Bump the github-actions group with 4 updates (#1158 )

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [shivammathur/cache-extensions](https://github.com/shivammathur/cache-extensions). Updates `github/codeql-action/init` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) Updates `github/codeql-action/autobuild` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) Updates `shivammathur/cache-extensions` from 1.15.8 to 1.15.11 - [Release notes](https://github.com/shivammathur/cache-extensions/releases) - [Commits](https://github.com/shivammathur/cache-extensions/compare/c33688ce81fd884ddd70d51cadeb62b6fb974750...695b1b465eba861efe67cbbc31252c27f5ed253d) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: shivammathur/cache-extensions dependency-version: 1.15.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Pin VcRedist to stable release 4.1.527
2026-11-14 19:42:00 +00:00 · 2026-11-14 16:32:02 +05:30 · 2026-11-14 14:37:10 +05:30 · 2026-11-10 19:40:56 +05:30 · 2026-11-10 19:28:27 +05:30 · 2026-11-08 16:47:45 +05:30
43 changed files with 1089 additions and 1027 deletions
@@ -88,7 +88,7 @@ body:
      label: "Are you willing to submit a PR?"
      description: "We accept pull requests targeting the develop branch."
      options:
-        - "Yes"
        - "No"
+        - "Yes"
    validations:
      required: true
@@ -26,13 +26,13 @@ jobs:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4
        with:
          config-file: ./.github/codeql/codeql-configuration.yml
          languages: javascript

      - name: Autobuild
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4
@@ -23,7 +23,7 @@ jobs:
        php-versions: ['5.3', '5.4', '5.5', '5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5', '8.6', '8.7']
    steps:
      - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
        with:
          php-version: ${{ matrix.php-versions }}
          tools: none
@@ -42,7 +42,7 @@ jobs:
        run: |
          php -m | Out-File -FilePath "$env:file.all" -Append
      - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
        with:
          php-version: ${{ matrix.php-versions }}
          extensions: none
@@ -91,7 +91,7 @@ jobs:
          Remove-Item "$env:file.all" -Force
          Remove-Item "$env:file.builtin" -Force
      - name: Upload artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: lists-php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
          path: php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
@@ -109,7 +109,7 @@ jobs:
          repository: ${{ github.repository }}.wiki
          persist-credentials: false
      - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          path: ${{ github.workspace }}/lists
          pattern: lists-*
@@ -39,7 +39,7 @@ jobs:
          persist-credentials: false

      - name: Setup Node.js 24.x
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
        with:
          node-version: 24.x

@@ -48,7 +48,7 @@ jobs:

      - name: Setup cache environment
        id: cache-env
-        uses: shivammathur/cache-extensions@de3c642a5fce0ef91581a1c9831e229f525196d6 # v1
+        uses: shivammathur/cache-extensions@695b1b465eba861efe67cbbc31252c27f5ed253d # v1
        with:
          php-version: ${{ matrix.php-versions || env.default-php-version }}
          extensions: ${{ env.extensions }}
@@ -38,7 +38,7 @@ jobs:
          persist-credentials: false

      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
        with:
          node-version: '24.x'
          registry-url: https://registry.npmjs.org
@@ -60,7 +60,7 @@ jobs:
        run: npm publish --access public --tag "${{ steps.publish-tag.outputs.tag }}"

      - name: Change to GitHub Packages registry
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
        with:
          registry-url: https://npm.pkg.github.com
          package-manager-cache: false
@@ -82,7 +82,6 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 | macOS Golden Gate 27.x | arm64   | `xcode-27`                                                | -                 |
 | macOS Tahoe 26.x       | arm64   | `macos-latest` or `macos-26`                              | -                 |
 | macOS Sequoia 15.x     | arm64   | `macos-15`                                                | -                 |
-| macOS Sonoma 14.x      | arm64   | `macos-14`                                                | -                 |
 | macOS Tahoe 26.x       | x86_64  | `macos-26-intel`                                          | `PHP 8.5`         |
 | macOS Sequoia 15.x     | x86_64  | `macos-15-intel`                                          | `PHP 8.5`         |

@@ -112,8 +111,8 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t

 On all supported OS/Platforms, the following PHP versions can be set up as per the runner.

- PHP 5.3 to PHP 8.7 on GitHub-hosted runners, except for macOS ARM64 runners (macos-14).
- PHP 5.6 to PHP 8.7 on GitHub-hosted macOS ARM64 runners (macos-14).
+- PHP 5.3 to PHP 8.7 on GitHub-hosted runners, except for macOS ARM64 runners.
+- PHP 5.6 to PHP 8.7 on GitHub-hosted macOS ARM64 runners.
 - PHP 5.6 to PHP 8.7 on self-hosted runners.

 | PHP Version | Stability | Release Support       | Runner Support                 |
@@ -175,6 +174,8 @@ PHP extensions can be set up using the `extensions` input. It accepts a `string`

 - Extensions with pre-release versions available on `PECL` can be set up by suffixing the extension's name with its state i.e `alpha`, `beta`, `devel` or `snapshot`.

+  This sets the minimum stability. The newest release with that stability or a more stable state is selected.
+
 ```yaml
 - name: Setup PHP with pre-release PECL extension
  uses: shivammathur/setup-php@v2
@@ -1,4 +1,4 @@
-import * as config from '../src/config';
+import * as config from '../src/config.js';

 describe('Config tests', () => {
  it.each`
@@ -1,4 +1,5 @@
-import * as core from '../src/core';
+import {jest} from '@jest/globals';
+import * as core from '../src/core.js';

 describe('Core tests', () => {
  const originalEnv = process.env;
@@ -1,4 +1,4 @@
-import * as coverage from '../src/coverage';
+import * as coverage from '../src/coverage.js';

 describe('Config tests', () => {
  it.each`
@@ -1,5 +1,5 @@
 import * as fs from 'fs';
-import * as extensions from '../src/extensions';
+import * as extensions from '../src/extensions.js';

 describe('Extension tests', () => {
  it.each`
@@ -7,6 +7,7 @@ describe('Extension tests', () => {
    ${'none'}                                    | ${'7.4'} | ${'Disable-AllShared'}
    ${':intl'}                                   | ${'7.4'} | ${'Disable-Extension intl'}
    ${'ast-beta'}                                | ${'7.4'} | ${'Add-Extension ast beta'}
+    ${'ast-stable'}                              | ${'7.4'} | ${'Add-Extension ast stable'}
    ${'blackfire'}                               | ${'7.3'} | ${'Add-Blackfire blackfire'}
    ${'blackfire-1.31.0'}                        | ${'7.3'} | ${'Add-Blackfire blackfire-1.31.0'}
    ${'grpc-1.2.3'}                              | ${'7.4'} | ${'Add-Extension grpc stable 1.2.3'}
@@ -1,6 +1,19 @@
-import * as fetch from '../src/fetch';
+import * as fetch from '../src/fetch.js';
 import nock from 'nock';

+beforeAll(() => nock.disableNetConnect());
+
+afterEach(() => {
+  const pending = nock.pendingMocks();
+  nock.cleanAll();
+  expect(pending).toEqual([]);
+});
+
+afterAll(() => {
+  nock.enableNetConnect();
+  nock.restore();
+});
+
 it('checking fetch', async () => {
  const host_url = 'https://example.com';
  const manifest_url = host_url + '/manifest';
@@ -9,9 +22,8 @@ it('checking fetch', async () => {
  nock(host_url)
    .get('/manifest')
    .reply(200, {latest: 'latest'})
-    .get('/manifest', '', {
-      reqheaders: {authorization: 'Bearer invalid_token'}
-    })
+    .get('/manifest')
+    .matchHeader('authorization', 'Bearer invalid_token')
    .reply(401, {error: '401: Unauthorized'})
    .get('/ping')
    .twice()
@@ -36,7 +48,7 @@ it('checking fetch', async () => {
  expect(response.data).toBe(undefined);

  response = await fetch.fetch(manifest_url, 'invalid_token');
-  expect(response.error).not.toBe(undefined);
+  expect(response.error).toBe('401: Unauthorized');
  expect(response.data).toBe(undefined);

  response = await fetch.fetch(host_url + '/error');
@@ -1,12 +1,11 @@
-import * as install from '../src/install';
-import * as utils from '../src/utils';
+import {jest} from '@jest/globals';

 /**
 * Mock install.ts
 */
-jest.mock('../src/install', () => ({
+jest.unstable_mockModule('../src/install.js', () => ({
  getScript: jest
-    .fn()
+    .fn<typeof import('../src/install.js').getScript>()
    .mockImplementation(async (os: string): Promise<string> => {
      const filename = os + (await utils.scriptExtension(os));
      const version: string = await utils.parseVersion(
@@ -36,7 +35,7 @@ jest.mock('../src/install', () => ({
 /**
 * Mock fetch.ts
 */
-jest.mock('../src/fetch', () => ({
+jest.unstable_mockModule('../src/fetch.js', () => ({
  fetch: jest.fn().mockImplementation(() => {
    return {
      data: '{ "latest": "8.3", "lowest": "8.1", "highest": "8.3", "nightly": "8.4", "5.x": "5.6" }'
@@ -44,6 +43,9 @@ jest.mock('../src/fetch', () => ({
  })
 }));

+const utils = await import('../src/utils.js');
+const install = await import('../src/install.js');
+
 describe('Install', () => {
  it.each`
    version      | os          | extension_csv | ini_file         | ini_values_csv | coverage_driver | tools        | output
@@ -1,6 +1,19 @@
-import * as packagist from '../src/packagist';
+import * as packagist from '../src/packagist.js';
 import nock from 'nock';

+beforeAll(() => nock.disableNetConnect());
+
+afterEach(() => {
+  const pending = nock.pendingMocks();
+  nock.cleanAll();
+  expect(pending).toEqual([]);
+});
+
+afterAll(() => {
+  nock.enableNetConnect();
+  nock.restore();
+});
+
 describe('search function', () => {
  const mockResponse = {
    packages: {
@@ -1,6 +1,6 @@
-import * as fs from 'fs';
-import * as tools from '../src/tools';
-import {ToolData, ToolInput} from '../src/tools';
+import {jest} from '@jest/globals';
+import fs from 'fs';
+import type {ToolData, ToolInput} from '../src/tools.js';

 function getData(data: Partial<ToolData>): ToolData {
  const tool = data.tool || 'tool';
@@ -40,16 +40,12 @@ function unsetComposerAuthEnv(): void {
 /**
 * Mock fetch.ts
 */
-jest.mock('../src/fetch', () => ({
+jest.unstable_mockModule('../src/fetch.js', () => ({
  fetch: jest
-    .fn()
+    .fn<typeof import('../src/fetch.js').fetch>()
    .mockImplementation(
      async (url: string, token?: string): Promise<Record<string, string>> => {
-        if (url.includes('deployer')) {
-          return {
-            data: '[{"version": "1.2.3", "url": "https://deployer.org/releases/v1.2.3/deployer.phar"}]'
-          };
-        } else if (url.includes('atom') && !url.includes('no-')) {
+        if (url.includes('atom') && !url.includes('no-')) {
          return {
            data: '"releases/tag/1.2.3", "releases/tag/3.2.1", "releases/tag/2.3.1"'
          };
@@ -86,9 +82,9 @@ jest.mock('../src/fetch', () => ({
    )
 }));

-jest.mock('../src/packagist', () => ({
+jest.unstable_mockModule('../src/packagist.js', () => ({
  search: jest
-    .fn()
+    .fn<typeof import('../src/packagist.js').search>()
    .mockImplementation(
      async (
        package_name: string,
@@ -102,6 +98,10 @@ jest.mock('../src/packagist', () => ({
    )
 }));

+const tools = await import('../src/tools.js');
+
+afterEach(() => jest.restoreAllMocks());
+
 describe('Tools tests', () => {
  it.each`
    token                | version
@@ -381,6 +381,56 @@ describe('Tools tests', () => {
    }
  );

+  it.each`
+    release               | resolved
+    ${'phpstan'}          | ${'latest/download'}
+    ${'phpstan:0.12.68'}  | ${'download/0.12.68'}
+    ${'phpstan:^0.12.68'} | ${'download/0.12.68'}
+    ${'phpstan:0.12'}     | ${'download/1.2.3'}
+    ${'phpstan:0.12.x'}   | ${'download/1.2.3'}
+    ${'phpstan:0.12.*'}   | ${'download/1.2.3'}
+  `(
+    'resolving PHPStan PHAR fallback for $release',
+    async ({release, resolved}) => {
+      unsetComposerAuthEnv();
+      for (const os of ['linux', 'darwin', 'win32']) {
