Bump pkl.impl.ghactions to version 1.3.2 (#1403)

Updates pkl.impl.ghactions package to version 1.3.2

.github/PklProject

@@ -2,9 +2,9 @@ amends "pkl:Project"
 
 dependencies {
   ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.1"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.3.2"
   }
   ["gha"] {
-    uri = "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.6"
+    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.2.0"
   }
 }

.github/PklProject.deps.json

@@ -1,18 +1,39 @@
 {
   "schemaVersion": 1,
   "resolvedDependencies": {
-    "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0": {
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.6",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.3.0",
       "checksums": {
-        "sha256": "84365239996740252a91abab084d443aa3a3438f375b667ac16cb765461c1555"
+        "sha256": "76174cb974310b3d952280b76ed224eb4ee6fd5419bf696ad9a66fba44bd427d"
       }
     },
-    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0": {
+    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.1",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.3.2",
       "checksums": {
-        "sha256": "f8efc4b174855a2fafdab8ed792de4b0cb89b0516d688c8540eea13af20e0f80"
+        "sha256": "a04ff65fd6ef83a124cb1f26db9c8b544327ac398396974f80fa63cd76700561"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1.1.1",
+      "checksums": {
+        "sha256": "1e6e29b441ffdee2605d317f6543a4a604aab5af472b63f0c47d92a3b4b36f7f"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.0.0",
+      "checksums": {
+        "sha256": "ebc9698278d8aac71bb5a7e4d913c3bbb75d57e8e725f0298e346e36783f6ca2"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.0",
+      "checksums": {
+        "sha256": "02ef6f25bfca5b1d095db73ea15de79d2d2c6832ebcab61e6aba90554382abcb"
       }
     }
   }

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  ignore:
+  - dependency-name: '*'
+    update-types:
+    - version-update:semver-major
+  schedule:
+    interval: weekly

.github/index.pkl

@@ -21,8 +21,8 @@ testReports {
   }
   excludeJobs {
     "bench"
-    "deploy-release"
     "github-release"
+    Regex("deploy-.*")
   }
 }
 
@@ -196,27 +196,3 @@ release {
       }
     } |> toWorkflowJobs
 }
-
-output {
-  files {
-    [[true]] {
-      renderer {
-        converters {
-          ["jobs"] = (it: Mapping<String, Workflow.Job>) ->
-            it
-              .toMap()
-              .mapValues((name, job) ->
-                if (name.contains("linux") && !name.contains("alpine"))
-                  job
-                    .toMap()
-                    .put("container", new Dynamic {
-                      image = "redhat/ubi8:8.10"
-                    })
-                else
-                  job
-              )
-        }
-      }
-    }
-  }
-}

.github/jobs/BuildJavaExecutableJob.pkl

@@ -1,7 +1,6 @@
 extends "GradleJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/actions/Common.pkl"
+import "@gha/catalog.pkl"
 
 // Keep this in sync with projects that build java executables
 local projects: List<String> = List("pkl-doc", "pkl-cli", "pkl-codegen-java", "pkl-codegen-kotlin")
@@ -17,13 +16,13 @@ local command =
   }.join(" ")
 
 steps {
-  new Common.Checkout {}
+  catalog.`actions/checkout@v6`
   new {
     name = "gradle build java executables"
     shell = "bash"
     run = command
   }
-  new Artifact.Upload {
+  (catalog.`actions/upload-artifact@v5`) {
     name = "Upload executable artifacts"
     with {
       name = "executable-java"

.github/jobs/BuildNativeJob.pkl

@@ -1,7 +1,7 @@
 extends "GradleJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/Context.pkl"
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
 
 /// Whether to link to musl. Otherwise, links to glibc.
 musl: Boolean(implies(module.os == "linux")) = false
@@ -12,7 +12,7 @@ project: String
 extraGradleArgs {
   when (os == "macOS" && arch == "amd64") {
     "-Dpkl.targetArch=\(module.arch)"
-    "-Dpkl.native--native-compiler-path=\(Context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
+    "-Dpkl.native--native-compiler-path=\(context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
   }
   when (musl) {
     "-Dpkl.musl=true"
@@ -48,7 +48,7 @@ steps {
     shell = "bash"
     run = "./gradlew \(module.gradleArgs) \(project):buildNative"
   }
-  new Artifact.Upload {
+  (catalog.`actions/upload-artifact@v5`) {
     name = "Upload executable artifacts"
     with {
       name =
@@ -62,3 +62,11 @@ steps {
     }
   }
 }
+
+fixed job {
+  when (os == "linux" && !musl) {
+    container {
+      image = "redhat/ubi8:8.10"
+    }
+  }
+}

