId !== undefined) {
         args.push("--sarif-category", automationDetailsId);
       }
-      await new toolrunner.ToolRunner(cmd, args, {
-        env: env.getDefined(),
-      }).exec();
+      await new toolrunner.ToolRunner(cmd, args).exec();
     },
     async diagnosticsExport(
       sarifFile: string,
@@ -960,9 +946,7 @@ export async function getCodeQLForCmd(
       if (automationDetailsId !== undefined) {
         args.push("--sarif-category", automationDetailsId);
       }
-      await new toolrunner.ToolRunner(cmd, args, {
-        env: env.getDefined(),
-      }).exec();
+      await new toolrunner.ToolRunner(cmd, args).exec();
     },
     async resolveExtractor(language: Language): Promise<string> {
       // Request it using `format=json` so we don't need to strip the trailing new line generated by
@@ -980,7 +964,6 @@ export async function getCodeQLForCmd(
           ...getExtraOptionsFromEnv(["resolve", "extractor"]),
         ],
         {
-          env: env.getDefined(),
           silent: true,
           listeners: {
             stdout: (data) => {
@@ -1008,7 +991,7 @@ export async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries,
       ];
-      return await runCliJson<string[]>(env, cmd, codeqlArgs, {
+      return await runCliJson<string[]>(cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -1022,7 +1005,7 @@ export async function getCodeQLForCmd(
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"]),
       ];
-      return await runCliJson<ResolveDatabaseOutput>(env, cmd, codeqlArgs, {
+      return await runCliJson<ResolveDatabaseOutput>(cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -1049,7 +1032,7 @@ export async function getCodeQLForCmd(
         args.push("--sarif-merge-runs-from-equal-category");
       }
 
-      await runCli(env, cmd, args);
+      await runCli(cmd, args);
     },
   };
   // To ensure that status reports include the CodeQL CLI version wherever
@@ -1071,7 +1054,7 @@ export async function getCodeQLForCmd(
     );
   } else if (
     checkVersion &&
-    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
+    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
     !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
   ) {
     const result = await codeql.getVersion();
@@ -1089,7 +1072,7 @@ export async function getCodeQLForCmd(
         }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
         "continue using this version of the CodeQL Action.",
     );
-    env.export(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
   }
   return codeql;
 }
@@ -1166,13 +1149,12 @@ export function getExtraOptions(
 }
 
 async function runCli(
-  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<string> {
   try {
-    return await runTool(env, cmd, args, opts);
+    return await runTool(cmd, args, opts);
   } catch (e) {
     if (e instanceof CommandInvocationError) {
       throw wrapCliConfigurationError(new CliError(e));
@@ -1183,8 +1165,6 @@ async function runCli(
 
 /**
  * Wraps the command executor {@link runCli} and tries to parse the output as JSON.
- *
- * @param env The environment variables.
  * @param cmd The command to run.
  * @param args The arguments to pass to the command.
  * @param opts The options for running the command.
@@ -1193,12 +1173,11 @@ async function runCli(
  * @returns The parsed JSON output from the command.
  */
 async function runCliJson<T>(
-  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<T> {
-  const output = await runCli(env, cmd, args, opts);
+  const output = await runCli(cmd, args, opts);
   try {
     return JSON.parse(output) as T;
   } catch (e) {
@@ -1297,20 +1276,17 @@ function getExtractionVerbosityArguments(
  * Without the fix, long build processes will timeout when pulling down Java packages
  * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
  */
-function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
-  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
-  env.set(
-    "JAVA_TOOL_OPTIONS",
-    [
-      ...javaToolOptions.split(/\s+/),
-      "-Dhttp.keepAlive=false",
-      "-Dmaven.wagon.http.pool=false",
-    ].join(" "),
-  );
+function applyAutobuildAzurePipelinesTimeoutFix() {
+  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
+  process.env["JAVA_TOOL_OPTIONS"] = [
+    ...javaToolOptions.split(/\s+/),
+    "-Dhttp.keepAlive=false",
+    "-Dmaven.wagon.http.pool=false",
+  ].join(" ");
 }
 
-async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
-  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);
+async function getJobRunUuidSarifOptions() {
+  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
 