+        const data = await tools.getData(release, '8.0', os);
+        const script = await tools.addPackage(data);
+        expect(script).toContain(
+          'scoped https://github.com/phpstan/phpstan/releases/' +
+            resolved +
+            '/phpstan.phar "-V"'
+        );
+        expect(data.type).toBe('composer');
+        expect(data.release).toContain('phpstan');
+      }
+    }
+  );
+
+  it('keeps Composer available when the fallback version lookup fails', async () => {
+    process.env['GITHUB_TOKEN'] = 'invalid_token';
+    const data = await tools.getData('phpstan:0.12', '8.0', 'linux');
+    expect(await tools.addPackage(data)).toBe(
+      'add_composer_tool phpstan "phpstan:0.12.*" phpstan/ scoped'
+    );
+    unsetComposerAuthEnv();
+  });
+
+  it('uses fallback settings independently of the Composer repository', async () => {
+    const data = await tools.getData('vendor/tool:1.2.3', '8.0', 'linux', {
+      fallback: {
+        type: 'phar',
+        repository: 'releases/tool',
+        domain: 'https://example.com',
+        extension: '.phar',
+        version_prefix: 'v'
+      }
+    });
+    expect(await tools.addPackage(data)).toBe(
+      'add_composer_tool tool tool:1.2.3 vendor/ global https://example.com/releases/tool/v1.2.3/tool.phar ""'
+    );
+  });
+
  it.each`
    version     | php_version | os          | script
    ${'latest'} | ${'8.0'}    | ${'linux'}  | ${'add_tool https://github.com/phar-io/phive/releases/download/3.2.1/phive-3.2.1.phar phive'}
@@ -431,13 +481,15 @@ describe('Tools tests', () => {

  it.each`
    version     | url
-    ${'latest'} | ${'https://deployer.org/deployer.phar'}
-    ${'1.2.3'}  | ${'https://deployer.org/releases/v1.2.3/deployer.phar'}
-    ${'3.2.1'}  | ${'Version missing in deployer manifest'}
+    ${'latest'} | ${'https://github.com/deployphp/deployer/releases/latest/download/deployer.phar,https://deployer.org/deployer.phar deployer'}
+    ${'7.5.12'} | ${'https://github.com/deployphp/deployer/releases/download/v7.5.12/deployer.phar,https://deployer.org/releases/v7.5.12/deployer.phar deployer'}
+    ${'6.8.0'}  | ${'https://github.com/deployphp/deployer/releases/download/v6.8.0/deployer.phar,https://deployer.org/releases/v6.8.0/deployer.phar deployer'}
  `('checking addDeployer: $version', async ({version, url}) => {
    const data = getData({
      tool: 'deployer',
      domain: 'https://deployer.org',
+      repository: 'deployphp/deployer',
+      version_prefix: 'v',
      version: version
    });
    expect(await tools.addDeployer(data)).toContain(url);
@@ -527,30 +579,11 @@ describe('Tools tests', () => {
  });

  it('checking affected composer version with CRLF ranges', async () => {
-    let affected = false;
-    let fixed = true;
-    await jest.isolateModulesAsync(async () => {
-      jest.doMock('fs', () => ({
-        ...jest.requireActual('fs'),
-        readFileSync: (
-          filePath: fs.PathOrFileDescriptor,
-          options?: unknown
-        ) => {
-          if (String(filePath).includes('composer-gh-auth-no-op')) {
-            return '1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8';
-          }
-          return (jest.requireActual('fs') as typeof fs).readFileSync(
-            filePath,
-            options as fs.ObjectEncodingOptions & {flag?: string}
-          );
-        }
-      }));
-      const isolatedTools = jest.requireActual<typeof tools>('../src/tools');
-      affected = isolatedTools.skipGitHubAuthForComposerVersion('2.9.7');
-      fixed = isolatedTools.skipGitHubAuthForComposerVersion('2.9.8');
-    });
-    expect(affected).toBe(true);
-    expect(fixed).toBe(false);
+    jest
+      .spyOn(fs, 'readFileSync')
+      .mockReturnValue('1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8');
+    expect(tools.skipGitHubAuthForComposerVersion('2.9.7')).toBe(true);
+    expect(tools.skipGitHubAuthForComposerVersion('2.9.8')).toBe(false);
  });

  it.each`
@@ -655,7 +688,7 @@ describe('Tools tests', () => {
        'add_tool https://github.com/humbug/php-scoper/releases/latest/download/php-scoper.phar php-scoper "--version"',
        'add_tool https://github.com/phpDocumentor/phpDocumentor/releases/latest/download/phpDocumentor.phar phpDocumentor "--version"',
        'add_composer_tool phplint phplint overtrue/',
-        'add_tool https://github.com/phpstan/phpstan/releases/latest/download/phpstan.phar phpstan "-V"',
+        'add_composer_tool phpstan phpstan phpstan/ scoped',
        'add_tool https://phar.phpunit.de/phpunit-7.4.0.phar,https://phar.phpunit.de/phpunit-7.phar phpunit "--version"',
        'add_pecl',
        'add_tool https://www.phing.info/get/phing-latest.phar phing "-v"',
@@ -744,7 +777,7 @@ describe('Tools tests', () => {
        'blackfire-player is not a windows tool',
        'Add-Tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/latest/download/cs2pr cs2pr "-V"',
        'Add-Tool https://github.com/bmitch/churn-php/releases/latest/download/churn.phar churn "-V"',
-        'Add-Tool https://deployer.org/deployer.phar deployer "-V"',
+        'Add-Tool https://github.com/deployphp/deployer/releases/latest/download/deployer.phar,https://deployer.org/deployer.phar deployer "-V"',
        'Tool does_not_exist is not supported',
        'Add-ComposerTool flex flex symfony/ global',
        'Add-Mago',
@@ -830,19 +863,20 @@ describe('Tools tests', () => {
  });

  it.each`
-    tools_csv                                    | os          | script
-    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}  | ${'linux'}  | ${'add_tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
-    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}  | ${'win32'}  | ${'Add-Tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
-    ${'composer:2.9.8@sha256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
-    ${'cs2pr:1.2.3@sha256:' + 'd'.repeat(64)}    | ${'linux'}  | ${'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V" sha256:' + 'd'.repeat(64)}
-    ${'phive:0.15.3@sha512:' + 'c'.repeat(128)}  | ${'darwin'} | ${'add_tool https://github.com/phar-io/phive/releases/download/0.15.3/phive-0.15.3.phar phive "status" sha512:' + 'c'.repeat(128)}
-    ${'phinx:1.2.3@sha256:' + 'a'.repeat(64)}    | ${'linux'}  | ${'add_log "$cross" "phinx" "Checksum verification is not supported for phinx"'}
-    ${'pecl:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
-    ${'phpunit:9.5.0@sha256:invalid'}            | ${'linux'}  | ${'add_log "$cross" "phpunit" "Invalid sha256 checksum, expected 64 hexadecimal characters"'}
-    ${'composer:2.9.8@SHA256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
-    ${'composer:2.9.8@sha384:' + 'b'.repeat(96)} | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm sha384, expected sha256 or sha512"'}
-    ${'composer:2.9.8@md5:' + 'b'.repeat(32)}    | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm md5, expected sha256 or sha512"'}
-    ${'composer:2.9.8@sha256' + 'b'.repeat(64)}  | ${'linux'}  | ${'add_log "$cross" "composer" "Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>"'}
+    tools_csv                                     | os          | script
+    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}   | ${'linux'}  | ${'add_tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
+    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}   | ${'win32'}  | ${'Add-Tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
+    ${'composer:2.9.8@sha256:' + 'b'.repeat(64)}  | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
+    ${'cs2pr:1.2.3@sha256:' + 'd'.repeat(64)}     | ${'linux'}  | ${'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V" sha256:' + 'd'.repeat(64)}
+    ${'deployer:7.5.12@sha256:' + 'e'.repeat(64)} | ${'linux'}  | ${'add_tool https://github.com/deployphp/deployer/releases/download/v7.5.12/deployer.phar,https://deployer.org/releases/v7.5.12/deployer.phar deployer "-V" sha256:' + 'e'.repeat(64)}
+    ${'phive:0.15.3@sha512:' + 'c'.repeat(128)}   | ${'darwin'} | ${'add_tool https://github.com/phar-io/phive/releases/download/0.15.3/phive-0.15.3.phar phive "status" sha512:' + 'c'.repeat(128)}
+    ${'phinx:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'linux'}  | ${'add_log "$cross" "phinx" "Checksum verification is not supported for phinx"'}
+    ${'pecl:1.2.3@sha256:' + 'a'.repeat(64)}      | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
+    ${'phpunit:9.5.0@sha256:invalid'}             | ${'linux'}  | ${'add_log "$cross" "phpunit" "Invalid sha256 checksum, expected 64 hexadecimal characters"'}
+    ${'composer:2.9.8@SHA256:' + 'b'.repeat(64)}  | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
+    ${'composer:2.9.8@sha384:' + 'b'.repeat(96)}  | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm sha384, expected sha256 or sha512"'}
+    ${'composer:2.9.8@md5:' + 'b'.repeat(32)}     | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm md5, expected sha256 or sha512"'}
+    ${'composer:2.9.8@sha256' + 'b'.repeat(64)}   | ${'linux'}  | ${'add_log "$cross" "composer" "Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>"'}
  `(
    'checking addTools with checksum: $tools_csv, $os',
    async ({tools_csv, os, script}) => {
@@ -948,26 +982,14 @@ describe('Tools tests', () => {
      }
    });

-    let result: string = '';
-    await jest.isolateModulesAsync(async () => {
-      jest.doMock('fs', () => ({
-        ...jest.requireActual('fs'),
-        readFileSync: (
-          filePath: fs.PathOrFileDescriptor,
-          options?: unknown
-        ) => {
-          if (String(filePath).includes('tools.json')) {
-            return brokenToolsJson;
-          }
-          return (jest.requireActual('fs') as typeof fs).readFileSync(
-            filePath,
-            options as fs.ObjectEncodingOptions & {flag?: string}
-          );
-        }
-      }));
-      const isolatedTools = jest.requireActual<typeof tools>('../src/tools');
-      result = await isolatedTools.addTools('broken-tool', '7.4', 'linux');
+    const readFileSync = fs.readFileSync;
+    jest.spyOn(fs, 'readFileSync').mockImplementation((filePath, options) => {
+      if (String(filePath).includes('tools.json')) {
+        return brokenToolsJson;
+      }
+      return readFileSync(filePath, options);
    });
+    const result = await tools.addTools('broken-tool', '7.4', 'linux');

    expect(result).toContain(
      'add_log "$cross" "broken-tool" "broken-tool has no function defined. Please report this issue."'
@@ -1,9 +1,13 @@
+import {fileURLToPath} from 'url';
+import {jest} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
-import {spawnSync} from 'child_process';
 import * as path from 'path';
-import * as utils from '../src/utils';
-import * as fetchModule from '../src/fetch';
+const fetchMock = jest.fn<typeof import('../src/fetch.js').fetch>();
+jest.unstable_mockModule('../src/fetch.js', () => ({fetch: fetchMock}));
+const utils = await import('../src/utils.js');
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));

 describe('Utils tests', () => {
  it('checking readEnv', async () => {
@@ -41,9 +45,9 @@ describe('Utils tests', () => {
  });

  it('checking parseVersion', async () => {
-    const fetchSpy = jest.spyOn(fetchModule, 'fetch').mockResolvedValue({
+    const fetchSpy = fetchMock.mockResolvedValue({
      data: fs.readFileSync(
-        path.join(__dirname, '../src/configs/php-versions.json'),
+        path.join(dirname, '../src/configs/php-versions.json'),
        'utf8'
      )
    });
@@ -54,6 +58,9 @@ describe('Utils tests', () => {
    expect(await utils.parseVersion('8.7.0')).toBe('8.7');
    expect(await utils.parseVersion('7')).toBe('7.0');
    expect(await utils.parseVersion('7.4')).toBe('7.4');
+    expect(await utils.parseVersion('8.10')).toBe('8.10');
+    expect(await utils.parseVersion('10')).toBe('10.0');
+    expect(await utils.parseVersion('10.0')).toBe('10.0');
    expect(await utils.parseVersion('5.x')).toBe('5.6');
    expect(await utils.parseVersion('pre')).toBe('pre');
    expect(await utils.parseVersion('pre-installed')).toBe('pre');
@@ -325,8 +332,8 @@ describe('Utils tests', () => {
      "Could not find '.phpenv-version' file."