.github/jobs/DeployJob.pkl

@@ -1,7 +1,6 @@
 extends "GradleJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/actions/Common.pkl"
+import "@gha/catalog.pkl"
 import "@gha/Workflow.pkl"
 import "@pkl.impl.ghactions/helpers.pkl"
 
@@ -14,8 +13,8 @@ arch = "amd64"
 os = "linux"
 
 steps {
-  new Common.Checkout {}
-  new Artifact.Download {
+  catalog.`actions/checkout@v6`
+  (catalog.`actions/download-artifact@v6`) {
     with {
       pattern = "executable-**"
       `merge-multiple` = true

.github/jobs/GithubRelease.pkl

@@ -2,8 +2,8 @@ module GithubRelease
 
 extends "PklJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/Context.pkl"
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
 
 fixed job {
   `runs-on` = "ubuntu-latest"
@@ -12,7 +12,7 @@ fixed job {
   }
   needs = "deploy-release"
   steps {
-    new Artifact.Download {
+    (catalog.`actions/download-artifact@v6`) {
       with {
         pattern = "executable-**"
         `merge-multiple` = true
@@ -21,10 +21,10 @@ fixed job {
     new {
       name = "Publish release on GitHub"
       env {
-        ["GH_TOKEN"] = Context.github.token
-        ["TAG_NAME"] = Context.github.refName
-        ["GIT_SHA"] = Context.github.sha
-        ["GH_REPO"] = Context.github.repository
+        ["GH_TOKEN"] = context.github.token
+        ["TAG_NAME"] = context.github.refName
+        ["GIT_SHA"] = context.github.sha
+        ["GH_REPO"] = context.github.repository
       }
       // language=bash
       run =

.github/jobs/GradleJob.pkl

@@ -2,9 +2,8 @@ abstract module GradleJob
 
 extends "PklJob.pkl"
 
-import "@gha/actions/Common.pkl"
-import "@gha/actions/Setup.pkl"
 import "@gha/Workflow.pkl"
+import "@pkl.impl.ghactions/catalog.pkl"
 
 /// Whether this is a release build or not.
 isRelease: Boolean = false
@@ -21,9 +20,9 @@ nightlyMacOS: Boolean(implies(os == "macOS")) = false
 
 extraGradleArgs: Listing<String>
 
-steps: Listing<*Workflow.Step | Workflow.TypedStep>
+steps: Listing<Workflow.Step>
 
-preSteps: Listing<*Workflow.Step | Workflow.TypedStep>
+preSteps: Listing<Workflow.Step>
 
 /// The fetch depth to use when doing a git checkout.
 fetchDepth: Int?
@@ -73,18 +72,17 @@ fixed job {
   steps {
     ...preSteps
     // full checkout (needed for spotless)
-    new Common.Checkout {
+    (catalog.`actions/checkout@v6`) {
       when (fetchDepth != null) {
         with {
           `fetch-depth` = fetchDepth
         }
       }
     }
-    new Setup.Java {
+    (catalog.`actions/setup-java@v5`) {
       with {
         `java-version` = "21"
         distribution = "temurin"
-        cache = "gradle"
         architecture =
           if (arch == "amd64")
             "x64"
@@ -92,6 +90,7 @@ fixed job {
             "aarch64"
       }
     }
+    catalog.`gradle/actions/setup-gradle@v5`
     ...module.steps
   }
 }

.github/workflows/__lockfile__.yml

@@ -0,0 +1,33 @@
+#file: noinspection MandatoryParamsAbsent,UndefinedAction
+# This is a fake workflow that never runs.
+# It's used to pin actions to specific git SHAs when generating actual workflows.
+# It also gets updated by dependabot (see .github/dependabot.yml).
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: __lockfile__
+'on':
+  push:
+    branches-ignore:
+    - '**'
+    tags-ignore:
+    - '**'
+jobs:
+  locks:
+    if: 'false'
+    runs-on: nothing
+    steps:
+    - name: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+    - name: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+    - name: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+    - name: actions/download-artifact@v6
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+    - name: actions/setup-java@v5
+      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+    - name: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+    - name: dawidd6/action-download-artifact@v11
+      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+    - name: gradle/actions/setup-gradle@v5
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5

.github/workflows/build.yml

@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Build
 'on':
   push:
@@ -20,27 +18,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check
         path: '**/build/reports/tests/**/*'
@@ -51,27 +51,29 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check-windows
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check-windows
         path: '**/build/reports/tests/**/*'
@@ -81,13 +83,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: bench:jmh
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
@@ -96,27 +101,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-compatibility
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-compatibility
         path: '**/build/reports/tests/**/*'
@@ -126,33 +133,37 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
-    - uses: actions/checkout@v5
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-java
         path: '*/build/executable/**/*'
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-java-executables-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-java-executables-snapshot
         path: '**/build/reports/tests/**/*'
@@ -165,30 +176,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -200,32 +214,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -240,30 +257,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -275,32 +295,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -312,13 +335,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -396,19 +422,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-alpine-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -419,30 +445,33 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-windows-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -455,30 +484,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -490,32 +522,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -530,30 +565,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -565,32 +603,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -602,13 +643,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -686,19 +730,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-alpine-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -709,36 +753,39 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-windows-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -760,18 +807,18 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-publish-test-results
         path: '**/build/reports/tests/**/*'

