Automation: update setup-beam version output to fe5485f

* Bump @eslint/js from 9.31.0 to 9.38.0

Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.31.0 to 9.38.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.38.0/packages/js)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 9.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Help Dependabot out (?)

* Address vulnerabilities with markdownlint-cli

* Do the bump proposed by the PR

* Go back to a working, albeit apparently vulnerable, version

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Paulo F. Oliveira <paulo.ferraz.oliveira@gmail.com>

.github/workflows/action.yml

@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Version it!
         run: |
           # We expect a string such as const setupBeamVersion = 'undefined' in the code
@@ -45,8 +45,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm run build-dist
@@ -58,15 +58,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: raven-actions/actionlint@v2.0.1
+      - uses: actions/checkout@v6.0.2
+      - uses: raven-actions/actionlint@v2.1.0
 
   unit_tests_ubuntu:
     name: Unit tests (Ubuntu)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm ci
@@ -84,8 +84,8 @@ jobs:
     name: Unit tests (Windows)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm install --production
@@ -103,8 +103,8 @@ jobs:
     name: Unit tests (macOS)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm ci

.github/workflows/hexpm-mirrors.yml

@@ -26,7 +26,7 @@ jobs:
         install-rebar: [true, false]
         install-hex: [true, false]
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/macos.yml

@@ -65,7 +65,7 @@ jobs:
             rebar3-version: 'latest'
             os: 'macos-latest'
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -118,7 +118,7 @@ jobs:
             rebar3-version: 3.24
             os: macos-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/ubuntu.yml

@@ -86,7 +86,7 @@ jobs:
             escript_script: 'protoc-gen-elixir --version'
             os: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -154,7 +154,7 @@ jobs:
             rebar3-version: 3.24
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/update_3rd_party_licenses.yml

@@ -14,7 +14,7 @@ jobs:
     name: Update 3rd party licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - run:
           ./.github/workflows/update_3rd_party_licenses.sh
         env:

.github/workflows/windows.yml

@@ -70,7 +70,7 @@ jobs:
             escript_script: 'protoc-gen-elixir --version'
             os: 'windows-latest'
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -137,7 +137,7 @@ jobs:
             rebar3-version: 3.24
             os: windows-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

README.md

@@ -84,6 +84,7 @@ and Erlang/OTP.
 | `ubuntu-24.04`   | 24.3 - 28    | x86_64, arm64    | ✅
 | `windows-2019`   | 21\* - 25    | x86_64, x86      | ✅
 | `windows-2022`   | 21\* - 28    | x86_64, x86      | ✅
+| `windows-2025`   | 21\* - 28    | x86_64, x86      | ✅
 | `macOS-13`       | 25.0 - 28    | x86_64, arm64    | ✅
 | `macOS-14`       | 25.0 - 28    | x86_64, arm64    | ✅
 | `macOS-15`       | 25.0 - 28    | x86_64, arm64    | ✅
@@ -102,6 +103,7 @@ uses that to download assets:
 | `ubuntu24`         | `ubuntu-24.04`
 | `win19`            | `windows-2019`
 | `win22`            | `windows-2022`
+| `win25`            | `windows-2025`
 | `macos13`          | `macOS-13`
 | `macos14`          | `macOS-14`
 | `macos15`          | `macOS-15`
@@ -297,7 +299,7 @@ on: push
 
 jobs:
   test:
-    runs-on: windows-2022
+    runs-on: windows-2025
     steps:
       - uses: actions/checkout@v4
       - uses: erlef/setup-beam@v1

dist/index.js

@@ -5700,7 +5700,7 @@ function coerce (version, options) {
   var undefined;
 
   /** Used as the semantic version number. */
-  var VERSION = '4.17.21';
+  var VERSION = '4.17.23';
 