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }

src/diagnostics.ts

@@ -3,7 +3,7 @@ import path from "path";
 
 import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
-import type { ActionConfig } from "./config/action-config";
+import type { Config } from "./config-utils";
 import { Language } from "./languages";
 import { getActionsLogger, type Logger } from "./logging";
 import {
@@ -177,10 +177,7 @@ export function getTempLanguageDiagnosticsPath(
 }
 
 /** Gets the path where diagnostics for {@link language} should be stored in the database. */
-export function getDatabaseDiagnosticsPath(
-  config: ActionConfig<"dbLocation">,
-  language: Language,
-) {
+export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
   return getLanguageDiagnosticsPath(config.dbLocation, language);
 }
 
@@ -193,7 +190,7 @@ export function getDatabaseDiagnosticsPath(
  * @param diagnostic The diagnostic message to add to the database.
  */
 export function addDiagnostic(
-  config: ActionConfig<"dbLocation" | "tempDir">,
+  config: Config,
   language: Language,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
@@ -218,7 +215,7 @@ export function addDiagnostic(
 
 /** Adds a diagnostic that is not specific to any language. */
 export function addNoLanguageDiagnostic(
-  config: ActionConfig<"dbLocation" | "languages" | "tempDir"> | undefined,
+  config: Config | undefined,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
 ) {
@@ -308,7 +305,7 @@ function writeDiagnosticFile(
  */
 function writeDiagnostic(
   action: ActionState<["Logger"]>,
-  config: ActionConfig<"dbLocation">,
+  config: Config,
   language: Language,
   diagnostic: DiagnosticMessage,
 ) {
@@ -351,7 +348,7 @@ export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
 /** Relocates all temporary diagnostics to the respective databases. */
 export function flushDiagnostics(
   action: ActionState<["Logger"]>,
-  config: ActionConfig<"dbLocation" | "languages">,
+  config: Config,
 ) {
   const diagnosticsCount = temporaryDiagnostics.length;
   action.logger.debug(

src/environment.ts

@@ -293,8 +293,8 @@ export function getOptionalEnvVar(paramName: string): string | undefined {
  * in tests, while clearly signalling in regular code that the consumer of the `ReadOnlyEnv` instance
  * will only read from it.
  */
-export class ReadOnlyEnv {
-  constructor(protected readonly vars: Record<string, string | undefined>) {}
+export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
+  constructor(protected readonly vars: Record<string, T>) {}
 
   /** Clones the object while detaching the underlying environment from the original. */
   public clone(): this {
@@ -302,24 +302,10 @@ export class ReadOnlyEnv {
   }
 
   /** Gets a copy of the underlying environment. */
-  public get(): Record<string, string | undefined> {
+  public get(): Record<string, T> {
     return { ...this.vars };
   }
 
-  /** Gets a copy of the underlying environment, where the values are not `undefined`. */
-  public getDefined(): Record<string, string> {
-    const result: Record<string, string> = {};
-
-    for (const [key, val] of Object.entries(this.vars)) {
-      if (val === undefined) {
-        continue;
-      }
-      result[key] = val;
-    }
-
-    return result;
-  }
-
   /** Tries to get the value for `name` and throws if there isn't one. */
   public getRequired(name: string): string {
     return getRequiredEnvVar(this.vars, name);
@@ -331,7 +317,7 @@ export class ReadOnlyEnv {
   }
 
   /** Gets the entries of the underlying `ProcessEnv`. */
-  public entries(): Array<[string, string | undefined]> {
+  public entries(): Array<[string, T]> {
     return Object.entries(this.vars);
   }
 
@@ -361,17 +347,19 @@ export class ReadOnlyEnv {
  * Use `ReadOnlyEnv` instead if you only plan to read from the environment.
  * This type allows writing to the environment.
  */
-export class Env extends ReadOnlyEnv {
+export class Env<
+  T extends string | undefined = string | undefined,
+> extends ReadOnlyEnv<T> {
   private changed: boolean = false;
 
   /** Sets an environment variable. */
-  public set(name: string, value: string | undefined): void {
+  public set(name: string, value: T): void {
     this.vars[name] = value;
     this.changed = true;
   }
 