.github/workflows/main.yml

@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Build (main)
 'on':
   push:
@@ -19,27 +17,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check
         path: '**/build/reports/tests/**/*'
@@ -50,27 +50,29 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check-windows
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check-windows
         path: '**/build/reports/tests/**/*'
@@ -80,13 +82,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: bench:jmh
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
@@ -95,27 +100,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-compatibility
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-compatibility
         path: '**/build/reports/tests/**/*'
@@ -125,33 +132,37 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
-    - uses: actions/checkout@v5
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-java
         path: '*/build/executable/**/*'
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-java-executables-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-java-executables-snapshot
         path: '**/build/reports/tests/**/*'
@@ -164,30 +175,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -199,32 +213,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -239,30 +256,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -274,32 +294,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -311,13 +334,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -395,19 +421,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-alpine-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -418,30 +444,33 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-windows-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -454,30 +483,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -489,32 +521,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -529,30 +564,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -564,32 +602,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -601,13 +642,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -685,19 +729,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-alpine-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -708,30 +752,33 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-windows-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -760,15 +807,20 @@ jobs:
       LANG: en_US.UTF-8
     environment: maven-release
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
-    - uses: actions/checkout@v5
-    - uses: actions/download-artifact@v6
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: executable-**
         merge-multiple: true
@@ -779,21 +831,8 @@ jobs:
         ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@v5
-      with:
-        name: test-results-xml-deploy-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@v5
-      with:
-        name: test-results-html-deploy-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -811,23 +850,22 @@ jobs:
     - pkl-doc-linux-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
-    - deploy-snapshot
     permissions:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-publish-test-results
         path: '**/build/reports/tests/**/*'
@@ -858,7 +896,7 @@ jobs:
     steps:
     - name: Create app token
       id: app-token
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       with:
         app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
         private-key: ${{ secrets.PKL_CI }}

.github/workflows/prb.yml

@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Pull Request
 'on':
   pull_request: {}
@@ -15,28 +13,30 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check
         path: '**/build/reports/tests/**/*'
@@ -48,28 +48,30 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check-windows
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check-windows
         path: '**/build/reports/tests/**/*'
@@ -82,31 +84,34 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -119,33 +124,36 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -160,31 +168,34 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -197,33 +208,36 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -236,13 +250,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -320,20 +337,20 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-alpine-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -345,31 +362,34 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-windows-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -382,31 +402,34 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -419,33 +442,36 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -460,31 +486,34 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -497,33 +526,36 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -536,13 +568,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -620,20 +655,20 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-alpine-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -645,31 +680,34 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-windows-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
         if-no-files-found: ignore
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -679,14 +717,16 @@ jobs:
     steps:
     - name: Upload event file
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-event-file
         path: ${{ github.event_path }}
   check-pkl-github-actions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
@@ -701,6 +741,8 @@ jobs:
         chmod +x $PKL_EXEC
         echo "$DIR" >> "$GITHUB_PATH"
         echo "pkl_exec=$PKL_EXEC" >> "$GITHUB_OUTPUT"
+    - shell: bash
+      run: rm -rf .github/**/[a-z]*.yml
     - shell: bash
       run: pkl eval -m .github/ --project-dir .github/ .github/index.pkl
     - name: check git status

.github/workflows/release-branch.yml

@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Build (release branch)
 'on':
   push:
@@ -19,27 +17,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check
         path: '**/build/reports/tests/**/*'
@@ -50,27 +50,29 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check-windows
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check-windows
         path: '**/build/reports/tests/**/*'
@@ -80,13 +82,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: bench:jmh
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
@@ -95,27 +100,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-compatibility
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-compatibility
         path: '**/build/reports/tests/**/*'
@@ -125,33 +132,37 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
-    - uses: actions/checkout@v5
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-java
         path: '*/build/executable/**/*'
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-java-executables-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-java-executables-snapshot
         path: '**/build/reports/tests/**/*'
@@ -164,30 +175,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -199,32 +213,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -239,30 +256,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -274,32 +294,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -311,13 +334,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -395,19 +421,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-alpine-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -418,30 +444,33 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-windows-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -454,30 +483,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -489,32 +521,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -529,30 +564,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -564,32 +602,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-aarch64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -601,13 +642,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -685,19 +729,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-alpine-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
@@ -708,36 +752,39 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-windows-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-windows-amd64-snapshot
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -759,18 +806,18 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-publish-test-results
         path: '**/build/reports/tests/**/*'
@@ -800,7 +847,7 @@ jobs:
     steps:
     - name: Create app token
       id: app-token
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       with:
         app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
         private-key: ${{ secrets.PKL_CI }}

