Automation: update setup-beam version output to fe5485f

* Bump @eslint/js from 9.31.0 to 9.38.0

Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.31.0 to 9.38.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.38.0/packages/js)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 9.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Help Dependabot out (?)

* Address vulnerabilities with markdownlint-cli

* Do the bump proposed by the PR

* Go back to a working, albeit apparently vulnerable, version

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Paulo F. Oliveira <paulo.ferraz.oliveira@gmail.com>

.github/workflows/action.yml

@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Version it!
         run: |
           # We expect a string such as const setupBeamVersion = 'undefined' in the code
@@ -45,8 +45,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm run build-dist
@@ -58,15 +58,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: raven-actions/actionlint@v2.0.1
+      - uses: actions/checkout@v6.0.2
+      - uses: raven-actions/actionlint@v2.1.0
 
   unit_tests_ubuntu:
     name: Unit tests (Ubuntu)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm ci
@@ -84,19 +84,27 @@ jobs:
     name: Unit tests (Windows)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm install --production
       - run: npm test
+      - name: .tool-versions test
+        id: setup-beam
+        uses: ./
+        with:
+          install-rebar: false
+          install-hex: false
+          version-file: test/.tool-versions
+          version-type: strict
 
   unit_tests_macos:
     name: Unit tests (macOS)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version: '20'
       - run: npm ci

.github/workflows/hexpm-mirrors.yml

@@ -26,7 +26,7 @@ jobs:
         install-rebar: [true, false]
         install-hex: [true, false]
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/macos.yml

@@ -43,12 +43,6 @@ jobs:
             elixir-version: '1.14.3'
             os: 'macos-latest'
             version-type: 'strict'
-          - otp-version: '27'
-            os: 'macos-15'
-            version-type: 'strict'
-          - otp-version: '26'
-            os: 'macos-15'
-            version-type: 'strict'
           - otp-version: '25'
             os: 'macos-15'
           - otp-version: '26'
@@ -71,7 +65,7 @@ jobs:
             rebar3-version: 'latest'
             os: 'macos-latest'
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -124,7 +118,7 @@ jobs:
             rebar3-version: 3.24
             os: macos-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/ubuntu.yml

@@ -53,12 +53,6 @@ jobs:
             elixir-version: '1.14.3'
             os: 'ubuntu-latest'
             version-type: 'strict'
-          - otp-version: '27'
-            os: 'ubuntu-24.04'
-            version-type: 'strict'
-          - otp-version: '26'
-            os: 'ubuntu-24.04'
-            version-type: 'strict'
           - otp-version: '25'
             os: 'ubuntu-24.04'
           - otp-version: '26'
@@ -92,7 +86,7 @@ jobs:
             escript_script: 'protoc-gen-elixir --version'
             os: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -160,7 +154,7 @@ jobs:
             rebar3-version: 3.24
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/update_3rd_party_licenses.yml

@@ -14,7 +14,7 @@ jobs:
     name: Update 3rd party licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - run:
           ./.github/workflows/update_3rd_party_licenses.sh
         env:

.github/workflows/windows.yml

@@ -70,7 +70,7 @@ jobs:
             escript_script: 'protoc-gen-elixir --version'
             os: 'windows-latest'
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -137,7 +137,7 @@ jobs:
             rebar3-version: 3.24
             os: windows-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v6.0.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

README.md

@@ -84,6 +84,7 @@ and Erlang/OTP.
 | `ubuntu-24.04`   | 24.3 - 28    | x86_64, arm64    | ✅
 | `windows-2019`   | 21\* - 25    | x86_64, x86      | ✅
 | `windows-2022`   | 21\* - 28    | x86_64, x86      | ✅
+| `windows-2025`   | 21\* - 28    | x86_64, x86      | ✅
 | `macOS-13`       | 25.0 - 28    | x86_64, arm64    | ✅
 | `macOS-14`       | 25.0 - 28    | x86_64, arm64    | ✅
 | `macOS-15`       | 25.0 - 28    | x86_64, arm64    | ✅
@@ -102,6 +103,7 @@ uses that to download assets:
 | `ubuntu24`         | `ubuntu-24.04`
 | `win19`            | `windows-2019`
 | `win22`            | `windows-2022`
+| `win25`            | `windows-2025`
 | `macos13`          | `macOS-13`
 | `macos14`          | `macOS-14`
 | `macos15`          | `macOS-15`
@@ -297,7 +299,7 @@ on: push
 
 jobs:
   test:
-    runs-on: windows-2022
+    runs-on: windows-2025
     steps:
       - uses: actions/checkout@v4
       - uses: erlef/setup-beam@v1

dist/index.js

@@ -5700,7 +5700,7 @@ function coerce (version, options) {
   var undefined;
 
