[mailerlite-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-java	action	digest	de7274f → b843ebf

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[mailerlite-kritika]

Kritika Review

Bumps the actions/setup-java pin to b843ebf in both workflows

No findings

Confidence 4/5 · medium risk: The bump moves a pinned digest of the same v6 action in the publish and test workflows, and the review reported no findings. I still have a concern the review does not settle: the upstream auth.ts refactor and the GPG cleanup change sit on the publish path, which handles Maven Central credentials and signing, and the account only asserts that default settings.xml generation is unchanged without showing the auth.ts diff.

Summary

Renovate moves the pinned digest of actions/setup-java from de7274f to b843ebf in publish.yaml and test.yml. The v6 comment still fits. I read the upstream compare of 9 commits. They add optional Maven inputs (repository origins and plugin repositories), Temurin and Zulu version-parsing fixes, and GPG agent cleanup. Neither workflow uses the new inputs, so their behaviour should not change.

Merge impact

• The upstream diff adds optional mvn-server-repository-origins and mvn-plugin-repositories inputs and refactors src/auth.ts. Neither workflow sets these inputs, so settings.xml generation for server-id: central should be unchanged.
• The upstream change also stops the GPG agent before removing the gpg home (src/gpg.ts). publish.yaml imports a GPG key, so a publish run (workflow_dispatch or a release) is the first place to check that the post-step cleanup works.

Sources consulted

• https://redirect.github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad

Commands offered: curl, fd, gh, jq, rg, yq; run: gh.

_{Reviews (1) · Last reviewed commit: "chore(deps): update actions/setup-java d..." · claude-sonnet-5-5}