.github/workflows/release.yml

@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Release
 'on':
   push:
@@ -19,27 +17,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check
         path: '**/build/reports/tests/**/*'
@@ -50,27 +50,29 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: check
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-check-windows
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-check-windows
         path: '**/build/reports/tests/**/*'
@@ -80,13 +82,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: bench:jmh
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
@@ -95,27 +100,29 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-gradle-compatibility
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-gradle-compatibility
         path: '**/build/reports/tests/**/*'
@@ -125,33 +132,37 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
+        persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
-    - uses: actions/checkout@v5
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-java
         path: '*/build/executable/**/*'
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-java-executables-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-java-executables-release
         path: '**/build/reports/tests/**/*'
@@ -164,30 +175,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -199,32 +213,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -239,30 +256,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-macOS-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-macOS-aarch64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-macOS-aarch64-release
         path: '**/build/reports/tests/**/*'
@@ -274,32 +294,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-linux-aarch64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-linux-aarch64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-linux-aarch64-release
         path: '**/build/reports/tests/**/*'
@@ -311,13 +334,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -395,19 +421,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-alpine-linux-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-alpine-linux-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-alpine-linux-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -418,30 +444,33 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-cli-windows-amd64
         path: pkl-cli*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-cli-windows-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-cli-windows-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -454,30 +483,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -489,32 +521,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -529,30 +564,33 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-macOS-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-macOS-aarch64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-macOS-aarch64-release
         path: '**/build/reports/tests/**/*'
@@ -564,32 +602,35 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-linux-aarch64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-linux-aarch64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-linux-aarch64-release
         path: '**/build/reports/tests/**/*'
@@ -601,13 +642,16 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: Install musl and zlib
       run: |
         set -e
@@ -685,19 +729,19 @@ jobs:
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-alpine-linux-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-alpine-linux-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-alpine-linux-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -708,30 +752,33 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: executable-pkl-doc-windows-amd64
         path: pkl-doc*/build/executable/**/*
     - name: Upload Test Result XML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-xml-pkl-doc-windows-amd64-release
         path: '**/build/test-results/**/*.xml'
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-pkl-doc-windows-amd64-release
         path: '**/build/reports/tests/**/*'
@@ -760,15 +807,20 @@ jobs:
       LANG: en_US.UTF-8
     environment: maven-release
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
-        cache: gradle
-    - uses: actions/checkout@v5
-    - uses: actions/download-artifact@v6
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: executable-**
         merge-multiple: true
@@ -785,7 +837,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: executable-**
         merge-multiple: true
@@ -806,7 +858,7 @@ jobs:
           --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${TAG_NAME}" \
           */build/executable/*
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -828,18 +880,18 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       with:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
     - name: Upload Test Result HTML
       if: '!cancelled()'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
         name: test-results-html-publish-test-results
         path: '**/build/reports/tests/**/*'
@@ -871,7 +923,7 @@ jobs:
     steps:
     - name: Create app token
       id: app-token
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       with:
         app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
         private-key: ${{ secrets.PKL_CI }}

.github/workflows/test_report.yml

@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: PR Test Reports
 'on':
   workflow_run:
@@ -20,14 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Download artifacts
-      uses: dawidd6/action-download-artifact@v11
+      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
       with:
         path: artifacts
         name: test-results-.*
-        name_is_regex: true
+        name_is_regexp: true
         run_id: ${{ github.event.workflow_run.id }}
     - name: Publish test results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
       with:
         commit: ${{ github.event.workflow_run.head_sha }}
         comment_mode: 'off'

README.adoc

@@ -63,6 +63,9 @@ image:https://github.com/apple/pkl/actions/workflows/main.yml/badge.svg?style=sv
 |https://github.com/apple/pkl-go-examples[`apple/pkl-go-examples`]
 |Examples for using Pkl within Go applications
 
+|https://github.com/apple/highlightjs-pkl[`apple/highlightjs-pkl`]
+|Highlight.js syntax highlighting for Pkl
+
 |https://github.com/apple/pkl-intellij[`apple/pkl-intellij`]
 |JetBrains editor plugins providing Pkl language support
 
@@ -79,7 +82,7 @@ image:https://github.com/apple/pkl/actions/workflows/main.yml/badge.svg?style=sv
 |The pkl-lang.org website
 
 |https://github.com/apple/pkl-lsp[`apple/pkl-lsp`]
-| Language server for Pkl, implementing the server-side of the Language Server Protocol
+|Language server for Pkl, implementing the server-side of the Language Server Protocol
 
 |https://github.com/apple/pkl-neovim[`apple/pkl-neovim`]
 |Pkl language support for Neovim
@@ -93,6 +96,9 @@ image:https://github.com/apple/pkl/actions/workflows/main.yml/badge.svg?style=sv
 |https://github.com/apple/pkl-project-commons[`apple/pkl-project-commons`]
 |Utility libraries for Pkl
 