   /** Used as the semantic version number. */
-  var VERSION = '4.17.21';
+  var VERSION = '4.17.23';
 
   /** Used as the size to enable large array optimizations. */
   var LARGE_ARRAY_SIZE = 200;
@@ -9454,7 +9454,7 @@ function coerce (version, options) {
           if (isArray(iteratee)) {
             return function(value) {
               return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee);
-            }
+            };
           }
           return iteratee;
         });
@@ -10058,8 +10058,47 @@ function coerce (version, options) {
      */
     function baseUnset(object, path) {
       path = castPath(path, object);
-      object = parent(object, path);
-      return object == null || delete object[toKey(last(path))];
+
+      // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+      var index = -1,
+          length = path.length;
+
+      if (!length) {
+        return true;
+      }
+
+      var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function');
+
+      while (++index < length) {
+        var key = path[index];
+
+        // skip non-string keys (e.g., Symbols, numbers)
+        if (typeof key !== 'string') {
+          continue;
+        }
+
+        // Always block "__proto__" anywhere in the path if it's not expected
+        if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
+          return false;
+        }
+
+        // Block "constructor.prototype" chains
+        if (key === 'constructor' &&
+            (index + 1) < length &&
+            typeof path[index + 1] === 'string' &&
+            path[index + 1] === 'prototype') {
+
+          // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a')
+          if (isRootPrimitive && index === 0) {
+            continue;
+          }
+
+          return false;
+        }
+      }
+
+      var obj = parent(object, path);
+      return obj == null || delete obj[toKey(last(path))];
     }
 
     /**
@@ -25933,7 +25972,7 @@ async function main() {
   await maybeInstallRebar3(rebar3Spec)
 
   // undefined is replaced by a function, post- main branch merge
-  const setupBeamVersion = '8fc1380'
+  const setupBeamVersion = 'fe5485f'
   core.setOutput('setup-beam-version', setupBeamVersion)
 }
 
@@ -26045,10 +26084,14 @@ async function maybeInstallRebar3(rebar3Spec) {
   return installed
 }
 
+function maybeRemoveOTPPrefix(otpSpec) {
+  return otpSpec.replace(/^OTP-/, '')
+}
+
 async function getOTPVersion(otpSpec0, osVersion) {
   const [otpVersions, originListing, hexMirrors] =
     await getOTPVersions(osVersion)
-  let spec = otpSpec0.replace(/^OTP-/, '')
+  let spec = maybeRemoveOTPPrefix(otpSpec0)
   const versions = otpVersions
   const otpVersion = getVersionFromSpec(spec, versions)
 
@@ -26062,11 +26105,21 @@ async function getOTPVersion(otpSpec0, osVersion) {
 }
 
 function requestedVersionFor(tool, version, originListing, mirrors) {
-  return (
-    `Requested ${tool} version (${version}) not found in version list, ` +
-    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}; ` +
-    "should you be using option 'version-type': 'strict'?"
-  )
+  const isStrictVersion = isStrictVersion()
+
+  let versionType = 'loose'
+  if (isStrictVersion) {
+    versionType = 'strict'
+  }
+
+  let ret =
+    `Requested ${versionType} ${tool} version (${version}) not found in version list, ` +
+    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}.`
+  if (!isStrictVersion) {
+    ret = `${ret} Should you be using option 'version-type': 'strict'?`
+  }
+
+  return ret
 }
 