   /** Sets all environment variables given by `vars`. */
-  public setAll(vars: Record<string, string | undefined>): void {
+  public setAll(vars: Record<string, T>): void {
     for (const [key, val] of Object.entries(vars)) {
       this.set(key, val);
     }
@@ -385,7 +373,7 @@ export class Env extends ReadOnlyEnv {
    * @param name The name of the environment variable to set and export.
    * @param val The value to set and export for the environment variable.
    */
-  public export(name: string, val: string): void {
+  public export(name: string, val: T): void {
     // Setting the environment variable for this instance is always OK, including
     // in tests, since we use fresh `Env` instances whenever needed. This allows
     // tests to pass that rely on that part of the `core.exportVariable` behaviour.

src/init-action.ts

@@ -62,7 +62,6 @@ import {
   runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
-import { checkSwiftCompatibility } from "./languages/swift";
 import { Logger, withGroupAsync } from "./logging";
 import {
   downloadOverlayBaseDatabaseFromCache,
@@ -419,7 +418,14 @@ async function run(
       logger,
     });
 
-    checkSwiftCompatibility(actionState, config);
+    if (
+      config.languages.includes(BuiltInLanguage.swift) &&
+      process.platform !== "darwin"
+    ) {
+      throw new ConfigurationError(
+        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+      );
+    }
 
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(

src/languages/swift.test.ts

@@ -1,70 +0,0 @@
-import test from "ava";
-import sinon from "sinon";
-
-import { ActionsEnvVars } from "../environment";
-import {
-  createTestConfig,
-  getCodeQLForTesting,
-  getTestEnv,
-  initAllState,
-  makeVersionInfo,
-  RecordingLogger,
-} from "../testing-utils";
-import { ConfigurationError, withTmpDir } from "../util";
-
-import { checkSwiftCompatibility } from "./swift";
-
-import { BuiltInLanguage } from ".";
-
-test("checkSwiftCompatibility doesn't throw for non-Swift languages", (t) => {
-  for (const language of Object.values(BuiltInLanguage)) {
-    if (language === BuiltInLanguage.swift) {
-      continue;
-    }
-
-    t.notThrows(() =>
-      checkSwiftCompatibility(
-        initAllState(),
-        createTestConfig({ languages: [language] }),
-      ),
-    );
-  }
-});
-
-test("checkSwiftCompatibility doesn't throw for Swift on darwin", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    const env = getTestEnv();
-    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
-    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-    t.notThrows(() =>
-      checkSwiftCompatibility(
-        initAllState({ platform: "darwin", env, logger }),
-        createTestConfig({
-          tempDir: tmpDir,
-          languages: [BuiltInLanguage.swift],
-        }),
-      ),
-    );
-  }));
-
-const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
-for (const nonDarwinPlatform of nonDarwinPlatforms) {
-  test(`checkSwiftCompatibility throws for Swift on ${nonDarwinPlatform}`, (t) => {
-    t.throws(
-      () => {
-        checkSwiftCompatibility(
-          initAllState({ platform: nonDarwinPlatform }),
-          createTestConfig({ languages: [BuiltInLanguage.swift] }),
-        );
-      },
-      {
-        instanceOf: ConfigurationError,
-        message: /^Swift analysis is only supported on macOS runner images/,
-      },
-    );
-  });
-}

src/languages/swift.ts

@@ -1,27 +0,0 @@
-import { ActionState } from "../action-common";
-import { Config } from "../config-utils";
-import { ConfigurationError } from "../util";
-
-import { BuiltInLanguage } from ".";
-
-/**
- * Determines whether we can run a Swift analysis on the current runner.
- *
- * @param action The Action state.
- * @param config The Action configuration.
- *
- * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
- */
-export function checkSwiftCompatibility(
-  action: ActionState<["Base"]>,
-  config: Config,
-) {
-  if (
-    config.languages.includes(BuiltInLanguage.swift) &&
-    action.platform !== "darwin"
-  ) {
-    throw new ConfigurationError(
-      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-    );
-  }
-}

src/testing-utils.ts

@@ -1052,7 +1052,6 @@ export function makeTestToken(length: number = 36) {
 export async function getCodeQLForTesting(
   cmd = "codeql-for-testing",
   logger: Logger = new RecordingLogger(),
-  env: Env = getEnv(),
 ): Promise<codeql.CodeQL> {
-  return codeql.getCodeQLForCmd(logger, cmd, false, env);
+  return codeql.getCodeQLForCmd(logger, cmd, false);
 }

unreleased-change-notes/ghes-3-18-deprecation.md

@@ -1 +0,0 @@
-- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)