+|https://github.com/apple/pkl-readers[`apple/pkl-readers`]
+|Shared Pkl https://pkl-lang.org/main/current/language-reference/index.html#external-readers[external reader] tools
+
 |https://github.com/apple/pkl-spring[`apple/pkl-spring`]
 |Spring Boot extension for configuring Boot apps with Pkl
 
@@ -108,9 +114,9 @@ image:https://github.com/apple/pkl/actions/workflows/main.yml/badge.svg?style=sv
 |https://github.com/apple/pkl.tmbundle[`apple/pkl.tmbundle`]
 |TextMate bundle for Pkl
 
-|https://github.com/apple/rules_pkl[`apple/rules_pkl`]
-| Bazel build rules for Pkl
-
 |https://github.com/apple/tree-sitter-pkl[`apple/tree-sitter-pkl`]
 |Tree-sitter parser for Pkl
+
+|https://github.com/apple/rules_pkl[`apple/rules_pkl`]
+|Bazel build rules for Pkl
 |===

build.gradle.kts

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 // https://youtrack.jetbrains.com/issue/KTIJ-19369
-@file:Suppress("DSL_SCOPE_VIOLATION")
-
 import org.jetbrains.gradle.ext.ActionDelegationConfig
 import org.jetbrains.gradle.ext.ActionDelegationConfig.TestRunner.PLATFORM
 import org.jetbrains.gradle.ext.ProjectSettings

buildSrc/src/main/kotlin/PklPublishing.kt

@@ -0,0 +1,147 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.charset.StandardCharsets
+import java.util.Base64
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.maven.tasks.AbstractPublishToMaven
+import org.gradle.api.publish.maven.tasks.GenerateMavenPom
+import org.gradle.kotlin.dsl.*
+import org.gradle.plugins.signing.SigningExtension
+
+/** Configures common POM metadata (licenses, developers, SCM, etc.) for all Pkl publications. */
+fun Project.configurePklPomMetadata() {
+  extensions.configure<PublishingExtension> {
+    publications.withType<MavenPublication>().configureEach {
+      pom {
+        name.set(artifactId)
+        licenses {
+          license {
+            name.set("The Apache Software License, Version 2.0")
+            url.set("https://github.com/apple/pkl/blob/main/LICENSE.txt")
+          }
+        }
+        developers {
+          developer {
+            id.set("pkl-authors")
+            name.set("The Pkl Authors")
+            email.set("pkl-oss@group.apple.com")
+          }
+        }
+        scm {
+          connection.set("scm:git:git://github.com/apple/pkl.git")
+          developerConnection.set("scm:git:ssh://github.com/apple/pkl.git")
+          val buildInfo = extensions.getByType<BuildInfo>()
+          url.set("https://github.com/apple/pkl/tree/${buildInfo.commitish}")
+        }
+        issueManagement {
+          system.set("GitHub Issues")
+          url.set("https://github.com/apple/pkl/issues")
+        }
+        ciManagement {
+          system.set("GitHub Actions")
+          url.set("https://github.com/apple/pkl/actions")
+        }
+      }
+    }
+  }
+}
+
+/** Configures POM validation task to check for unresolved versions and snapshots in releases. */
+fun Project.configurePomValidation() {
+  val validatePom by
+    tasks.registering {
+      if (tasks.findByName("generatePomFileForLibraryPublication") == null) {
+        return@registering
+      }
+      val generatePomFileForLibraryPublication by tasks.existing(GenerateMavenPom::class)
+      val outputFile =
+        layout.buildDirectory.file("validatePom") // dummy output to satisfy up-to-date check
+
+      dependsOn(generatePomFileForLibraryPublication)
+      inputs.file(generatePomFileForLibraryPublication.get().destination)
+      outputs.file(outputFile)
+
+      doLast {
+        outputFile.get().asFile.delete()
+
+        val pomFile = generatePomFileForLibraryPublication.get().destination
+        assert(pomFile.exists())
+
+        val text = pomFile.readText()
+
+        run {
+          val unresolvedVersion = Regex("<version>.*[+,()\\[\\]].*</version>")
+          val matches = unresolvedVersion.findAll(text).toList()
+          if (matches.isNotEmpty()) {
+            throw org.gradle.api.GradleException(
+              """
+        Found unresolved version selector(s) in generated POM:
+        ${matches.joinToString("\n") { it.groupValues[0] }}
+      """
+                .trimIndent()
+            )
+          }
+        }
+
+        val buildInfo = project.extensions.getByType<BuildInfo>()
+        if (buildInfo.isReleaseBuild) {
+          val snapshotVersion = Regex("<version>.*-SNAPSHOT</version>")
+          val matches = snapshotVersion.findAll(text).toList()
+          if (matches.isNotEmpty()) {
+            throw org.gradle.api.GradleException(
+              """
+        Found snapshot version(s) in generated POM of Pkl release version:
+        ${matches.joinToString("\n") { it.groupValues[0] }}
+      """
+                .trimIndent()
+            )
+          }
+        }
+
+        outputFile.get().asFile.writeText("OK")
+      }
+    }
+
+  tasks.named("publish") { dependsOn(validatePom) }
+}
+
+/** Configures signing for Pkl publications. */
+fun Project.configurePklSigning() {
+  // Workaround for maven publish plugin not setting up dependencies correctly.
+  // Taken from https://github.com/gradle/gradle/issues/26091#issuecomment-1798137734
+  val dependsOnTasks = mutableListOf<String>()
+
+  tasks.withType<AbstractPublishToMaven>().configureEach {
+    dependsOnTasks.add(name.replace("publish", "sign").replaceAfter("Publication", ""))
+    dependsOn(dependsOnTasks)
+  }
+
+  extensions.configure<SigningExtension> {
+    // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and
+    // `ORG_GRADLE_PROJECT_signingPassword` in CI.
+    val signingKey =
+      (findProperty("signingKey") as String?)?.let {
+        Base64.getDecoder().decode(it).toString(StandardCharsets.US_ASCII)
+      }
+    val signingPassword = findProperty("signingPassword") as String?
+    if (signingKey != null && signingPassword != null) {
+      useInMemoryPgpKeys(signingKey, signingPassword)
+    }
+    extensions.getByType<PublishingExtension>().publications.findByName("library")?.let { sign(it) }
+  }
+}