 const knownBranches = ['main', 'master', 'maint']
@@ -26224,12 +26277,9 @@ async function getOTPVersions(osVersion) {
       .trim()
       .split('\n')
       .forEach((line) => {
-        const otpMatch = line
-          .match(/^([^ ]+)?( .+)/)[1]
-          .match(/^([^-]+-)?(.+)$/)
-        const otpVersion = otpMatch[2]
-        const otpVersionOrig = otpMatch[0]
-        debugLog('OTP line and parsing', [line, otpVersion, otpMatch])
+        const otpVersionOrig = line.match(/^([^ ]+)?( .+)/)[1]
+        const otpVersion = maybeRemoveOTPPrefix(otpVersionOrig)
+        debugLog('OTP line and parsing', [line, otpVersion, otpVersionOrig])
         otpVersions[otpVersion] = otpVersionOrig // we keep the original for later reference
       })
   } else if (process.platform === 'win32') {
@@ -26243,10 +26293,10 @@ async function getOTPVersions(osVersion) {
         .flat()
         .filter((x) => x.name.match(file_regex))
         .forEach((x) => {
-          const otpMatch = x.name.match(file_regex)
-          const otpVersion = otpMatch[1]
-          debugLog('OTP line and parsing', [otpMatch, otpVersion])
-          otpVersions[otpVersion] = otpVersion
+          const otpVersionOrig = x.name.match(file_regex)[1]
+          const otpVersion = otpVersionOrig
+          debugLog('OTP line and parsing', [x.name, otpVersion, otpVersionOrig])
+          otpVersions[otpVersion] = otpVersionOrig
         })
     })
   } else if (process.platform === 'darwin') {
@@ -26255,10 +26305,9 @@ async function getOTPVersions(osVersion) {
         columns: true,
       })
       .forEach((line) => {
-        const otpMatch = line.ref_name.match(/^([^-]+-)?(.+)$/)
-        const otpVersion = otpMatch[2]
-        const otpVersionOrig = otpMatch[0]
-        debugLog('OTP line and parsing', [line, otpVersion, otpMatch])
+        const otpVersionOrig = line.ref_name
+        const otpVersion = maybeRemoveOTPPrefix(otpVersionOrig)
+        debugLog('OTP line and parsing', [line, otpVersion, otpVersionOrig])
         otpVersions[otpVersion] = otpVersionOrig // we keep the original for later reference
       })
   }
@@ -26384,7 +26433,8 @@ function getVersionFromSpec(spec0, versions0) {
       isKnownBranch(version) ||
       isKnownVerBranch(version)
     ) {
-      // If `version-type: strict` or version is RC, we just try to remove a potential initial v
+      // If `version-type: strict`, version is an RC, or version is "a branch"
+      // we just try to remove a potential initial v
       coerced = maybeRemoveVPrefix(version)
     } else {
       // Otherwise, we place the version into a version bucket
@@ -26401,18 +26451,19 @@ function getVersionFromSpec(spec0, versions0) {
   const rangeMax = semver.maxSatisfying(versions, rangeForMax)
   let version = null
 