    );

-    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
-    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+    const existsSync = jest.spyOn(fs, 'existsSync').mockReturnValue(false);
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockReturnValue('');

    existsSync.mockReturnValue(true);
    readFileSync.mockReturnValue('8.1');
@@ -392,8 +399,8 @@ describe('Utils tests', () => {
  });

  it('readPHPVersion rejects unsupported values from each source', async () => {
-    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
-    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+    const existsSync = jest.spyOn(fs, 'existsSync').mockReturnValue(false);
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockReturnValue('');

    process.env['php-version'] = '$0';
    await expect(utils.readPHPVersion()).rejects.toThrow('php-version input');
@@ -447,20 +454,8 @@ describe('Utils tests', () => {
  });
 });

-const hasPwsh =
-  spawnSync('pwsh', ['-NoProfile', '-Command', 'exit 0']).status === 0;
-const scripts = path.join(__dirname, '../src/scripts');
-const unixInit = fs.readFileSync(path.join(scripts, 'unix.sh'), 'utf8');
-const windowsSource = fs.readFileSync(path.join(scripts, 'win32.ps1'), 'utf8');
-const windowsInit = [
-  windowsSource.match(/Function Invoke-WithoutTrace[\s\S]*?\n}/)![0],
-  windowsSource.match(
-    /\$setup_php_trace = 0\r?\nif \(\$env:SETUP_PHP_TRACE[\s\S]*?\n}/
-  )![0]
-].join('\n');
-
 describe.each(['linux', 'darwin', 'win32'])(
-  'Verbose scripts on %s',
+  'Verbose script preparation on %s',
  platform => {
    let root: string;
    let run: string;
@@ -473,19 +468,12 @@ describe.each(['linux', 'darwin', 'win32'])(
      const scripts = path.join(root, 'src', 'scripts');
      const extension = platform === 'win32' ? '.ps1' : '.sh';
      fs.mkdirSync(path.join(scripts, 'tools'), {recursive: true});
-      const init = path.join(scripts, 'init' + extension);
-      fs.writeFileSync(
-        init,
-        platform === 'win32'
-          ? windowsInit
-          : unixInit + '\nrunner=self-hosted read_env\n'
-      );
      helper = path.join(scripts, 'tools', 'helper' + extension);
      run = path.join(scripts, 'run' + extension);
      fs.writeFileSync(helper, 'echo helper-output\n');
      fs.writeFileSync(
        run,
-        `. '${init}'\n. '${helper}' ${platform === 'win32' ? '>$null' : '>/dev/null'} 2>&1\n`
+        `. '${helper}' ${platform === 'win32' ? '>$null' : '>/dev/null'} 2>&1\n`
      );
      delete process.env.verbose;
      delete process.env.VERBOSE;
@@ -516,22 +504,6 @@ describe.each(['linux', 'darwin', 'win32'])(
          tracing ? String(verbose!.length - 1) : '0'
        );
        expect(fs.readFileSync(run, 'utf8')).toBe(original);
-        if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
-          const result = spawnSync(
-            platform === 'win32' ? 'pwsh' : 'bash',
-            platform === 'win32'
-              ? ['-NoProfile', '-File', prepared]
-              : [prepared],
-            {encoding: 'utf8', env: process.env}
-          );
-          expect(result.status).toBe(0);
-          expect(/helper-output\r?\n/.test(result.stdout)).toBe(enabled);
-          expect(
-            platform === 'win32'
-              ? result.stdout.includes('DEBUG:')
-              : result.stderr.includes('+ ')
-          ).toBe(tracing);
-        }
      }
    );

@@ -556,18 +528,6 @@ describe.each(['linux', 'darwin', 'win32'])(
          `echo nested-output ${platform === 'win32' ? '2>&1 | Out-Host' : ''}\n${probe}\n`
        );
        expect(fs.readFileSync(helper, 'utf8')).toContain(pipe);
-        const shell = platform === 'win32' ? 'pwsh' : 'bash';
-        if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
-          const result = spawnSync(
-            shell,
-            platform === 'win32'
-              ? ['-NoProfile', '-File', prepared]
-              : [prepared],
-            {encoding: 'utf8', env: process.env}
-          );
-          expect(result.status).toBe(0);
-          expect(result.stdout).toMatch(/nested-output\r?\n/);
-        }
        process.env.verbose = 'false';
        expect(await utils.addVerbose(run, platform)).toBe(run);
        expect(process.env.SETUP_PHP_TRACE).toBe('0');
@@ -591,277 +551,6 @@ describe.each(['linux', 'darwin', 'win32'])(
      }
    );

-    it.each(['true', 'vv', 'vvv'])(
-      'protects nested sensitive calls and restores tracing for verbose=%s',
-      async verbose => {
-        const windows = platform === 'win32';
-        if (windows ? !hasPwsh : process.platform === 'win32') return;
-        process.env.verbose = verbose;
-        process.env.GITHUB_TOKEN = 'example-github-token';
-        process.env.TRACE_TEST_OUTPUT = path.join(root, 'tokens');
-        fs.writeFileSync(
-          helper,
-          windows
-            ? `$result = 0
-try {
-  Invoke-WithoutTrace {
-    Invoke-WithoutTrace {
-      $token = $env:GITHUB_TOKEN
-      Set-Content $env:TRACE_TEST_OUTPUT $token
-    }
-    $token = $env:GITHUB_TOKEN
-    Add-Content $env:TRACE_TEST_OUTPUT $token
-    if ($env:TRACE_TEST_STATUS -ne '0') { throw 'example-failure' }
-  }
-} catch {
-  if ($_.Exception.Message -ne 'example-failure') { throw }
-  $result = [int]$env:TRACE_TEST_STATUS
-}
-$after_wrapper = 'after-wrapper'
-Write-Output $after_wrapper
-Write-Output "status=$result"
-`
-            : `inner_sensitive() {
-  token="$GITHUB_TOKEN"
-  printf '%s\\n' "$token" > "$TRACE_TEST_OUTPUT"
-  return "$TRACE_TEST_STATUS"
-}
-outer_sensitive() {
-  without_trace inner_sensitive
-  local result=$?
-  token="$GITHUB_TOKEN"
-  printf '%s\\n' "$token" >> "$TRACE_TEST_OUTPUT"
-  return "$result"
-}
-without_trace outer_sensitive
-result=$?
-echo "\${token:+state-preserved}"
-echo after-wrapper
-exit "$result"
-`
-        );
-        const prepared = await utils.addVerbose(run, platform);
-        for (const status of [0, 37]) {
-          const result = spawnSync(
-            windows ? 'pwsh' : 'bash',
-            windows ? ['-NoProfile', '-File', prepared] : [prepared],
-            {
-              encoding: 'utf8',
-              env: {...process.env, TRACE_TEST_STATUS: String(status)}
-            }
-          );
-          expect(result.status).toBe(windows ? 0 : status);
-          expect(result.stdout + result.stderr).not.toContain(
-            'example-github-token'
-          );
-          expect(result.stdout).toContain('after-wrapper');
-          expect(
-            windows
-              ? /DEBUG:.*Write-Output \$after_wrapper/.test(result.stdout)
-              : result.stderr.includes('+ echo after-wrapper')
-          ).toBe(verbose !== 'true');
-          if (windows) {
-            expect(result.stdout).toContain('status=' + status);
-            expect(/DEBUG:\s+!\s+SET \$after_wrapper/.test(result.stdout)).toBe(
-              verbose === 'vvv'
-            );
-          } else {
-            expect(result.stdout).toContain('state-preserved');
-          }
-          expect(
-            fs
-              .readFileSync(process.env.TRACE_TEST_OUTPUT!, 'utf8')
-              .trim()
-              .split(/\r?\n/)
-          ).toEqual(['example-github-token', 'example-github-token']);
-        }
-      }
-    );
-
-    it.each(['true', 'vv', 'vvv'])(
-      'keeps Blackfire credentials out of traces for verbose=%s',
-      async verbose => {
-        const windows = platform === 'win32';
-        if (windows ? !hasPwsh : process.platform === 'win32') return;
-        process.env.verbose = verbose;
-        process.env.TRACE_TEST_OUTPUT = path.join(root, 'blackfire-config');
-        process.env.BLACKFIRE_SERVER_ID = 'example-blackfire-server-id';
-        process.env.BLACKFIRE_SERVER_TOKEN = 'example-blackfire-server-token';
-        process.env.BLACKFIRE_CLIENT_ID = 'example-blackfire-client-id';
-        process.env.BLACKFIRE_CLIENT_TOKEN = 'example-blackfire-client-token';
-        fs.writeFileSync(
-          helper,
-          fs.readFileSync(
-            path.join(
-              scripts,
-              'tools',
-              'blackfire' + (windows ? '.ps1' : '.sh')
-            ),
-            'utf8'
-          ) +
-            (windows
-              ? `
-function Invoke-RestMethod { @{cli='1.2.3'} }
-function Get-File {}
-function Expand-Archive {}
-function Add-ToProfile {}
-function Add-Log {}
-function blackfire { Add-Content $env:TRACE_TEST_OUTPUT ($args -join ' ') }
-$version = '8.4'
-$bin_dir = 'unused'
-Add-Blackfire
-Write-Output after-blackfire
-`
-              : `
-blackfire() { printf '%s\\n' "$@" >> "$TRACE_TEST_OUTPUT"; }
-os=Test
-blackfire_config
-echo after-blackfire
-`)
-        );
-        const prepared = await utils.addVerbose(run, platform);
-        const result = spawnSync(
-          windows ? 'pwsh' : 'bash',
-          windows ? ['-NoProfile', '-File', prepared] : [prepared],
-          {encoding: 'utf8', env: process.env}
-        );
-        expect(result.status).toBe(0);
-        expect(result.stdout + result.stderr).not.toContain(
-          'example-blackfire-'
-        );
-        expect(result.stdout).toContain('after-blackfire');
-        expect(
-          windows
-            ? /DEBUG:.*Write-Output after-blackfire/.test(result.stdout)
-            : result.stderr.includes('+ echo after-blackfire')
-        ).toBe(verbose !== 'true');
-        const config = fs.readFileSync(process.env.TRACE_TEST_OUTPUT!, 'utf8');
-        for (const value of [
-          'server-id',
-          'server-token',
-          'client-id',
-          'client-token'
-        ]) {
-          expect(config).toContain('example-blackfire-' + value);
-        }
-      }
-    );
-
-    it('keeps Composer credentials out of traces and resumes tracing', async () => {
-      if (platform === 'win32' ? !hasPwsh : process.platform === 'win32')
-        return;
-      process.env.verbose = 'vvv';
-      process.env.GITHUB_TOKEN = 'example-github-token';
-      process.env.COMPOSER_TOKEN = 'example-composer-token';
-      process.env.PACKAGIST_TOKEN = 'example-packagist-token';
-      process.env.COMPOSER_AUTH_JSON =
-        '{"bearer":{"example.org":"example-json-token"}}';
-      process.env.GITHUB_SERVER_URL = 'https://github.com';
-      const windows = platform === 'win32';
-      const source = fs.readFileSync(
-        path.join(scripts, 'tools', 'add_tools' + (windows ? '.ps1' : '.sh')),
-        'utf8'
-      );
-      fs.writeFileSync(
-        helper,
-        source +
-          (windows
-            ? `\n$composer_home='${root}'\nSet-ComposerAuth\nWrite-Output after-auth\n`
-            : `\ncomposer_home='${root}'\nset_composer_auth\necho after-auth\n`)
-      );
-      const prepared = await utils.addVerbose(run, platform);
-      const result = spawnSync(
-        windows ? 'pwsh' : 'bash',
-        windows ? ['-NoProfile', '-File', prepared] : [prepared],
-        {encoding: 'utf8', env: process.env}
-      );
-      expect(result.status).toBe(0);
-      expect(result.stdout + result.stderr).not.toMatch(
-        /example-(github|composer|packagist|json)-token/
-      );
-      expect(windows ? result.stdout : result.stderr).toMatch(
-        windows ? /DEBUG:.*Write-Output after-auth/ : /\+ echo after-auth/
-      );
-      const auth = JSON.parse(
-        fs.readFileSync(path.join(root, 'auth.json'), 'utf8')
-      );
-      expect(auth['github-oauth']['github.com']).toBe('example-composer-token');
-      expect(auth['http-basic']['repo.packagist.com'].password).toBe(
-        'example-packagist-token'
-      );
-      expect(auth.bearer['example.org']).toBe('example-json-token');
-    });
-
-    if (platform !== 'win32') {
-      (process.platform === 'win32' ? it.skip : it).each([
-        ['exit 37', 37],
-        ['set -e\nfalse', 1]
-      ])('preserves shell termination for %s', async (failure, status) => {
-        process.env.verbose = 'vvv';
-        process.env.GITHUB_TOKEN = 'example-github-token';
-        fs.writeFileSync(
-          helper,
-          `
-sensitive_failure() {
-  token="$GITHUB_TOKEN"
-  ${failure}
-  echo should-not-run
-}
-trap 'echo cleanup' EXIT
-without_trace sensitive_failure
-echo should-not-run
-`
-        );
-        const prepared = await utils.addVerbose(run, platform);
-        const result = spawnSync('bash', [prepared], {
-          encoding: 'utf8',
-          env: process.env
-        });
-        expect(result.status).toBe(status);
-        expect(result.stdout).toBe('cleanup\n');
-        expect(result.stdout + result.stderr).not.toContain(
-          'example-github-token'
-        );
-      });
-
-      (process.platform === 'win32' ? it.skip : it).each(['true', 'vv', 'vvv'])(
-        'protects Relay credentials and preserves tracing and status for verbose=%s',
-        async verbose => {
-          process.env.verbose = verbose;
-          const ini = path.join(root, 'relay.ini');
-          fs.writeFileSync(
-            helper,
-            fs.readFileSync(path.join(scripts, 'extensions/relay.sh'), 'utf8') +
-              '\nsudo() { if [ "$1" = rm ]; then return "$RELAY_TEST_STATUS"; fi; "$@"; }\n' +
-              `init_relay_ini '${ini}'\nrelay_status=$?\necho after-relay\nexit "$relay_status"\n`
-          );
-          const prepared = await utils.addVerbose(run, platform);
-          for (const status of [0, 37]) {
-            fs.writeFileSync(ini, '; relay.key =\n');
-            const result = spawnSync('bash', [prepared], {
-              encoding: 'utf8',
-              env: {
-                ...process.env,
-                RELAY_KEY: 'example-relay-key',
-                RELAY_TEST_STATUS: String(status)
-              }
-            });
-            expect(result.status).toBe(status);
-            expect(result.stdout + result.stderr).not.toContain(
-              'example-relay-key'
-            );
-            expect(result.stdout).toContain('after-relay');
-            expect(result.stderr.includes('+ echo after-relay')).toBe(
-              verbose !== 'true'
-            );
-            expect(fs.readFileSync(ini, 'utf8')).toBe(
-              'relay.key = example-relay-key\n'
-            );
-          }
-        }
-      );
-    }
-
    (process.platform === 'win32' ? it.skip : it)(
      'uses fresh copies without writing through source symlinks',
      async () => {
@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}
@@ -1,5 +1,5 @@
+import {createRequire} from 'node:module';
 import typescriptEslint from '@typescript-eslint/eslint-plugin';
-import {importX} from 'eslint-plugin-import-x';
 import jest from 'eslint-plugin-jest';
 import prettierRecommended from 'eslint-plugin-prettier/recommended';
 import eslintConfigPrettier from 'eslint-config-prettier';
@@ -7,6 +7,11 @@ import globals from 'globals';
 import tsParser from '@typescript-eslint/parser';
 import js from '@eslint/js';

+// Until import-x supports minimatch 11, use its CommonJS entry point to avoid
+// the removed makeRe import in no-internal-modules, unused by these presets.