buildSrc/src/main/kotlin/pklNativeLifecycle.gradle.kts

@@ -69,13 +69,12 @@ val assembleNative by
       buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
         wraps(assembleNativeWindowsAmd64)
       }
-      buildInfo.musl -> {
-        throw GradleException("Building musl on ${buildInfo.os} is not supported")
-      }
       else -> {
-        throw GradleException(
-          "Unsupported os/arch pair: ${buildInfo.os.name}/${buildInfo.targetArch}"
-        )
+        doLast {
+          throw GradleException(
+            "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+          )
+        }
       }
     }
   }
@@ -83,6 +82,7 @@ val assembleNative by
 val testNative by
   tasks.registering {
     group = "verification"
+    dependsOn(assembleNative)
 
     if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
       throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
@@ -105,13 +105,12 @@ val testNative by
       buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
         dependsOn(testNativeWindowsAmd64)
       }
-      buildInfo.musl -> {
-        throw GradleException("Building musl on ${buildInfo.os} is not supported")
-      }
       else -> {
-        throw GradleException(
-          "Unsupported os/arch pair: ${buildInfo.os.name}/${buildInfo.targetArch}"
-        )
+        doLast {
+          throw GradleException(
+            "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+          )
+        }
       }
     }
   }
@@ -125,5 +124,5 @@ val checkNative by
 val buildNative by
   tasks.registering {
     group = "build"
-    dependsOn(assembleNative, checkNative)
+    dependsOn(checkNative)
   }

buildSrc/src/main/kotlin/pklPublishLibrary.gradle.kts

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,10 +13,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import java.nio.charset.StandardCharsets
-import java.util.Base64
-import org.gradle.api.publish.maven.tasks.GenerateMavenPom
-
 plugins {
   `maven-publish`
   signing
@@ -27,119 +23,14 @@ publishing {
     components.findByName("java")?.let { javaComponent ->
       create<MavenPublication>("library") { from(javaComponent) }
     }
-    withType<MavenPublication>().configureEach {
-      pom {
-        name.set(artifactId)
-        licenses {
-          license {
-            name.set("The Apache Software License, Version 2.0")
-            url.set("https://github.com/apple/pkl/blob/main/LICENSE.txt")
-          }
-        }
-        developers {
-          developer {
-            id.set("pkl-authors")
-            name.set("The Pkl Authors")
-            email.set("pkl-oss@group.apple.com")
-          }
-        }
-        scm {
-          connection.set("scm:git:git://github.com/apple/pkl.git")
-          developerConnection.set("scm:git:ssh://github.com/apple/pkl.git")
-          val buildInfo = project.extensions.getByType<BuildInfo>()
-          url.set("https://github.com/apple/pkl/tree/${buildInfo.commitish}")
-        }
-        issueManagement {
-          system.set("GitHub Issues")
-          url.set("https://github.com/apple/pkl/issues")
-        }
-        ciManagement {
-          system.set("GitHub Actions")
-          url.set("https://github.com/apple/pkl/actions")
-        }
-      }
-    }
   }
 }
 