-  if (
+  if (spec0 === 'latest') {
+    version = versions0[versions0.latest]
+  } else if (
     isStrictVersion() ||
     isRC(spec0) ||
     isKnownBranch(spec0) ||
-    isKnownVerBranch(spec0)
+    isKnownVerBranch(spec0) ||
+    spec0 === 'nightly'
   ) {
     if (versions0[spec]) {
       // We obtain it directly
       version = versions0[spec]
     }
-  } else if (spec0 === 'latest') {
-    version = versions0[versions0.latest]
   } else if (rangeMax !== null) {
     // Otherwise, we compare alt. versions' semver ranges to this version, from highest to lowest
     const thatVersion = spec
@@ -26521,6 +26572,7 @@ function getRunnerOSVersion() {
     ubuntu24: 'ubuntu-24.04',
     win19: 'windows-2019',
     win22: 'windows-2022',
+    win25: 'windows-2025',
     macos13: 'macOS-13',
     macos14: 'macOS-14',
     macos15: 'macOS-15',
@@ -26680,7 +26732,7 @@ function parseVersionFile(versionFilePath0) {
   // For the time being we parse .tool-versions
   // If we ever start parsing something else, this should
   // become default in a new option named e.g. version-file-type
-  versions.split('\n').forEach((line) => {
+  versions.split(/\r?\n/).forEach((line) => {
     const appVersion = line.match(/^([^ ]+)[ ]+(ref:v?)?([^ #]+)/)
     if (appVersion) {
       const app = appVersion[1]
@@ -27524,7 +27576,7 @@ const normalize_options = function (opts) {
     );
   }
   // Normalize option `columns`
-  options.cast_first_line_to_header = null;
+  options.cast_first_line_to_header = undefined;
   if (options.columns === true) {
     // Fields in the first line are converted as-is to columns
     options.cast_first_line_to_header = undefined;
@@ -28056,7 +28108,7 @@ const normalize_options = function (opts) {
   // Normalize option `to`
   if (options.to === undefined || options.to === null) {
     options.to = -1;
-  } else {
+  } else if (options.to !== -1) {
     if (typeof options.to === "string" && /\d+/.test(options.to)) {
       options.to = parseInt(options.to);
     }
@@ -28075,7 +28127,7 @@ const normalize_options = function (opts) {
   // Normalize option `to_line`
   if (options.to_line === undefined || options.to_line === null) {
     options.to_line = -1;
-  } else {
+  } else if (options.to_line !== -1) {
     if (typeof options.to_line === "string" && /\d+/.test(options.to_line)) {
       options.to_line = parseInt(options.to_line);
     }
@@ -28206,10 +28258,14 @@ const transform = function (original_options = {}) {
               this.state.bufBytesStart += bomLength;
               buf = buf.slice(bomLength);
               // Renormalize original options with the new encoding
-              this.options = normalize_options({
+              const options = normalize_options({
                 ...this.original_options,
                 encoding: encoding,
               });
+              // Properties are merged with the existing options instance
+              for (const key in options) {
+                this.options[key] = options[key];
+              }
               // Options will re-evaluate the Buffer with the new encoding
               ({ comment, escape, quote } = this.options);
               break;
@@ -28952,10 +29008,14 @@ const transform = function (original_options = {}) {
       if (skip_records_with_error) {
         this.state.recordHasError = true;
         if (this.options.on_skip !== undefined) {
-          this.options.on_skip(
-            err,
-            raw ? this.state.rawBuffer.toString(encoding) : undefined,
-          );
+          try {
+            this.options.on_skip(
+              err,
+              raw ? this.state.rawBuffer.toString(encoding) : undefined,
+            );
+          } catch (err) {
+            return err;
+          }
         }
         // this.emit('skip', err, raw ? this.state.rawBuffer.toString(encoding) : undefined);
         return undefined;
@@ -29009,10 +29069,13 @@ const parse = function (data, opts = {}) {
     }
   };
   const close = () => {};
-  const err1 = parser.parse(data, false, push, close);
-  if (err1 !== undefined) throw err1;
-  const err2 = parser.parse(undefined, true, push, close);
-  if (err2 !== undefined) throw err2;
+  const error = parser.parse(data, true, push, close);
+  if (error !== undefined) throw error;
+  // 250606: `parser.parse` was implemented as 2 calls:
+  // const err1 = parser.parse(data, false, push, close);
+  // if (err1 !== undefined) throw err1;
+  // const err2 = parser.parse(undefined, true, push, close);
+  // if (err2 !== undefined) throw err2;
   return records;
 };
 

package.json

@@ -19,19 +19,19 @@
     "@actions/core": "1.11.1",
     "@actions/exec": "1.1.1",
     "@actions/tool-cache": "2.0.2",
-    "csv-parse": "5.6.0",
-    "semver": "7.7.2",
-    "lodash": "4.17.21"
+    "csv-parse": "6.1.0",
+    "lodash": "4.17.23",
+    "semver": "7.7.2"
   },
   "devDependencies": {
-    "@vercel/ncc": "0.38.3",
-    "eslint": "9.30.0",
-    "@eslint/js": "9.30.0",
-    "globals": "16.2.0",
-    "markdownlint-cli": "0.45.0",
-    "prettier": "3.6.2",
-    "shellcheck": "3.1.0",
+    "@eslint/js": "9.38.0",
+    "@vercel/ncc": "0.38.4",
+    "eslint": "9.38.0",
     "eslint-plugin-yml": "1.18.0",
+    "globals": "17.3.0",
+    "markdownlint-cli": "0.47.0",
+    "prettier": "3.6.2",
+    "shellcheck": "4.1.0",
     "yarn": "1.22.22"
   },
   "engines": {

src/setup-beam.js

@@ -53,7 +53,7 @@ async function main() {
   await maybeInstallRebar3(rebar3Spec)
 