+// https://github.com/un-ts/eslint-plugin-import-x/pull/570
+const {importX} = createRequire(import.meta.url)('eslint-plugin-import-x');
+
 export default [
  js.configs.recommended,
  ...typescriptEslint.configs['flat/recommended'],
@@ -1,11 +1,15 @@
-module.exports = {
+export default {
  clearMocks: true,
  moduleFileExtensions: ['js', 'ts'],
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
  testEnvironment: 'node',
  testMatch: ['**/*.test.ts'],
  testRunner: 'jest-circus/runner',
  transform: {
-    '^.+\\.ts$': ['ts-jest', {tsconfig: 'tsconfig.test.json'}]
+    '^.+\\.ts$': ['ts-jest', {tsconfig: 'tsconfig.test.json', useESM: true}]
  },
  verbose: true,
  collectCoverage: true
@@ -1,8 +1,9 @@
 {
  "name": "setup-php",
-  "version": "2.40.0-beta",
+  "version": "2.40.1",
  "private": false,
  "description": "Setup PHP for use with GitHub Actions",
+  "type": "module",
  "main": "lib/install.js",
  "types": "lib/install.d.ts",
  "directories": {
@@ -21,7 +22,7 @@
    "format-check": "prettier --check **/src/*.ts **/__tests__/*.ts",
    "release": "ncc build -m -o dist && git add -f dist/",
    "typecheck": "tsc --project tsconfig.test.json --noEmit",
-    "test": "jest"
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
  },
  "repository": {
    "type": "git",
@@ -35,39 +36,37 @@
  "author": "shivammathur",
  "license": "MIT",
  "dependencies": {
-    "@actions/exec": "^2.0.0",
+    "@actions/exec": "^3.0.0",
    "compare-versions": "^6.1.1"
  },
  "devDependencies": {
    "@eslint/compat": "^2.1.1",
    "@eslint/js": "^10.0.1",
    "@types/jest": "^30.0.0",
-    "@types/node": "^26.6.2",
-    "@typescript-eslint/eslint-plugin": "^8.70.0",
-    "@typescript-eslint/parser": "^8.70.0",
+    "@types/node": "^26.6.6",
+    "@typescript-eslint/eslint-plugin": "^8.72.1",
+    "@typescript-eslint/parser": "^8.72.1",
    "@typescript/native": "npm:typescript@^7.0.2",
    "@vercel/ncc": "^0.45.0",
-    "eslint": "^10.11.0",
+    "eslint": "^10.14.0",
    "eslint-config-prettier": "^10.1.8",
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jest": "^29.16.6",
-    "eslint-plugin-prettier": "^5.5.6",
-    "globals": "^17.12.0",
+    "eslint-plugin-jest": "^29.17.0",
+    "eslint-plugin-prettier": "^5.5.7",
+    "globals": "^17.14.0",
    "jest": "^30.5.2",
    "jest-circus": "^30.5.2",
-    "nock": "^14.0.17",
-    "prettier": "^3.9.8",
+    "nock": "^15.0.5",
+    "prettier": "^3.9.10",
    "simple-git-hooks": "^2.14.0",
-    "ts-jest": "^29.4.12",
+    "ts-jest": "^29.4.15",
    "typescript": "npm:@typescript/typescript6@^6.0.2"
  },
  "overrides": {
-    "@babel/core": "^7.29.7",
-    "js-yaml": "^4.2.0",
-    "test-exclude": "^7.0.1",
-    "glob": "^13.0.6",
-    "minimatch": "^10.2.1"
+    "deepmerge": "npm:@shivammathur/deepmerge@4.3.2",
+    "glob": "^14.0.3",
+    "minimatch": "^11.0.3"
  },
  "bugs": {
    "url": "https://github.com/shivammathur/setup-php/issues"
@@ -76,8 +75,9 @@
    "pre-commit": "npm run format && npm run lint && npm run test && npm run build && npm run release"
  },
  "allowScripts": {
+    "@parcel/watcher@2.6.0": true,
    "fsevents@2.3.3": true,
-    "simple-git-hooks@2.13.1": true,
-    "unrs-resolver@1.11.1": true
+    "simple-git-hooks@2.14.0": true,
+    "unrs-resolver@1.12.2": true
  }
 }
@@ -1,4 +1,4 @@
-import * as utils from './utils';
+import * as utils from './utils.js';

 /**
 * Add script to set custom ini values for unix
@@ -3,21 +3,77 @@
    {
      "owner": "phpunit",
      "pattern": [
-        {
-          "regexp": "^\\d+\\)\\s.*$"
-        },
-        {
-          "regexp": "^(.*Failed\\sasserting\\sthat.*)$",
-          "message": 1
-        },
-        {
-          "regexp": "^\\s*$"
-        },
-        {
-          "regexp": "^(.*):(\\d+)$",
-          "file": 1,
-          "line": 2
-        }
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(.*Failed\\sasserting\\sthat.*)$", "message": 1 },
+        { "regexp": "^\\s*$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-no-blank",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(.*Failed\\sasserting\\sthat.*)$", "message": 1 },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-custom-message",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^.*Failed\\sasserting\\sthat.*$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-custom-message-blank",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^.*Failed\\sasserting\\sthat.*$" },
+        { "regexp": "^\\s*$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-other-blank",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^(?:\\s*|[-+@ ].*)$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-other",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-warning",
+      "severity": "warning",
+      "pattern": [
+        { "regexp": "^There (?:was|were) \\d+ (?:(?:risky|skipped) tests?(?: suites?)?|(?:PHPUnit(?: test runner)? )?warnings?):$" },
+        { "regexp": "^(?:(\\s*(/.*|[A-Za-z]:[\\\\/].*):(\\d+)|(?!-+$|There (?:was|were) \\d+ .+:$|\\d+ tests? triggered \\d+ .+:$|OK(?: \\(\\d+ tests?, \\d+ assertions?\\)|, but (?:there were issues|some tests were skipped|incomplete, skipped, or risky tests)!)$|(?:FAILURES|ERRORS|WARNINGS)!$|Tests: \\d+(?:,|\\.?$)|PHPUnit \\d+\\.\\S+ by |Triggered by:$).*)|Triggered by:)$", "message": 1, "file": 2, "line": 3, "loop": true }
+      ]
+    },
+    {
+      "owner": "phpunit-notice",
+      "severity": "notice",
+      "pattern": [
+        { "regexp": "^There (?:was|were) \\d+ (?:incomplete tests?(?: suites?)?|(?:PHPUnit(?: test runner)? )?notices?):$" },
+        { "regexp": "^(?:(\\s*(/.*|[A-Za-z]:[\\\\/].*):(\\d+)|(?!-+$|There (?:was|were) \\d+ .+:$|\\d+ tests? triggered \\d+ .+:$|OK(?: \\(\\d+ tests?, \\d+ assertions?\\)|, but (?:there were issues|some tests were skipped|incomplete, skipped, or risky tests)!)$|(?:FAILURES|ERRORS|WARNINGS)!$|Tests: \\d+(?:,|\\.?$)|PHPUnit \\d+\\.\\S+ by |Triggered by:$).*)|Triggered by:)$", "message": 1, "file": 2, "line": 3, "loop": true }
+      ]
+    },
+    {
+      "owner": "phpunit-issue",
+      "pattern": [
+        { "regexp": "^\\d+ tests? triggered \\d+ (?:PHP(?:Unit)? )?(error|warning|notice)s?:$", "severity": 1 },
+        { "regexp": "^(?:\\d+\\)\\s)?(?:(\\s*(/.*|[A-Za-z]:[\\\\/].*):(\\d+)|(?!-+$|There (?:was|were) \\d+ .+:$|\\d+ tests? triggered \\d+ .+:$|OK(?: \\(\\d+ tests?, \\d+ assertions?\\)|, but (?:there were issues|some tests were skipped|incomplete, skipped, or risky tests)!)$|(?:FAILURES|ERRORS|WARNINGS)!$|Tests: \\d+(?:,|\\.?$)|PHPUnit \\d+\\.\\S+ by |Triggered by:$).*)|Triggered by:)$", "message": 1, "file": 2, "line": 3, "loop": true }
      ]
    }
  ]
@@ -153,12 +153,17 @@
    "version_parameter": "-V"
  },
  "phpstan": {
-    "type": "phar",
+    "type": "composer",
    "repository": "phpstan/phpstan",
-    "extension": ".phar",
-    "domain": "https://github.com",
-    "version_prefix": "",
-    "version_parameter": "-V"
+    "scope": "scoped",
+    "fallback": {
+      "type": "phar",
+      "repository": "phpstan/phpstan",
+      "extension": ".phar",
+      "domain": "https://github.com",
+      "version_prefix": "",
+      "version_parameter": "-V"
+    }
  },
  "pie": {
    "type": "phar",
@@ -1,5 +1,5 @@
 {
-  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/shivammathur/setup-php/develop/src/configs/tools_schema.json",
  "type": "object",
  "title": "Tools",
@@ -14,123 +14,161 @@
        "function": "function_name",
        "repository": "user/tool",
        "packagist": "user/tool",
-        "scope": "global, scoped",
-        "type": "phar, composer, custom-package or custom-function",
+        "scope": "scoped",
+        "type": "composer",
        "version_parameter": "--version",
-        "version_prefix": "v"
+        "version_prefix": "v",
+        "fallback": {
+          "type": "phar",
+          "repository": "user/tool",
+          "domain": "https://github.com",
+          "extension": ".phar",
+          "version_prefix": "v",
+          "version_parameter": "--version"
+        }
      }
    }
  ],
-  "items": {
-    "properties": {
-      "alias": {
-        "$id": "#/items/properties/alias",
-        "type": "string",
-        "title": "The alias schema",
-        "description": "Alias for a tool.",
-        "examples": [
-          "tool_alias"
-        ]
+  "additionalProperties": {
+    "$ref": "#/$defs/tool"
+  },
+  "$defs": {
+    "tool": {
+      "type": "object",
+      "properties": {
+        "alias": {
+          "type": "string",
+          "title": "The alias schema",
+          "description": "Alias for a tool.",
+          "examples": [
+            "tool_alias"
+          ]
+        },
+        "domain": {
+          "type": "string",
+          "title": "The domain schema",
+          "description": "Domain URL of the tool.",
+          "examples": [
+            "https://example.com"
+          ]
+        },
+        "extension": {
+          "type": "string",
+          "title": "The extension schema",
+          "description": "File extension of the tool.",
+          "examples": [
+            ".ext"
+          ]
+        },
+        "fetch_latest": {
+          "type": "string",
+          "title": "The fetch_latest schema",
+          "description": "Fetch the latest version from GitHub releases.",
+          "enum": [
+            "true",
+            "false"
+          ]
+        },
+        "function": {
+          "type": "string",
+          "title": "The function schema",
+          "description": "Function name in tools.ts which returns the script to setup the tool.",
+          "examples": [
+            "function_name"
+          ]