-val validatePom by
-  tasks.registering {
-    if (tasks.findByName("generatePomFileForLibraryPublication") == null) {
-      return@registering
-    }
-    val generatePomFileForLibraryPublication by tasks.existing(GenerateMavenPom::class)
-    val outputFile =
-      layout.buildDirectory.file("validatePom") // dummy output to satisfy up-to-date check
+configurePklPomMetadata()
 
-    dependsOn(generatePomFileForLibraryPublication)
-    inputs.file(generatePomFileForLibraryPublication.get().destination)
-    outputs.file(outputFile)
+configurePomValidation()
 
-    doLast {
-      outputFile.get().asFile.delete()
-
-      val pomFile = generatePomFileForLibraryPublication.get().destination
-      assert(pomFile.exists())
-
-      val text = pomFile.readText()
-
-      run {
-        val unresolvedVersion = Regex("<version>.*[+,()\\[\\]].*</version>")
-        val matches = unresolvedVersion.findAll(text).toList()
-        if (matches.isNotEmpty()) {
-          throw GradleException(
-            """
-        Found unresolved version selector(s) in generated POM:
-        ${matches.joinToString("\n") { it.groupValues[0] }}
-      """
-              .trimIndent()
-          )
-        }
-      }
-
-      val buildInfo = project.extensions.getByType<BuildInfo>()
-      if (buildInfo.isReleaseBuild) {
-        val snapshotVersion = Regex("<version>.*-SNAPSHOT</version>")
-        val matches = snapshotVersion.findAll(text).toList()
-        if (matches.isNotEmpty()) {
-          throw GradleException(
-            """
-        Found snapshot version(s) in generated POM of Pkl release version:
-        ${matches.joinToString("\n") { it.groupValues[0] }}
-      """
-              .trimIndent()
-          )
-        }
-      }
-
-      outputFile.get().asFile.writeText("OK")
-    }
-  }
-
-tasks.publish { dependsOn(validatePom) }
-
-// Workaround for maven publish plugin not setting up dependencies correctly.
-// Taken from https://github.com/gradle/gradle/issues/26091#issuecomment-1798137734
-val dependsOnTasks = mutableListOf<String>()
-
-tasks.withType<AbstractPublishToMaven>().configureEach {
-  dependsOnTasks.add(name.replace("publish", "sign").replaceAfter("Publication", ""))
-  dependsOn(dependsOnTasks)
-}
-
-signing {
-  // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and `ORG_GRADLE_PROJECT_signingPassword`
-  // in CI.
-  val signingKey =
-    (findProperty("signingKey") as String?)?.let {
-      Base64.getDecoder().decode(it).toString(StandardCharsets.US_ASCII)
-    }
-  val signingPassword = findProperty("signingPassword") as String?
-  if (signingKey != null && signingPassword != null) {
-    useInMemoryPgpKeys(signingKey, signingPassword)
-  }
-  publishing.publications.findByName("library")?.let { sign(it) }
-}
+configurePklSigning()
 
 artifacts {
   project.tasks.findByName("javadocJar")?.let { archives(it) }

docs/antora.yml

@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.30.2
-prerelease: false
+version: 0.31.0-dev
+prerelease: true
 nav:
 - nav.adoc

docs/modules/ROOT/partials/component-attributes.adoc

@@ -3,10 +3,10 @@
 // the following attributes must be updated immediately before a release
 
 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.30.2
+:pkl-version-no-suffix: 0.31.0
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
-:is-release-version: ''
+:!is-release-version:
 
 // the remaining attributes do not need to be updated regularly
 

docs/modules/java-binding/examples/JavaConfigExample.java

@@ -4,7 +4,7 @@ import org.pkl.config.java.JavaType;
 import org.pkl.core.ModuleSource;
 import org.junit.jupiter.api.Test;
 
-@SuppressWarnings("unused")
+@SuppressWarnings({"unused", "NewClassNamingConvention"})
 // the pkl-jvm-examples repo has a similar example
 public class JavaConfigExample {
   @Test

docs/modules/pkl-cli/pages/index.adoc

@@ -741,9 +741,9 @@ pkl shell-completion zsh
 This command formats or checks formatting of Pkl files. +
 Exit codes:
 
-* 0: No violations found.
+* 0: No violations found or files were updated.
 * 1: An unexpected error happened (ex.: IO error)
-* 11: Violations were found.
+* 11: Violations were found (when running without `--write`).
 