   // undefined is replaced by a function, post- main branch merge
-  const setupBeamVersion = '8fc1380'
+  const setupBeamVersion = 'fe5485f'
   core.setOutput('setup-beam-version', setupBeamVersion)
 }
 
@@ -170,10 +170,14 @@ async function maybeInstallRebar3(rebar3Spec) {
   return installed
 }
 
+function maybeRemoveOTPPrefix(otpSpec) {
+  return otpSpec.replace(/^OTP-/, '')
+}
+
 async function getOTPVersion(otpSpec0, osVersion) {
   const [otpVersions, originListing, hexMirrors] =
     await getOTPVersions(osVersion)
-  let spec = otpSpec0.replace(/^OTP-/, '')
+  let spec = maybeRemoveOTPPrefix(otpSpec0)
   const versions = otpVersions
   const otpVersion = getVersionFromSpec(spec, versions)
 
@@ -187,11 +191,21 @@ async function getOTPVersion(otpSpec0, osVersion) {
 }
 
 function requestedVersionFor(tool, version, originListing, mirrors) {
-  return (
-    `Requested ${tool} version (${version}) not found in version list, ` +
-    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}; ` +
-    "should you be using option 'version-type': 'strict'?"
-  )
+  const isStrictVersion = isStrictVersion()
+
+  let versionType = 'loose'
+  if (isStrictVersion) {
+    versionType = 'strict'
+  }
+
+  let ret =
+    `Requested ${versionType} ${tool} version (${version}) not found in version list, ` +
+    `at ${originListing}${mirrors ? `, with mirrors ${mirrors}` : ''}.`
+  if (!isStrictVersion) {
+    ret = `${ret} Should you be using option 'version-type': 'strict'?`
+  }
+
+  return ret
 }
 
 const knownBranches = ['main', 'master', 'maint']
@@ -349,12 +363,9 @@ async function getOTPVersions(osVersion) {
       .trim()
       .split('\n')
       .forEach((line) => {
-        const otpMatch = line
-          .match(/^([^ ]+)?( .+)/)[1]
-          .match(/^([^-]+-)?(.+)$/)
-        const otpVersion = otpMatch[2]
-        const otpVersionOrig = otpMatch[0]
-        debugLog('OTP line and parsing', [line, otpVersion, otpMatch])
+        const otpVersionOrig = line.match(/^([^ ]+)?( .+)/)[1]
+        const otpVersion = maybeRemoveOTPPrefix(otpVersionOrig)
+        debugLog('OTP line and parsing', [line, otpVersion, otpVersionOrig])
         otpVersions[otpVersion] = otpVersionOrig // we keep the original for later reference
       })
   } else if (process.platform === 'win32') {
@@ -368,10 +379,10 @@ async function getOTPVersions(osVersion) {
         .flat()
         .filter((x) => x.name.match(file_regex))
         .forEach((x) => {
-          const otpMatch = x.name.match(file_regex)
-          const otpVersion = otpMatch[1]
-          debugLog('OTP line and parsing', [otpMatch, otpVersion])
-          otpVersions[otpVersion] = otpVersion
+          const otpVersionOrig = x.name.match(file_regex)[1]
+          const otpVersion = otpVersionOrig
+          debugLog('OTP line and parsing', [x.name, otpVersion, otpVersionOrig])
+          otpVersions[otpVersion] = otpVersionOrig
         })
     })
   } else if (process.platform === 'darwin') {
@@ -380,10 +391,9 @@ async function getOTPVersions(osVersion) {
         columns: true,
       })
       .forEach((line) => {
-        const otpMatch = line.ref_name.match(/^([^-]+-)?(.+)$/)
-        const otpVersion = otpMatch[2]
-        const otpVersionOrig = otpMatch[0]
-        debugLog('OTP line and parsing', [line, otpVersion, otpMatch])
+        const otpVersionOrig = line.ref_name
+        const otpVersion = maybeRemoveOTPPrefix(otpVersionOrig)
+        debugLog('OTP line and parsing', [line, otpVersion, otpVersionOrig])
         otpVersions[otpVersion] = otpVersionOrig // we keep the original for later reference
       })
   }
@@ -509,7 +519,8 @@ function getVersionFromSpec(spec0, versions0) {
       isKnownBranch(version) ||
       isKnownVerBranch(version)
     ) {
-      // If `version-type: strict` or version is RC, we just try to remove a potential initial v
+      // If `version-type: strict`, version is an RC, or version is "a branch"
+      // we just try to remove a potential initial v
       coerced = maybeRemoveVPrefix(version)
     } else {
       // Otherwise, we place the version into a version bucket
@@ -526,18 +537,19 @@ function getVersionFromSpec(spec0, versions0) {
   const rangeMax = semver.maxSatisfying(versions, rangeForMax)
   let version = null
 
