[dajudge]

Description

Fix a socket leak in @actions/http-client timeout handling.

The existing timeout callback calls socket.end(), which can leave a half-open client socket alive when the remote peer keeps its side of the connection open. That keeps the Node.js event loop active after the action’s work has completed.

This change patches the dependency during build and test setup to destroy the timed-out request with the timeout error instead. The patch is idempotent and fails fast if the expected upstream dependency implementation changes.

The compiled dist/ bundles have been regenerated.

This patch was developed with assistance from GPT-5.6-Sol.

Related issue

N/A

Check list

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Documentation changes are not required.
• Added a regression test using a half-open TCP server to verify no client socket remains active after timeout.

[brunoborges]

Thanks for the fix and the regression test, @dajudge. The underlying timeout/socket lifecycle bug is in @actions/http-client, which now lives in the actions/toolkit repository under packages/http-client: https://github.com/actions/toolkit/tree/main/packages/http-client. Please submit the patch and regression test there instead. Fixing it upstream will benefit all consumers and avoid maintaining a dependency-patching script in setup-java. Once an upstream release includes the fix, setup-java can update the dependency. Closing this PR in favor of that upstream fix.

[dajudge]

@brunoborges Thanks — agreed. I’ve submitted the fix and regression test upstream in actions/toolkit#2551.

Do you happen to know who currently maintains actions/toolkit, or the best person/team to request a review from there?