+        },
+        "repository": {
+          "type": "string",
+          "title": "The repository schema",
+          "description": "GitHub repository of the tool.",
+          "examples": [
+            "user/tool"
+          ]
+        },
+        "packagist": {
+          "type": "string",
+          "title": "The repository schema",
+          "description": "Packagist repository of the tool in case different from repository.",
+          "examples": [
+            "user/tool"
+          ]
+        },
+        "scope": {
+          "type": "string",
+          "title": "The scope schema",
+          "description": "Scope of tool installation: global or scoped",
+          "enum": [
+            "global",
+            "scoped"
+          ]
+        },
+        "type": {
+          "type": "string",
+          "title": "The type schema",
+          "description": "Type of tool: phar, composer, custom-package or custom-function.",
+          "enum": [
+            "phar",
+            "composer",
+            "custom-package",
+            "custom-function"
+          ]
+        },
+        "version_parameter": {
+          "type": "string",
+          "title": "The version_parameter schema",
+          "description": "Parameter to get the tool version.",
+          "examples": [
+            "--version"
+          ]
+        },
+        "version_prefix": {
+          "type": "string",
+          "title": "The version_prefix schema",
+          "description": "Prefix of the version in the download URL.",
+          "examples": [
+            "v"
+          ]
+        },
+        "fallback": {
+          "$ref": "#/$defs/pharFallback"
+        }
      },
-      "domain": {
-        "$id": "#/items/properties/domain",
-        "type": "string",
-        "title": "The domain schema",
-        "description": "Domain URL of the tool.",
-        "examples": [
-          "https://example.com"
-        ]
-      },
-      "extension": {
-        "$id": "#/items/properties/extension",
-        "type": "string",
-        "title": "The extension schema",
-        "description": "File extension of the tool.",
-        "examples": [
-          ".ext"
-        ]
-      },
-      "fetch_latest": {
-        "$id": "#/items/properties/fetch_latest",
-        "type": "string",
-        "title": "The fetch_latest schema",
-        "description": "Fetch the latest version from GitHub releases.",
-        "enum": [
-          "true",
-          "false"
-        ]
-      },
-      "function": {
-        "$id": "#/items/properties/function",
-        "type": "string",
-        "title": "The function schema",
-        "description": "Function name in tools.ts which returns the script to setup the tool.",
-        "examples": [
-          "function_name"
-        ]
-      },
-      "repository": {
-        "$id": "#/items/properties/repository",
-        "type": "string",
-        "title": "The repository schema",
-        "description": "GitHub repository of the tool.",
-        "examples": [
-          "user/tool"
-        ]
-      },
-      "packagist": {
-        "$id": "#/items/properties/packagist",
-        "type": "string",
-        "title": "The repository schema",
-        "description": "Packagist repository of the tool in case different from repository.",
-        "examples": [
-          "user/tool"
-        ]
-      },
-      "scope": {
-        "$id": "#/items/properties/scope",
-        "type": "string",
-        "title": "The scope schema",
-        "description": "Scope of tool installation: global or scoped",
-        "enum": [
-          "global",
-          "scoped"
-        ]
-      },
-      "type": {
-        "$id": "#/items/properties/type",
-        "type": "string",
-        "title": "The type schema",
-        "description": "Type of tool: phar, composer, custom-package or custom-function.",
-        "enum": [
-          "phar",
-          "composer",
-          "custom-package",
-          "custom-function"
-        ]
-      },
-      "version_parameter": {
-        "$id": "#/items/properties/version_parameter",
-        "type": "string",
-        "title": "The version_parameter schema",
-        "description": "Parameter to get the tool version.",
-        "examples": [
-          "--version"
-        ]
-      },
-      "version_prefix": {
-        "$id": "#/items/properties/version_prefix",
-        "type": "string",
-        "title": "The version_prefix schema",
-        "description": "Prefix of the version in the download URL.",
-        "examples": [
-          "v"
-        ]
-      }
+      "required": [
+        "type"
+      ],
+      "additionalProperties": true
    },
-    "required": [
-      "type"
-    ],
-    "additionalProperties": true
+    "pharFallback": {
+      "type": "object",
+      "title": "The fallback schema",
+      "description": "PHAR installation settings used when Composer installation fails.",
+      "properties": {
+        "type": {
+          "const": "phar"
+        },
+        "repository": {
+          "$ref": "#/$defs/tool/properties/repository"
+        },
+        "domain": {
+          "$ref": "#/$defs/tool/properties/domain"
+        },
+        "extension": {
+          "$ref": "#/$defs/tool/properties/extension"
+        },
+        "fetch_latest": {
+          "$ref": "#/$defs/tool/properties/fetch_latest"
+        },
+        "version_parameter": {
+          "$ref": "#/$defs/tool/properties/version_parameter"
+        },
+        "version_prefix": {
+          "$ref": "#/$defs/tool/properties/version_prefix"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": false
+    }
  }
-}
+}
@@ -1,6 +1,6 @@
-import * as utils from './utils';
-import * as extensions from './extensions';
-import * as config from './config';
+import * as utils from './utils.js';
+import * as extensions from './extensions.js';
+import * as config from './config.js';

 export async function checkXdebugError(
  extension: string,
@@ -1,4 +1,4 @@
-import * as utils from './utils';
+import * as utils from './utils.js';

 /**
 * Install and enable extensions for darwin
@@ -180,7 +180,7 @@ export async function addExtensionWindows(
        add_script += await utils.joins(
          '\nAdd-Extension',
          ext_name,
-          ext_version.replace('stable', '')
+          ext_version
        );
        break;
      // match extensions for compiling from source
@@ -1,12 +1,15 @@
+import {fileURLToPath} from 'url';
 import path from 'path';
-import fs from 'fs';
 import {exec} from '@actions/exec';
-import * as config from './config';
-import * as core from './core';
-import * as coverage from './coverage';
-import * as extensions from './extensions';
-import * as tools from './tools';
-import * as utils from './utils';
+import fs from 'fs';
+import * as config from './config.js';
+import * as core from './core.js';
+import * as coverage from './coverage.js';
+import * as extensions from './extensions.js';
+import * as tools from './tools.js';
+import * as utils from './utils.js';
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));

 /**
 * Build the script
@@ -16,7 +19,7 @@ import * as utils from './utils';
 export async function getScript(os: string): Promise<string> {
  const url = 'https://setup-php.com/sponsor';
  const filename = os + (await utils.scriptExtension(os));
-  const script_path = path.join(__dirname, '../src/scripts', filename);
+  const script_path = path.join(dirname, '../src/scripts', filename);
  const run_path = script_path.replace(os, 'run');
  const extension_csv: string = utils.sanitizeShellInput(
    await utils.getInput('extensions', false),
@@ -1,5 +1,5 @@
 import * as cv from 'compare-versions';
-import * as fetch from './fetch';
+import * as fetch from './fetch.js';

 type RS = Record<string, string>;
 type RSRS = Record<string, RS>;
@@ -168,8 +168,12 @@ patch_brew() {
 # Function to update dependencies.
 update_dependencies() {
  if ! [ -e /tmp/update_dependencies ]; then
-    for repo in "$brew_repo" "${core_repo:?}"; do
-      if [ -e "$repo" ]; then
+    local repos=("$brew_repo")
+    if [ -n "${HOMEBREW_NO_INSTALL_FROM_API:-}" ]; then
+      repos+=("${core_repo:?}")
+    fi
+    for repo in "${repos[@]}"; do
+      if [ -d "$repo" ]; then
        git_retry -C "$repo" fetch origin main && git -C "$repo" reset --hard origin/main || return $?
      fi
    done
@@ -199,20 +203,26 @@ setup_cached_versions() {

 # Function to setup PHP 5.6 and newer using Homebrew.
 add_php() {
-  local exit_code
+  local exit_code php_alias
  action=$1
  existing_version=$2
  suffix="$(get_php_formula_suffix)"
  php_keg="php@$version$suffix"
  php_formula="shivammathur/php/$php_keg"
  if [[ "$existing_version" = "false" || -n "$suffix" || "$action" = "upgrade" ]]; then
-    if [ "$(uname -m)" = "x86_64" ] || { [ "${runner:?}" != "self-hosted" ] && [ "${use_package_cache:-true}" != "false" ]; }; then
+    if [ "$(uname -m)" = "x86_64" ] || { [ "${runner:?}" != "self-hosted" ] && [ "${use_builds_cache:-true}" != "false" ]; }; then
      setup_cached_versions && return 0
      [ "$(uname -m)" != "x86_64" ] || return 1
    fi
    update_dependencies
    add_brew_tap "$php_tap"
  fi
+  # Resolve PHP aliases before invoking brew to avoid scanning unrelated installed formulae.
+  php_alias="$tap_dir/$php_tap/Aliases/$php_keg"
+  if [ -L "$php_alias" ]; then
+    php_keg="$(basename "$(readlink "$php_alias")" .rb)"
+    php_formula="shivammathur/php/$php_keg"
+  fi
  if [[ "$existing_version" != "false" && -z "$suffix" ]]; then
    if [ "$action" = "upgrade" ]; then
      safe_brew install --only-dependencies "$php_formula" || return $?