-  if (
+  if (spec0 === 'latest') {
+    version = versions0[versions0.latest]
+  } else if (
     isStrictVersion() ||
     isRC(spec0) ||
     isKnownBranch(spec0) ||
-    isKnownVerBranch(spec0)
+    isKnownVerBranch(spec0) ||
+    spec0 === 'nightly'
   ) {
     if (versions0[spec]) {
       // We obtain it directly
       version = versions0[spec]
     }
-  } else if (spec0 === 'latest') {
-    version = versions0[versions0.latest]
   } else if (rangeMax !== null) {
     // Otherwise, we compare alt. versions' semver ranges to this version, from highest to lowest
     const thatVersion = spec
@@ -646,6 +658,7 @@ function getRunnerOSVersion() {
     ubuntu24: 'ubuntu-24.04',
     win19: 'windows-2019',
     win22: 'windows-2022',
+    win25: 'windows-2025',
     macos13: 'macOS-13',
     macos14: 'macOS-14',
     macos15: 'macOS-15',
@@ -805,7 +818,7 @@ function parseVersionFile(versionFilePath0) {
   // For the time being we parse .tool-versions
   // If we ever start parsing something else, this should
   // become default in a new option named e.g. version-file-type
-  versions.split('\n').forEach((line) => {
+  versions.split(/\r?\n/).forEach((line) => {
     const appVersion = line.match(/^([^ ]+)[ ]+(ref:v?)?([^ #]+)/)
     if (appVersion) {
       const app = appVersion[1]

test/setup-beam.test.js

@@ -77,7 +77,7 @@ describe('OTP install', () => {
     const otpOSVersion = 'ubuntu-08.04'
     const otpVersion = 'OTP-23.2'
 
-    assert.rejects(
+    await assert.rejects(
       async () => {
         await setupBeam.install('otp', {
           hexMirror: 'https://builds.hex.pm',
@@ -97,7 +97,7 @@ describe('OTP install', () => {
 describe('Elixir install', () => {
   it('fails for version 0.11 without OTP', async () => {
     const exVersion = '0.11'
-    assert.rejects(
+    await assert.rejects(
       async () => {
         await setupBeam.install('elixir', {
           hexMirror: 'https://builds.hex.pm',
@@ -114,7 +114,7 @@ describe('Elixir install', () => {
 
   it('fails for version 1.0.0 on OTP 17 (without OTP)', async () => {
     const exVersion = 'v1.0.0-otp-17'
-    assert.rejects(
+    await assert.rejects(
       async () => {
         await setupBeam.install('elixir', {
           hexMirror: 'https://builds.hex.pm',
@@ -133,7 +133,7 @@ describe('Elixir install', () => {
 describe('Gleam install', () => {
   it('fails for unknown OTP', async () => {
     const gleamVersion = '0.1.3'
-    assert.rejects(
+    await assert.rejects(
       async () => {
         await setupBeam.install('gleam', { gleamVersion })
       },
@@ -149,7 +149,7 @@ describe('Gleam install', () => {
 describe('rebar3 install', () => {
   it('fails for unknown OTP', async () => {
     const r3Version = '0.14.4'
-    assert.rejects(
+    await assert.rejects(
       async () => {
         await setupBeam.install('rebar3', { r3Version })
       },
@@ -179,14 +179,6 @@ describe('.getOTPVersion(_) - Erlang', () => {
     process.env.RUNNER_ARCH = 'X64'
 