   /** Used as the size to enable large array optimizations. */
   var LARGE_ARRAY_SIZE = 200;
@@ -9454,7 +9454,7 @@ function coerce (version, options) {
           if (isArray(iteratee)) {
             return function(value) {
               return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee);
-            }
+            };
           }
           return iteratee;
         });
@@ -10058,8 +10058,47 @@ function coerce (version, options) {
      */
     function baseUnset(object, path) {
       path = castPath(path, object);
-      object = parent(object, path);
-      return object == null || delete object[toKey(last(path))];
+
+      // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+      var index = -1,
+          length = path.length;
+
+      if (!length) {
+        return true;
+      }
+
+      var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function');
+
+      while (++index < length) {
+        var key = path[index];
+
+        // skip non-string keys (e.g., Symbols, numbers)
+        if (typeof key !== 'string') {
+          continue;
+        }
+
+        // Always block "__proto__" anywhere in the path if it's not expected
+        if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
+          return false;
+        }
+
+        // Block "constructor.prototype" chains
+        if (key === 'constructor' &&
+            (index + 1) < length &&
+            typeof path[index + 1] === 'string' &&
+            path[index + 1] === 'prototype') {
+
+          // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a')
+          if (isRootPrimitive && index === 0) {
+            continue;
+          }
+
+          return false;
+        }
+      }
+
+      var obj = parent(object, path);
+      return obj == null || delete obj[toKey(last(path))];
     }
 
     /**
@@ -25933,7 +25972,7 @@ async function main() {
   await maybeInstallRebar3(rebar3Spec)
 
   // undefined is replaced by a function, post- main branch merge
-  const setupBeamVersion = 'fceaea9'
+  const setupBeamVersion = 'fe5485f'
   core.setOutput('setup-beam-version', setupBeamVersion)
 }
 
@@ -26066,11 +26105,21 @@ async function getOTPVersion(otpSpec0, osVersion) {
 }
 
 function requestedVersionFor(tool, version, originListing, mirrors) {
-  return (
-    `Requested ${tool} version (${version}) not found in version list, ` +
-    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}; ` +
-    "should you be using option 'version-type': 'strict'?"
-  )
+  const isStrictVersion = isStrictVersion()
+
+  let versionType = 'loose'
+  if (isStrictVersion) {
+    versionType = 'strict'
+  }
+
+  let ret =
+    `Requested ${versionType} ${tool} version (${version}) not found in version list, ` +
+    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}.`
+  if (!isStrictVersion) {
+    ret = `${ret} Should you be using option 'version-type': 'strict'?`
+  }
+
+  return ret
 }
 
 const knownBranches = ['main', 'master', 'maint']
@@ -26523,6 +26572,7 @@ function getRunnerOSVersion() {
     ubuntu24: 'ubuntu-24.04',
     win19: 'windows-2019',
     win22: 'windows-2022',
+    win25: 'windows-2025',
     macos13: 'macOS-13',
     macos14: 'macOS-14',
     macos15: 'macOS-15',
@@ -27526,7 +27576,7 @@ const normalize_options = function (opts) {
     );
   }
   // Normalize option `columns`
-  options.cast_first_line_to_header = null;
+  options.cast_first_line_to_header = undefined;
   if (options.columns === true) {
     // Fields in the first line are converted as-is to columns
     options.cast_first_line_to_header = undefined;
@@ -28058,7 +28108,7 @@ const normalize_options = function (opts) {
   // Normalize option `to`
   if (options.to === undefined || options.to === null) {
     options.to = -1;
-  } else {
+  } else if (options.to !== -1) {
     if (typeof options.to === "string" && /\d+/.test(options.to)) {
       options.to = parseInt(options.to);
     }
@@ -28077,7 +28127,7 @@ const normalize_options = function (opts) {
   // Normalize option `to_line`
   if (options.to_line === undefined || options.to_line === null) {
     options.to_line = -1;
-  } else {
+  } else if (options.to_line !== -1) {
     if (typeof options.to_line === "string" && /\d+/.test(options.to_line)) {
       options.to_line = parseInt(options.to_line);
     }
@@ -28208,10 +28258,14 @@ const transform = function (original_options = {}) {
               this.state.bufBytesStart += bomLength;
               buf = buf.slice(bomLength);
               // Renormalize original options with the new encoding
-              this.options = normalize_options({
+              const options = normalize_options({
                 ...this.original_options,
                 encoding: encoding,
               });
+              // Properties are merged with the existing options instance
+              for (const key in options) {
+                this.options[key] = options[key];
+              }
               // Options will re-evaluate the Buffer with the new encoding
               ({ comment, escape, quote } = this.options);
               break;
@@ -28954,10 +29008,14 @@ const transform = function (original_options = {}) {
       if (skip_records_with_error) {
         this.state.recordHasError = true;
         if (this.options.on_skip !== undefined) {
-          this.options.on_skip(
-            err,
-            raw ? this.state.rawBuffer.toString(encoding) : undefined,
-          );
+          try {
+            this.options.on_skip(
+              err,
+              raw ? this.state.rawBuffer.toString(encoding) : undefined,
+            );
+          } catch (err) {
+            return err;
+          }
         }
         // this.emit('skip', err, raw ? this.state.rawBuffer.toString(encoding) : undefined);
         return undefined;
@@ -29011,10 +29069,13 @@ const parse = function (data, opts = {}) {
     }
   };
   const close = () => {};
-  const err1 = parser.parse(data, false, push, close);
-  if (err1 !== undefined) throw err1;
-  const err2 = parser.parse(undefined, true, push, close);
-  if (err2 !== undefined) throw err2;
+  const error = parser.parse(data, true, push, close);
+  if (error !== undefined) throw error;
+  // 250606: `parser.parse` was implemented as 2 calls:
+  // const err1 = parser.parse(data, false, push, close);
+  // if (err1 !== undefined) throw err1;
+  // const err2 = parser.parse(undefined, true, push, close);
+  // if (err2 !== undefined) throw err2;
   return records;
 };
 