@@ -335,7 +345,6 @@ export HOMEBREW_NO_AUTO_UPDATE=1
 export HOMEBREW_NO_ENV_HINTS=1
 export HOMEBREW_NO_INSTALL_CLEANUP=1
 export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
-export HOMEBREW_NO_INSTALL_FROM_API=1

 # shellcheck source=.
 . "${scripts:?}"/unix.sh
@@ -104,6 +104,7 @@ Function Add-Extension {
    [string]
    $extension_version = ''
  )
+  $minimum_stability_requested = $PSBoundParameters.ContainsKey('stability') -and $extension_version -eq ''
  $extension_backup = ''
  $restore_startup_errors = $false
  try {
@@ -115,7 +116,7 @@ Function Add-Extension {
      $extension_info = Get-PhpExtension -Path $php_dir | Where-Object { $_.Name -eq $extension -or $_.Handle -eq $extension }
    }
    # Only suppress startup errors while probing a cached DLL or replacing an installed DLL.
-    if($cached -or ($extension_version -ne '' -and $extension_info.Version -ne $extension_version -and (Test-Path "$ext_dir\php_$extension.dll"))) {
+    if($cached -or (($minimum_stability_requested -or ($extension_version -ne '' -and $extension_info.Version -ne $extension_version)) -and (Test-Path "$ext_dir\php_$extension.dll"))) {
      $startup_errors = Get-PhpIniKey -Key display_startup_errors -Path "$php_dir\php.ini"
      if($startup_errors -notmatch '^(0|off|false|no)$') {
        $restore_startup_errors = $true
@@ -147,7 +148,7 @@ Function Add-Extension {
      Remove-Item "$ext_dir\php_$extension.dll" -Force
      $extension_info = $null
    }
-    if ($null -ne $extension_info -and ($extension_version -eq '' -or $extension_info.Version -eq $extension_version)) {
+    if ($null -ne $extension_info -and ($extension_info.State -eq 'Builtin' -or (-not $minimum_stability_requested -and ($extension_version -eq '' -or $extension_info.Version -eq $extension_version)))) {
      switch ($extension_info.State) {
        'Builtin' {
          Add-Log $tick $extension "Enabled"
@@ -169,8 +170,9 @@ Function Add-Extension {
        if ($version -match '8.[1-4]' -and $stability -eq 'stable') {
          $minimumStability = 'snapshot'
        }
+        $maximumStability = if ($extension_version -eq '') { 'stable' } else { $stability }

-        $params = @{ Extension = $extension; MinimumStability = $minimumStability; MaximumStability = $stability; Path = $php_dir; AdditionalFilesPath = $deps_dir; NoDependencies = $true }
+        $params = @{ Extension = $extension; MinimumStability = $minimumStability; MaximumStability = $maximumStability; Path = $php_dir; AdditionalFilesPath = $deps_dir; NoDependencies = $true }
        if ($extension_version -ne '')
        {
          $params["Version"] = $extension_version
@@ -165,19 +165,27 @@ add_extension() {
 # Function to get the PECL version of an extension.
 get_pecl_version() {
  local extension=$1
-  states=("stable" "rc" "preview" "beta" "alpha" "snapshot")
-  stability="$(echo "$2" | grep -m 1 -Eio "($(IFS='|' ; echo "${states[*]}"))")"
-  IFS=' ' read -r -a states <<< "$(echo "${states[@]}" | grep -Eo "$stability.*")"
+  local requested=${2:-stable}
+  local states=("stable" "rc" "preview" "beta" "alpha" "devel" "snapshot")
+  local stability major_version response pecl_version pattern
+  response=$(get -s -n "" "https://pecl.php.net/rest/r/$extension/allreleases.xml")
+  if [[ "$requested" =~ ^[0-9] ]]; then
+    # Preserve exact pins and PECL's case-sensitive archive directory names.
+    pecl_version=$(echo "$response" | grep -Fio "<v>$requested</v>" | head -n 1 | cut -d '>' -f 2 | cut -d '<' -f 1)
+    echo "${pecl_version:-$requested}"
+    return
+  fi
+  requested="$(echo "$requested" | tr '[:upper:]' '[:lower:]')"
+  [[ " ${states[*]} " = *" $requested "* ]] || return 0
+  IFS=' ' read -r -a states <<< "$(echo "${states[@]}" | grep -Eo ".*$requested")"
+  stability="$(IFS='|' ; echo "${states[*]}")"
  major_version=${3:-'[0-9]+'}
-  pecl_rest='https://pecl.php.net/rest/r/'
-  response=$(get -s -n "" "$pecl_rest$extension"/allreleases.xml)
-  for state in "${states[@]}"; do
-    pecl_version=$(echo "$response" | grep -m 1 -Eio "($major_version\.[0-9]+\.[0-9]+${state}[0-9]+<)" | cut -d '<' -f 1)
-    [ -z "$pecl_version" ] && pecl_version=$(echo "$response" | grep -m 1 -Eio "v>(.*)<\/v>.*$state<" | grep -m 1 -Eo "($major_version\.[0-9]+\.[0-9]+.*)<" | cut -d '<' -f 1)
-    [ -n "$pecl_version" ] && break;
-  done
-  [ -z "$pecl_version" ] && pecl_version=$(echo "$response" | grep -m 1 -Eo "($major_version\.[0-9]+\.[0-9]+)<" | cut -d '<' -f 1)
-  echo "$pecl_version"
+  pattern="v>($major_version\.[0-9]+(\.[0-9]+)?)[^<]*</v>[[:space:]]*<s>($stability)<"
+  if [[ "$requested" = rc || "$requested" = preview ]]; then
+    pattern="$pattern|v>($major_version\.[0-9]+(\.[0-9]+)?)($stability)[0-9]*<"
+  fi
+  # PECL orders releases by version, so select the first acceptable state.
+  echo "$response" | grep -Eio "$pattern" | head -n 1 | cut -d '>' -f 2 | cut -d '<' -f 1
 }

 # Function to install PECL extensions and accept default options
@@ -190,7 +198,10 @@ pecl_install() {
  # Install using the source interface as it allows for patching.
  if [[ $(printf "%s\n%s" "${version:?}" "8.3" | sort -V | head -n1) != "$version" ]]; then
    extension_version=${extension##*-};
-    [ "$extension_version" = "${extension%-*}" ] &&  extension_version=$(get_pecl_version "$extension" "stable")
+    if [ "$extension_version" = "${extension%-*}" ]; then
+      extension_version=$(get_pecl_version "$extension" "stable")
+      [ -n "$extension_version" ] || return 1
+    fi
    add_extension_from_source "${extension%-*}" https://pecl.php.net "${extension%-*}" "${extension%-*}" "$extension_version" "$prefix" pecl
    check_extension "${extension%-*}" && return 0 || return 1;
  else
@@ -217,7 +228,7 @@ add_pecl_extension() {
  local extension=$1
  local pecl_version=$2
  local prefix=$3
-  if [[ $pecl_version =~ .*(alpha|beta|rc|snapshot|preview).* ]]; then
+  if [[ $pecl_version =~ (alpha|beta|rc|snapshot|preview|devel) ]]; then
    pecl_version=$(get_pecl_version "$extension" "$pecl_version")
  fi
  # Cache versioned extensions using suffixless copies in extension_dir.
@@ -234,12 +245,21 @@ add_pecl_extension() {
    [ -n "$pecl_version" ] && sudo rm -f "${ext_dir:?}/$extension-$pecl_version"
    [ -n "$pecl_version" ] && pecl_version="-$pecl_version"
    pecl_install "$extension$pecl_version" || ( [ "${fail_fast:?}" = "false" ] && add_extension "$extension" "$(get_extension_prefix "$extension")" >/dev/null 2>&1)
-    extension_version="$(php -r "echo phpversion('$extension');")"
+    if ! extension_version="$(php -d display_errors=0 -d display_startup_errors=0 -r "echo phpversion('$extension'); exit(extension_loaded('$extension') ? 0 : 1);" 2>/dev/null)"; then
+      add_log "${cross:?}" "$extension" "Could not install $extension on PHP ${semver:?}"
+      return
+    fi
+    if [ -n "$pecl_version" ] && [ "${extension_version/-/}" != "${pecl_version#-}" ]; then
+      [ "${fail_fast:?}" = "true" ] && add_log "${cross:?}" "$extension-$extension_version" "Installed and enabled, but $extension$pecl_version was requested"
+      add_log "!" "$extension-$extension_version" "Installed and enabled, but $extension$pecl_version was requested"
+      echo "::warning::Installed $extension-$extension_version, but $extension$pecl_version was requested"
+      return
+    fi
    if [ -n "$pecl_version" ] && [ "${extension_version/-/}" = "${pecl_version#-}" ]; then
-      sudo cp "${ext_dir:?}/$extension.so" "${ext_dir:?}/$extension-$extension_version" 2>/dev/null || true
+      sudo cp "${ext_dir:?}/$extension.so" "${ext_dir:?}/$extension$pecl_version" 2>/dev/null || true
    fi
    [ -n "$extension_version" ] && extension_version="-$extension_version"
-    add_extension_log "$extension$extension_version" "Installed and enabled"
+    add_log "${tick:?}" "$extension$extension_version" "Installed and enabled"
  fi
 }

@@ -249,6 +269,10 @@ add_unstable_extension() {
  local stability=$2
  local prefix=$3
  pecl_version=$(get_pecl_version "$extension" "$stability")
+  if [ -z "$pecl_version" ]; then
+    add_log "${cross:?}" "$extension-$stability" "No release found with minimum stability $stability"
+    return
+  fi
  add_pecl_extension "$extension" "$pecl_version" "$prefix"
 }

@@ -126,7 +126,7 @@ fetch_extension() {
    run_group "git clone -nv $url/$org/$repo /tmp/$repo-$release" "git clone"
    cd /tmp/"$repo-$release" || exit 1
    git checkout -q "$release"
-    cd "$sub_dir" || exit 1
+    cd "${sub_dir:-.}" || exit 1
    if [ -e .gitmodules ]; then
      jobs="$(grep -c "\[submodule" .gitmodules)"
      run_group "git submodule update --jobs $jobs --init --recursive" "git submodule"
@@ -6,36 +6,31 @@ add_sudo() {
  fi
 }

-# Function to link apt-fast to apt-get
-link_apt_fast() {
-  if ! command -v apt-fast >/dev/null; then
-    sudo ln -sf /usr/bin/apt-get /usr/bin/apt-fast
-    trap "sudo rm -f /usr/bin/apt-fast 2>/dev/null" exit
-  fi
+# Function to select the package installer.
+set_apt_install() {
+  local apt=apt-get
+  command -v apt-fast >/dev/null && apt=apt-fast
+  apt_install="sudo $debconf_fix $apt install -y --no-install-recommends -o Dpkg::Options::=--force-confnew"
 }

 # Function to setup environment for self-hosted runners.
 self_hosted_helper() {
-  if ! command -v apt-fast >/dev/null; then
-    sudo ln -sf /usr/bin/apt-get /usr/bin/apt-fast
-    trap "sudo rm -f /usr/bin/apt-fast 2>/dev/null" exit
-  fi
  sudo mkdir -p /opt/hostedtoolcache >/dev/null 2>&1 || true
-  install_packages apt-transport-https ca-certificates curl file make jq unzip autoconf automake gcc g++ gnupg
+  local packages=()
+  mapfile -t packages < <(filter_packages apt-transport-https ca-certificates curl file make jq unzip autoconf automake gcc g++ gnupg)
+  if [ "${#packages[@]}" -gt 0 ]; then
+    install_packages "${packages[@]}"
+  fi
 }

 # Function to fix broken packages.
 fix_broken_packages() {
-  sudo apt --fix-broken install >/dev/null 2>&1
+  sudo apt --fix-broken install -o Dpkg::Options::=--force-confnew >/dev/null 2>&1
 }

 # Function to install a package
 install_packages() {
  packages=("$@")
-  if ! [ -e /etc/dpkg/dpkg.cfg.d/force-confnew ]; then
-    echo "force-confnew" | sudo tee /etc/dpkg/dpkg.cfg.d/force-confnew >/dev/null 2>&1
-    trap "sudo rm -f /etc/dpkg/dpkg.cfg.d/force-confnew 2>/dev/null" exit
-  fi
  $apt_install "${packages[@]}" >/dev/null 2>&1 || (update_lists && fix_broken_packages && $apt_install "${packages[@]}" >/dev/null 2>&1)
 }

@@ -90,6 +85,21 @@ check_package() {
  apt-cache policy "$1" 2>/dev/null | grep -q 'Candidate'
 }

+# Function to filter out installed packages
+filter_packages() {
+  [ "$#" -gt 0 ] || return 0
+  local package architecture status
+  local -A installed=()
+  while IFS=$'\t' read -r package architecture status; do
+    [[ "$status" = [ih]'i ' ]] && status=1 || status=0
+    installed["$package"]=$(( ${installed["$package"]:-1} && status ))
+    installed["$package:$architecture"]=$status
+  done < <(dpkg-query -W -f='${Package}\t${Architecture}\t${db:Status-Abbrev}\n' -- "$@" 2>/dev/null)
+  for package in "$@"; do
+    [ "${installed[$package]:-0}" -eq 1 ] || printf '%s\n' "$package"
+  done
+}
+
 # Helper function to add an extension.
 add_extension_helper() {
  local extension=$1
@@ -226,7 +236,7 @@ update_php() {

 # Function to install PHP.
 add_php() {
-  if [ "${runner:?}" = "self-hosted" ] || [ "${use_package_cache:-true}" = "false" ]; then
+  if [ "${runner:?}" = "self-hosted" ] || [ "${use_builds_cache:-true}" = "false" ]; then
    if [[ "$version" =~ ${php_builder_versions:?} || "$ts" = "zts" ]]; then
        setup_php_builder
    else
@@ -285,6 +295,9 @@ add_php_config() {
 # Function to Setup PHP
 setup_php() {
  step_log "Setup PHP"
+  if [ "${builds_cache_warning:-false}" = "true" ]; then
+    add_log "!" "PHP" "Cached PHP builds are experimental on this runner and may fail to install"
+  fi
  sudo mkdir -m 777 -p /var/run /run/php
  php_config="$(command -v php-config)"
  check_pre_installed
@@ -335,11 +348,10 @@ version=${1:-'8.5'}
 ini=${2:-'production'}
 src=${0%/*}/..
 debconf_fix="DEBIAN_FRONTEND=noninteractive"
-apt_install="sudo $debconf_fix apt-fast install -y --no-install-recommends"
 scripts="$src"/scripts

 add_sudo >/dev/null 2>&1
-link_apt_fast >/dev/null 2>&1
+set_apt_install >/dev/null 2>&1

 . /etc/os-release
 # shellcheck source=.
@@ -237,6 +237,26 @@ Function Add-ToolsHelper() {
  }
 }

+# Function to find the newest stable release containing a tool asset.