     it('is Ok for known linux version', async () => {
-      before = simulateInput('version-type', 'strict')
-      spec = '26'
-      osVersion = 'ubuntu-24.04'
-      expected = 'maint-26'
-      got = await setupBeam.getOTPVersion(spec, osVersion)
-      assert.deepStrictEqual(got, expected)
-      simulateInput('version-type', before)
-
       before = simulateInput('version-type', 'strict')
       spec = '27.0'
       osVersion = 'ubuntu-24.04'
@@ -311,19 +303,46 @@ describe('.getOTPVersion(_) - Erlang', () => {
   }
 
   if (process.platform === 'linux') {
-    it('is Ok for known linux ARM64 version', async () => {
+    it('is main-... only if strict/maint-... is used as input', async () => {
       const arm64Options = setupBeam.githubARMRunnerArchs()
       process.env.RUNNER_ARCH =
         arm64Options[Math.floor(Math.random() * arm64Options.length)]
 
       before = simulateInput('version-type', 'strict')
-      spec = '26'
-      osVersion = 'ubuntu-24.04'
-      expected = 'maint-26'
-      got = await setupBeam.getOTPVersion(spec, osVersion)
-      assert.deepStrictEqual(got, expected)
+      await assert.rejects(
+        async () => {
+          await setupBeam.getOTPVersion('27', 'ubuntu-24.04')
+        },
+        (err) => {
+          assert.ok(err instanceof Error)
+          return true
+        },
+        `Fetching strict OTP version maint-<v> with input <v> is supposed to fail`,
+      )
       simulateInput('version-type', before)
 
+      before = simulateInput('version-type', 'strict')
+      assert.strictEqual(
+        await setupBeam.getOTPVersion('maint-27', 'ubuntu-24.04'),
+        'maint-27',
+      )
+      simulateInput('version-type', before)
+
+      before = simulateInput('version-type', 'loose')
+      assert.strictEqual(
+        await setupBeam.getOTPVersion('maint-27', 'ubuntu-24.04'),
+        'maint-27',
+      )
+      simulateInput('version-type', before)
+
+      process.env.RUNNER_ARCH = previousRunnerArch
+    })
+
+    it('is Ok for known linux ARM64 version', async () => {
+      const arm64Options = setupBeam.githubARMRunnerArchs()
+      process.env.RUNNER_ARCH =
+        arm64Options[Math.floor(Math.random() * arm64Options.length)]
+
       before = simulateInput('version-type', 'strict')
       spec = '27.0'
       osVersion = 'ubuntu-24.04'
@@ -388,14 +407,6 @@ describe('.getOTPVersion(_) - Erlang', () => {
       process.env.RUNNER_ARCH =
         amd64Options[Math.floor(Math.random() * amd64Options.length)]
 
-      before = simulateInput('version-type', 'strict')
-      spec = '26'
-      osVersion = 'ubuntu-24.04'
-      expected = 'maint-26'
-      got = await setupBeam.getOTPVersion(spec, osVersion)
-      assert.deepStrictEqual(got, expected)
-      simulateInput('version-type', before)
-
       before = simulateInput('version-type', 'strict')
       spec = '27.0'
       osVersion = 'ubuntu-24.04'
@@ -475,6 +486,35 @@ describe('.getOTPVersion(_) - Erlang', () => {
   }
 
   if (process.platform === 'darwin') {
+    it('is main-... only if strict/maint-... is used as input', async () => {
+      const arm64Options = setupBeam.githubARMRunnerArchs()
+      process.env.RUNNER_ARCH =
+        arm64Options[Math.floor(Math.random() * arm64Options.length)]
+
+      before = simulateInput('version-type', 'strict')
+      await assert.rejects(
+        async () => {
+          await setupBeam.getOTPVersion('27')
+        },
+        (err) => {
+          assert.ok(err instanceof Error)
+          return true
+        },
+        `Fetching strict OTP version maint-<v> with input <v> is supposed to fail`,
+      )
+      simulateInput('version-type', before)
+
+      before = simulateInput('version-type', 'strict')
+      assert.strictEqual(await setupBeam.getOTPVersion('maint-27'), 'maint-27')
+      simulateInput('version-type', before)
+
+      before = simulateInput('version-type', 'loose')
+      assert.strictEqual(await setupBeam.getOTPVersion('maint-27'), 'maint-27')
+      simulateInput('version-type', before)
+
+      process.env.RUNNER_ARCH = previousRunnerArch
+    })
+
     it('is Ok for known macos ARM64 version', async () => {
       const arm64Options = setupBeam.githubARMRunnerArchs()
       process.env.RUNNER_ARCH =
@@ -517,7 +557,7 @@ describe('OTP arch-specific install', () => {
       const spec = '26'
       const osVersion = 'ubuntu-24.04'
 