package.json

@@ -19,19 +19,19 @@
     "@actions/core": "1.11.1",
     "@actions/exec": "1.1.1",
     "@actions/tool-cache": "2.0.2",
-    "csv-parse": "5.6.0",
-    "semver": "7.7.2",
-    "lodash": "4.17.21"
+    "csv-parse": "6.1.0",
+    "lodash": "4.17.23",
+    "semver": "7.7.2"
   },
   "devDependencies": {
-    "@vercel/ncc": "0.38.3",
-    "eslint": "9.30.1",
-    "@eslint/js": "9.30.1",
-    "globals": "16.3.0",
-    "markdownlint-cli": "0.45.0",
-    "prettier": "3.6.2",
-    "shellcheck": "3.1.0",
+    "@eslint/js": "9.38.0",
+    "@vercel/ncc": "0.38.4",
+    "eslint": "9.38.0",
     "eslint-plugin-yml": "1.18.0",
+    "globals": "17.3.0",
+    "markdownlint-cli": "0.47.0",
+    "prettier": "3.6.2",
+    "shellcheck": "4.1.0",
     "yarn": "1.22.22"
   },
   "engines": {

src/setup-beam.js

@@ -53,7 +53,7 @@ async function main() {
   await maybeInstallRebar3(rebar3Spec)
 
   // undefined is replaced by a function, post- main branch merge
-  const setupBeamVersion = 'fceaea9'
+  const setupBeamVersion = 'fe5485f'
   core.setOutput('setup-beam-version', setupBeamVersion)
 }
 
@@ -191,11 +191,21 @@ async function getOTPVersion(otpSpec0, osVersion) {
 }
 
 function requestedVersionFor(tool, version, originListing, mirrors) {
-  return (
-    `Requested ${tool} version (${version}) not found in version list, ` +
-    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}; ` +
-    "should you be using option 'version-type': 'strict'?"
-  )
+  const isStrictVersion = isStrictVersion()
+
+  let versionType = 'loose'
+  if (isStrictVersion) {
+    versionType = 'strict'
+  }
+
+  let ret =
+    `Requested ${versionType} ${tool} version (${version}) not found in version list, ` +
+    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}.`
+  if (!isStrictVersion) {
+    ret = `${ret} Should you be using option 'version-type': 'strict'?`
+  }
+
+  return ret
 }
 
 const knownBranches = ['main', 'master', 'maint']
@@ -648,6 +658,7 @@ function getRunnerOSVersion() {
     ubuntu24: 'ubuntu-24.04',
     win19: 'windows-2019',
     win22: 'windows-2022',
+    win25: 'windows-2025',
     macos13: 'macOS-13',
     macos14: 'macOS-14',
     macos15: 'macOS-15',