+Function Get-LastRelease($url) {
+  $releases_url = $url.Split('/latest/download/')[0]
+  $asset = $url.Split('/')[-1]
+  $page = 1
+  do {
+    $releases = (Get-File -Url "${releases_url}?page=$page&q=prerelease%3Afalse").Content
+    foreach ($match in [regex]::Matches($releases, 'src="([^"]+/releases/expanded_assets/[^"]+)"')) {
+      $assets_url = $match.Groups[1].Value
+      if (-not $assets_url.StartsWith("$releases_url/expanded_assets/")) { continue }
+      $download_path = $assets_url.Substring('https://github.com'.Length).Replace('/expanded_assets/', '/download/') + "/$asset"
+      $assets = (Get-File -Url $assets_url).Content
+      if ($assets.Contains("href=`"$download_path`"")) {
+        return "https://github.com$download_path"
+      }
+    }
+    $page++
+  } while ($releases.Contains('class="next_page"'))
+}
+
 # Function to add tools.
 Function Add-Tool() {
  Param (
@@ -288,15 +308,17 @@ Function Add-Tool() {
      try {
        $status_code = (Invoke-WebRequest -Passthru -Uri $url -OutFile $tool_path).StatusCode
      } catch {
-        if($url -match '.*github.com.*releases.*latest.*') {
+        $status_code = 0
+        if($url -match '^https://github\.com/[^/]+/[^/]+/releases/latest/download/[^/?#]+$') {
          try {
-            $url = $url.replace("releases/latest/download", "releases/download/" + ([regex]::match((Get-File -Url ($url.split('/release')[0] + "/releases")).Content, "([0-9]+\.[0-9]+\.[0-9]+)/" + ($url.Substring($url.LastIndexOf("/") + 1))).Groups[0].Value).split('/')[0])
-            $status_code = (Invoke-WebRequest -Passthru -Uri $url -OutFile $tool_path).StatusCode
+            $release_url = Get-LastRelease $url
+            if ($release_url) {
+              $url = $release_url
+              $status_code = (Invoke-WebRequest -Passthru -Uri $url -OutFile $tool_path).StatusCode
+            }
          } catch {
            $status_code = 0
          }
-        } else {
-          $status_code = 0
        }
      }
      if($status_code -eq 200 -and (Test-Path $tool_path)) {
@@ -375,23 +397,33 @@ Function Add-ComposerToolHelper() {
      composer global config --no-plugins allow-plugins."$prefix$tool" true >$null 2>&1
    }
    composer global require $prefix$release $composer_args >$null 2>&1
+    if($LASTEXITCODE -ne 0) {
+      return
+    }
    return composer global show $prefix$tool 2>&1 | findstr '^versions'
  } else {
    $release_stream = [System.IO.MemoryStream]::New([System.Text.Encoding]::ASCII.GetBytes($release))
    $scoped_dir_suffix = (Get-FileHash -InputStream $release_stream -Algorithm sha256).Hash
    $scoped_dir = "$composer_bin\_tools\$tool-$scoped_dir_suffix"
    $unix_scoped_dir = $scoped_dir.replace('\', '/')
-    if(-not(Test-Path $scoped_dir)) {
+    if(-not(Test-Path $scoped_dir\vendor\autoload.php)) {
      New-Item -ItemType Directory -Force -Path $scoped_dir > $null 2>&1
      Set-Content -Path $scoped_dir\composer.json -Value "{}"
      if((composer show $prefix$tool $tool_version -d $unix_scoped_dir -a 2>&1 | findstr '^type *: *composer-plugin') -and ($composer_args -ne '')) {
        composer config -d $unix_scoped_dir --no-plugins allow-plugins."$prefix$tool" true >$null 2>&1
      }
      composer require $prefix$release -d $unix_scoped_dir $composer_args >$null 2>&1
+      if($LASTEXITCODE -ne 0) {
+        return
+      }
+    }
+    $log = composer show $prefix$tool -d $unix_scoped_dir 2>&1 | findstr '^versions'
+    if(-not $log) {
+      return
    }
    [System.Environment]::SetEnvironmentVariable(($tool.replace('-', '_') + '_bin'), "$scoped_dir\vendor\bin")
    Add-Path $scoped_dir\vendor\bin
-    return composer show $prefix$tool -d $unix_scoped_dir 2>&1 | findstr '^versions'
+    return $log
  }
 }

@@ -417,7 +449,13 @@ Function Add-ComposerTool() {
    [ValidateNotNull()]
    [ValidateLength(1, [int]::MaxValue)]
    [string]
-    $scope
+    $scope,
+    [Parameter(Position = 4, Mandatory = $false)]
+    [string]
+    $fallback_url,
+    [Parameter(Position = 5, Mandatory = $false)]
+    [string]
+    $fallback_version_parameter
  )
  $composer_args = ""
  if($composer_version.split('.')[0] -ne "1") {
@@ -433,10 +471,13 @@ Function Add-ComposerTool() {
  if(Test-Path $composer_bin\composer) {
    Copy-Item -Path "$bin_dir\composer" -Destination "$composer_bin\composer" -Force
  }
-  Add-ToolsHelper $tool
  if($log) {
    $tool_version = Get-ToolVersion "Write-Output" "$log"
+    Add-ToolsHelper $tool
    Add-Log $tick $tool "Added $tool $tool_version"
+  } elseif($fallback_url) {
+    Add-Log "!" $tool "Could not setup $tool using Composer. Falling back to PHAR."
+    Add-Tool $fallback_url $tool $fallback_version_parameter
  } else {
    Add-Log $cross $tool "Could not setup $tool"
  }
@@ -203,6 +203,27 @@ add_tools_helper() {
  done
 }

+# Function to find the newest stable release containing a tool asset.
+get_last_release() {
+  local releases_url="${1%/latest/download/*}"
+  local asset="${1##*/}"
+  local page=1 releases assets_url tag download_path
+  while true; do
+    releases=$(get -s -n "" "$releases_url?page=$page&q=prerelease%3Afalse") || return 1
+    while IFS= read -r assets_url; do
+      [[ "$assets_url" = "$releases_url/expanded_assets/"* ]] || continue
+      tag="${assets_url#"$releases_url/expanded_assets/"}"
+      download_path="${releases_url#https://github.com}/download/$tag/$asset"
+      if get -s -n "" "$assets_url" | grep -Fq "href=\"$download_path\""; then
+        printf 'https://github.com%s\n' "$download_path"
+        return 0
+      fi
+    done <<< "$(printf '%s' "$releases" | grep -Eo 'src="[^"]+/releases/expanded_assets/[^"]+"' | cut -d '"' -f 2)"
+    [[ "$releases" = *'class="next_page"'* ]] || return 1
+    page=$((page + 1))
+  done
+}
+
 # Function to setup a remote tool.
 add_tool() {
  url=$1
@@ -243,9 +264,12 @@ add_tool() {
  else
    [ -f "$tool_path" ] && sudo cp -a "$tool_path" "$tool_path.bak"
    status_code=$(get -v -e "$tool_path" "${url[@]}")
-    if [ "$status_code" != "200" ] && [[ "${url[0]}" =~ .*github.com.*releases.*latest.* ]]; then
-      url[0]="${url[0]//releases\/latest\/download/releases/download/$(get -s -n "" "$(echo "${url[0]}" | cut -d '/' -f '1-5')/releases" | grep -Eo -m 1 "([0-9]+\.[0-9]+\.[0-9]+)/$(echo "${url[0]}" | sed -e "s/.*\///")" | cut -d '/' -f 1)}"
-      status_code=$(get -v -e "$tool_path" "${url[0]}")
+    if [ "$status_code" != "200" ] && [[ "${url[0]}" =~ ^https://github\.com/[^/]+/[^/]+/releases/latest/download/[^/?#]+$ ]]; then
+      local release_url
+      if release_url=$(get_last_release "${url[0]}"); then
+        url[0]="$release_url"
+        status_code=$(get -v -e "$tool_path" "${url[0]}")
+      fi
    fi
    if [ "$status_code" = "200" ]; then
      if [ -n "$checksum" ] && ! verify_checksum "$tool_path" "$checksum"; then
@@ -255,8 +279,12 @@ add_tool() {
        sudo cp -a "$tool_path" "$cache_path"
      fi
    fi
-    if [ "$status_code" != "200" ] && [ -f "$tool_path.bak" ]; then
-      sudo mv "$tool_path.bak" "$tool_path"
+    if [ "$status_code" != "200" ]; then
+      if [ -f "$tool_path.bak" ]; then
+        sudo mv "$tool_path.bak" "$tool_path"
+      else
+        sudo rm -f "$tool_path"
+      fi
    fi
    sudo rm -f "$tool_path.bak"
  fi
@@ -293,19 +321,20 @@ add_composer_tool_helper() {
    if composer global show "$prefix$tool" "$tool_version" -a 2>&1 | grep -qE '^type *: *composer-plugin' && [ -n "$composer_args" ]; then
      composer global config --no-plugins allow-plugins."$prefix$tool" true >/dev/null 2>&1
    fi
-    composer global require "$prefix$release" "$composer_args" >/dev/null 2>&1
+    composer global require "$prefix$release" "$composer_args" >/dev/null 2>&1 || return 1
    composer global show "$prefix$tool" 2>&1 | grep -E ^versions | sudo tee /tmp/composer.log >/dev/null 2>&1
  else
    scoped_dir="$composer_bin/_tools/$tool-$(echo -n "$release" | shasum -a 256 | cut -d ' ' -f 1)"
-    if ! [ -d "$scoped_dir" ]; then
+    if ! [ -f "$scoped_dir/vendor/autoload.php" ]; then
      mkdir -p "$scoped_dir"
      echo '{}' | tee "$scoped_dir/composer.json" >/dev/null
      if composer show "$prefix$tool" "$tool_version" -d "$scoped_dir" -a 2>&1 | grep -qE '^type *: *composer-plugin' && [ -n "$composer_args" ]; then
        composer config -d "$scoped_dir" --no-plugins allow-plugins."$prefix$tool" true >/dev/null 2>&1
      fi
-      composer require "$prefix$release" -d "$scoped_dir" "$composer_args" >/dev/null 2>&1
-      composer show "$prefix$tool" -d "$scoped_dir" 2>&1 | grep -E ^versions | sudo tee /tmp/composer.log >/dev/null 2>&1
+      composer require "$prefix$release" -d "$scoped_dir" "$composer_args" >/dev/null 2>&1 || return 1
    fi
+    composer show "$prefix$tool" -d "$scoped_dir" 2>&1 | grep -E ^versions | sudo tee /tmp/composer.log >/dev/null 2>&1
+    [ -s /tmp/composer.log ] || return 1
    add_path "$scoped_dir"/vendor/bin
  fi
 }
@@ -316,6 +345,7 @@ add_composer_tool() {
  release=$2
  prefix=$3
  scope=$4
+  local fallback_url=${5:-} fallback_version_parameter=${6:-}
  composer_args=
  composer_major_version=$(cut -d'.' -f 1 /tmp/composer_version)
  if [ "$composer_major_version" != "1" ]; then
@@ -326,11 +356,17 @@ add_composer_tool() {
      return
    fi
  fi
-  add_composer_tool_helper "$tool" "$release" "$prefix" "$scope" "$composer_args"
-  tool_version=$(get_tool_version cat /tmp/composer.log)
-  ([ -s /tmp/composer.log ] && add_log "$tick" "$tool" "Added $tool $tool_version"
-  ) || add_log "$cross" "$tool" "Could not setup $tool"
-  add_tools_helper "$tool"
+  sudo rm -f /tmp/composer.log
+  if add_composer_tool_helper "$tool" "$release" "$prefix" "$scope" "$composer_args" && [ -s /tmp/composer.log ]; then
+    tool_version=$(get_tool_version cat /tmp/composer.log)
+    add_tools_helper "$tool"
+    add_log "$tick" "$tool" "Added $tool $tool_version"
+  elif [ -n "$fallback_url" ]; then
+    add_log "!" "$tool" "Could not setup $tool using Composer. Falling back to PHAR."