-      assert.rejects(
+      await assert.rejects(
         async () => {
           await setupBeam.getOTPVersion(spec, osVersion)
         },
@@ -583,7 +623,7 @@ describe('.getOTPVersion(_) - Elixir', () => {
 
       before = simulateInput('version-type', 'strict')
       spec = 'v1.15.0-rc.2'
-      otpVersion = 'OTP-26'
+      otpVersion = 'OTP-26.0'
       expected = 'v1.15.0-rc.2-otp-26'
       await setupBeam.installOTP(otpVersion)
       got = await setupBeam.getElixirVersion(spec, otpVersion)
@@ -617,6 +657,12 @@ describe('.getOTPVersion(_) - Gleam', () => {
     got = await setupBeam.getGleamVersion(spec, otpVersion)
     assert.deepStrictEqual(got, expected)
 
+    spec = 'nightly'
+    otpVersion = '28'
+    expected = 'nightly'
+    got = await setupBeam.getGleamVersion(spec, otpVersion)
+    assert.deepStrictEqual(got, expected)
+
     spec = '0.13.2'
     otpVersion = 'OTP-24'
     expected = 'v0.13.2'
@@ -870,11 +916,6 @@ describe('.getVersionFromSpec(_)', () => {
     got = setupBeam.getVersionFromSpec(spec, matrix.otp['ubuntu-20.04'])
     assert.deepStrictEqual(got, expected)
 
-    spec = 'maint-24'
-    expected = 'maint-24'
-    got = setupBeam.getVersionFromSpec(spec, matrix.otp['ubuntu-22.04'])
-    assert.deepStrictEqual(got, expected)
-
     spec = '> 0'
     expected = 'OTP-26.2.5'
     got = setupBeam.getVersionFromSpec(spec, matrix.otp['ubuntu-22.04'])
@@ -885,11 +926,6 @@ describe('.getVersionFromSpec(_)', () => {
     got = setupBeam.getVersionFromSpec(spec, matrix.otp['ubuntu-22.04'])
     assert.deepStrictEqual(got, expected)
 
-    spec = 'maint-26'
-    expected = 'maint-26'
-    got = setupBeam.getVersionFromSpec(spec, matrix.otp['ubuntu-22.04'])
-    assert.deepStrictEqual(got, expected)
-
     spec = '> 0'
     expected = 'OTP-27.0'
     got = setupBeam.getVersionFromSpec(spec, matrix.otp['ubuntu-24.04'])
@@ -938,15 +974,19 @@ describe('version file', () => {
   const gleamVersion = unsimulateInput('gleam-version')
 
   it('is parsed correctly', async () => {
-    const erlang = '27'
-    const elixir = '1.17.0'
-    const gleam = '0.23.0'
-    const toolVersions = `# a comment
-erlang   ref:v${erlang}# comment, no space, and ref:v
+    const erlang = '27.3.4.1'
+    const elixir = '1.18.4'
+    const gleam = '1.9.1'
+    let toolVersions = `# a comment
+erlang   ref:v${erlang}
 elixir ref:${elixir}  # comment, with space and ref:
  not-gleam 0.23 # not picked up
 gleam ${gleam} \n`
     const filename = 'test/.tool-versions'
+    if (process.platform === 'win32') {
+      // Force \r\n to test in Windows
+      toolVersions = toolVersions.replace(/\n/g, '\r\n')
+    }
     fs.writeFileSync(filename, toolVersions)
     process.env.GITHUB_WORKSPACE = ''
     const appVersions = setupBeam.parseVersionFile(filename)