+    add_tool "$fallback_url" "$tool" "$fallback_version_parameter"
+  else
+    add_log "$cross" "$tool" "Could not setup $tool"
+  fi
  if [ -e "$composer_bin/composer" ]; then
    sudo cp -a "$tool_path_dir/composer" "$composer_bin"
  fi
@@ -225,6 +225,11 @@ configure_brew() {
  tap_dir="$brew_repo"/Library/Taps
  core_repo="$tap_dir"/homebrew/homebrew-core

+  if [ -d "$core_repo" ]; then
+    export HOMEBREW_NO_INSTALL_FROM_API=1
+  else
+    unset HOMEBREW_NO_INSTALL_FROM_API
+  fi
  export HOMEBREW_CHANGE_ARCH_TO_ARM=1
  export HOMEBREW_NO_AUTO_UPDATE=1
  export HOMEBREW_NO_ENV_HINTS=1
@@ -33,6 +33,8 @@ add_log() {
  local message=$3
  if [ "$mark" = "$tick" ]; then
    printf "\033[32;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s\033[0m\n" "$mark" "$subject" "$message"
+  elif [ "$mark" = "!" ]; then
+    printf "\033[33;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s\033[0m\n" "$mark" "$subject" "$message"
  else
    printf "\033[31;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s\033[0m\n" "$mark" "$subject" "$message"
    [ "$fail_fast" = "true" ] && exit 1
@@ -58,6 +60,22 @@ without_trace() {
  return "$setup_php_trace_status"
 }

+# Function to check third-party runners eligible for the builds cache.
+check_builds_cache_runner() {
+  local pid=$PPID executable
+  while [[ "$pid" =~ ^[0-9]+$ && "$pid" -gt 1 ]]; do
+    executable="$(readlink -f "/proc/$pid/exe")" || return 1
+    if [[ "$executable" = */bin/Runner.Worker ]]; then
+      jq -e --arg name "${RUNNER_NAME:-}" \
+        '.AgentName == $name and (.AgentName | test("^(blacksmith|depot)-"))' \
+        "${executable%/bin/Runner.Worker}/.runner" >/dev/null 2>&1
+      return $?
+    fi
+    pid="$(awk '$1 == "PPid:" {print $2}' "/proc/$pid/status")" || return 1
+  done
+  return 1
+}
+
 # Function to read env inputs.
 read_env() {
  if [[ "${SETUP_PHP_TRACE:-0}" =~ ^[12]$ ]]; then
@@ -67,10 +85,19 @@ read_env() {
  [ "${debug:-${DEBUG:-false}}" = "true" ] && debug=debug && update=true || debug=release
  [[ "${phpts:-${PHPTS:-nts}}" = "ts" || "${phpts:-${PHPTS:-nts}}" = "zts" ]] && ts=zts && update=true || ts=nts
  fail_fast="${fail_fast:-${FAIL_FAST:-false}}"
+  use_builds_cache="${use_builds_cache:-${use_package_cache:-}}"
  [[ ( -z "$ImageOS" && -z "$ImageVersion" ) ||
     ( -n "$RUNNER_ENVIRONMENT" && "$RUNNER_ENVIRONMENT" = "self-hosted" ) ||
     -n "$ACT" || -n "$CONTAINER" ]] && _runner=self-hosted || _runner=github
  runner="${runner:-${RUNNER:-$_runner}}"
+  if [[ $_runner = "self-hosted" && "${use_builds_cache:-false}" = "true" ]]; then
+    runner=github
+    if [[ "${ID:-}" = "ubuntu" && -z "$ACT" && -z "$CONTAINER" &&
+          ( -n "${BLACKSMITH_VM_ID:-}" || "${RUNNER_NAME:-}" =~ ^(blacksmith|depot)- ) ]] && check_builds_cache_runner; then
+      _runner=github
+      builds_cache_warning=true
+    fi
+  fi
  tool_path_dir="${setup_php_tools_dir:-${SETUP_PHP_TOOLS_DIR:-/usr/local/bin}}"
  tool_cache_path_dir="${setup_php_tool_cache_dir:-${SETUP_PHP_TOOL_CACHE_DIR:-${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}/setup-php/tools}}"  

@@ -20,6 +20,8 @@ Function Step-Log($message) {
 Function Add-Log($mark, $subject, $message) {
  if ($mark -eq $tick) {
    printf "\033[32;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s \033[0m\n" $mark $subject $message
+  } elseif ($mark -eq "!") {
+    printf "\033[33;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s \033[0m\n" $mark $subject $message
  } else {
    printf "\033[31;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s \033[0m\n" $mark $subject $message
    if($env:fail_fast -eq 'true') {
@@ -437,7 +439,7 @@ if($version -eq 'pre') {
 }
 if ($null -eq $installed -or -not("$($installed.Version).".StartsWith(($version -replace '^(\d+(\.\d+)*).*', '$1.'))) -or $ts -ne $installed.ThreadSafe) {
  if ($version -lt '7.0' -and ($null -eq (Get-Module -ListAvailable -Name VcRedist))) {
-    Install-PSPackage VcRedist VcRedist-main\VcRedist\VcRedist "$github/aaronparker/VcRedist/archive/main.zip" Get-VcList >$null 2>&1
+    Install-PSPackage VcRedist VcRedist-4.1.527\VcRedist\VcRedist "$github/aaronparker/VcRedist/archive/v4.1.527.zip" Get-VcList >$null 2>&1
  }
  try {
    if ($version -match $nightly_versions) {
@@ -1,9 +1,12 @@
+import {fileURLToPath} from 'url';
 import path from 'path';
 import fs from 'fs';
 import * as cv from 'compare-versions';
-import * as fetch from './fetch';
-import * as packagist from './packagist';
-import * as utils from './utils';
+import * as fetch from './fetch.js';
+import * as packagist from './packagist.js';
+import * as utils from './utils.js';
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));

 /**
 * Valid function names for custom tool handlers
@@ -48,6 +51,7 @@ export interface ToolData {
  url: string;
  uri?: string;
  error?: string;
+  fallback?: ToolFallback;
 }

 /**
@@ -72,8 +76,19 @@ interface ToolConfig {
  version_parameter?: string;
  version_prefix?: string;
  packagist?: string;
+  fallback?: ToolFallback;
 }

+type ToolFallback = Pick<
+  ToolConfig,
+  | 'repository'
+  | 'domain'
+  | 'extension'
+  | 'fetch_latest'
+  | 'version_parameter'
+  | 'version_prefix'
+> & {type: 'phar'};
+
 /**
 * Regex to match a checksum suffix in a tool release - tool:version@sha256:<hash>
 */
@@ -141,21 +156,13 @@ interface GitHubRef {
  };
 }

-/**
- * Deployer manifest entry
- */
-interface DeployerManifestEntry {
-  version: string;
-  url: string;
-}
-
 export function skipGitHubAuthForComposerVersion(version: string): boolean {
  if (!/^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(version)) {
    return false;
  }
  return fs
    .readFileSync(
-      path.join(__dirname, '../src/configs/composer-gh-auth-no-op'),
+      path.join(dirname, '../src/configs/composer-gh-auth-no-op'),
      'utf8'
    )
    .trim()
@@ -414,7 +421,23 @@ export async function addPackage(data: ToolData): Promise<string> {
  const args = [parts[1], data.release, parts[0] + '/', data.scope]
    .map(a => utils.safeArg(a, data.os))
    .join(' ');
-  return command + args;
+  if (!data.fallback) return command + args;
+  const fallback = await getData(
+    data.release.replace(/\.\*$/, ''),
+    data.php_version,
+    data.os,
+    data.fallback
+  );
+  // A failed version lookup must not prevent a successful Composer install.
+  if (fallback.error) return command + args;
+  return (
+    command +
+    args +
+    ' ' +
+    utils.safeArg(fallback.url, data.os) +
+    ' ' +
+    (fallback.version_parameter || '""')
+  );
 }

 /**
@@ -514,29 +537,17 @@ export async function addComposer(data: ToolData): Promise<string> {
 * @param data
 */
 export async function addDeployer(data: ToolData): Promise<string> {
-  if (data.version === 'latest') {
-    data.url = data.domain + '/deployer.phar';
-  } else {
-    const manifest = await fetch.fetch('https://deployer.org/manifest.json');
-    const version_data: Record<string, DeployerManifestEntry> = JSON.parse(
-      manifest.data
-    );
-    const version_key: string | undefined = Object.keys(version_data).find(
-      (key: string) => {
-        return version_data[key].version === data.version;
-      }
-    );
-    if (version_key) {
-      data.url = version_data[version_key].url;
-    } else {
-      return await utils.addLog(
-        '$cross',
-        'deployer',
-        'Version missing in deployer manifest',
-        data.os
-      );
-    }
-  }
+  const github_url = await getUrl({
+    ...data,
+    domain: data.github,
+    prefix: 'releases',
+    verb: 'download'
+  });
+  const source_url =
+    data.version === 'latest'
+      ? `${data.domain}/deployer.phar`
+      : `${data.domain}/releases/v${data.version}/deployer.phar`;
+  data.url = `${github_url},${source_url}`;
  return await addArchive(data);
 }

@@ -670,9 +681,10 @@ export async function addWPCLI(data: ToolData): Promise<string> {
 export async function getData(
  release: string,
  php_version: string,
-  os: string
+  os: string,
+  overrides: ToolConfig = {}
 ): Promise<ToolData> {
-  const json_file_path = path.join(__dirname, '../src/configs/tools.json');
+  const json_file_path = path.join(dirname, '../src/configs/tools.json');
  const json_file: string = fs.readFileSync(json_file_path, 'utf8');
  const json_objects: Record<string, ToolConfig> = JSON.parse(json_file);
  release = release.replace(/\s+/g, '');
@@ -702,6 +714,7 @@ export async function getData(
      config = {tool};
    }
  }
+  config = {...config, ...overrides};
  const github = 'https://github.com';
  const domain = config.domain ?? github;
  const data: ToolData = {
@@ -727,7 +740,8 @@ export async function getData(
    packagist: config.packagist ?? config.repository ?? '',
    type: config.type,
    function: config.function,
-    alias: config.alias
+    alias: config.alias,
+    fallback: config.fallback
  };
  data.checksum = checksum_data.checksum;
  data.error = checksum_data.error;
@@ -1,7 +1,10 @@
+import {fileURLToPath} from 'url';
 import fs from 'fs';
 import * as path from 'path';
-import * as core from './core';
-import * as fetch from './fetch';
+import * as core from './core.js';
+import * as fetch from './fetch.js';
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));

 /**
 * Function to read environment variable and return a string value.
@@ -88,12 +91,9 @@ export async function parseVersion(version: string): Promise<string> {
      if (!/^\d+(\.\d+){0,2}$/.test(version)) {
        throw new Error(`Invalid PHP version: ${version.slice(0, 20)}`);
      }
-      switch (true) {
-        case version.length > 1:
-          return version.slice(0, 3);
-        default:
-          return version + '.0';
-      }
+      return version.includes('.')
+        ? version.split('.').slice(0, 2).join('.')
+        : version + '.0';
  }
 }

@@ -480,7 +480,7 @@ export async function customPackage(
  const pkg_name: string = pkg.replace(/\d+|(pdo|pecl)[_-]|[_-]db2/, '');
  const script_extension: string = await scriptExtension(os);
  const script: string = path.join(
-    __dirname,
+    dirname,
    '../src/scripts/' + type + '/' + pkg_name + script_extension
  );
  const command: string = await getCommand(os, pkg_name);
@@ -5,8 +5,8 @@
    "lib": [
      "ES2025"
    ],
-    "module": "Node20",
-    "moduleResolution": "Node16",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
    "noImplicitAny": true,
    "outDir": "./lib",
    "removeComments": true,