 If the path is a directory, recursively looks for files with a `.pkl` extension, or files named `PklProject`.
 

docs/modules/pkl-core/examples/CoreEvaluatorExample.java

@@ -7,7 +7,7 @@ import org.pkl.core.PObject;
 import org.junit.jupiter.api.Test;
 
 // the pkl-jvm-examples repo has a similar example
-@SuppressWarnings({"unchecked", "unused", "ConstantConditions"})
+@SuppressWarnings({"unchecked", "unused", "ConstantConditions", "NewClassNamingConvention"})
 public class CoreEvaluatorExample {
   @Test
   public void usage() {

docs/modules/release-notes/pages/0.31.adoc

@@ -0,0 +1,65 @@
+= Pkl 0.31 Release Notes
+:version: 0.31
+:version-minor: 0.XX.0
+:release-date: TBD
+
+include::ROOT:partial$component-attributes.adoc[]
+
+Pkl {version} was released on {release-date}. +
+[.small]#The latest bugfix release is {version-minor}. (xref:changelog.adoc[All Versions])#
+
+The next release (0.XX) is scheduled for ???..
+To see what's coming in the future, follow the {uri-pkl-roadmap}[Pkl Roadmap].
+
+Please send feedback and questions to https://github.com/apple/pkl/discussions[GitHub Discussions], or submit an issue on https://github.com/apple/pkl/issues/new[GitHub]. +
+
+[small]#Pkl is hosted on https://github.com/apple/pkl[GitHub].
+To get started, follow xref:pkl-cli:index.adoc#installation[Installation].#
+
+== Highlights [small]#💖#
+
+News you don't want to miss.
+
+=== XXX
+
+== Noteworthy [small]#🎶#
+
+Ready when you need them.
+
+=== Standard Library changes
+
+New properties have been added to the standard library (https://github.com/apple/pkl/pull/1396[#1396]).
+
+==== Additions to `pkl:base`
+
+The following APIs have been added:
+
+* link:{uri-stdlib-List}#isNotEmpty[`List.isNotEmpty`]
+* link:{uri-stdlib-Map}#isNotEmpty[`Map.isNotEmpty`]
+* link:{uri-stdlib-Set}#isNotEmpty[`Set.isNotEmpty`]
+* link:{uri-stdlib-Listing}#isNotEmpty[`Listing.isNotEmpty`]
+* link:{uri-stdlib-Mapping}#isNotEmpty[`Mapping.isNotEmpty`]
+* link:{uri-stdlib-String}#isNotEmpty[`String.isNotEmpty`]
+* link:{uri-stdlib-String}#isNotBlank[`String.isNotBlank`]
+
+== Breaking Changes [small]#💔#
+
+Things to watch out for when upgrading.
+
+=== XXX
+
+== Miscellaneous [small]#🐸#
+
+* XXX
+
+== Bugs fixed [small]#🐜#
+
+The following bugs have been fixed.
+
+* XXX (https://github.com/apple/pkl/issues/XXX[XXX])
+
+== Contributors [small]#🙏#
+
+We would like to thank the contributors to this release (in alphabetical order):
+
+* XXX

docs/modules/release-notes/pages/0.31.html

@@ -0,0 +1,826 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="generator" content="Asciidoctor 2.0.26">
+<title>Pkl 0.31 Release Notes</title>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700">
+<style>
+/*! Asciidoctor default stylesheet | MIT License | https://asciidoctor.org */
+/* Uncomment the following line when using as a custom stylesheet */
+/* @import "https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700"; */
+html{font-family:sans-serif;-webkit-text-size-adjust:100%}
+a{background:none}
+a:focus{outline:thin dotted}
+a:active,a:hover{outline:0}
+h1{font-size:2em;margin:.67em 0}
+b,strong{font-weight:bold}
+abbr{font-size:.9em}
+abbr[title]{cursor:help;border-bottom:1px dotted #dddddf;text-decoration:none}
+dfn{font-style:italic}
+hr{height:0}
+mark{background:#ff0;color:#000}
+code,kbd,pre,samp{font-family:monospace;font-size:1em}
+pre{white-space:pre-wrap}
+q{quotes:"\201C" "\201D" "\2018" "\2019"}
+small{font-size:80%}
+sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}
+sup{top:-.5em}
+sub{bottom:-.25em}
+img{border:0}
+svg:not(:root){overflow:hidden}
+figure{margin:0}
+audio,video{display:inline-block}
+audio:not([controls]){display:none;height:0}
+fieldset{border:1px solid silver;margin:0 2px;padding:.35em .625em .75em}
+legend{border:0;padding:0}
+button,input,select,textarea{font-family:inherit;font-size:100%;margin:0}
+button,input{line-height:normal}
+button,select{text-transform:none}
+button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}
+button[disabled],html input[disabled]{cursor:default}
+input[type=checkbox],input[type=radio]{padding:0}
+button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}
+textarea{overflow:auto;vertical-align:top}
+table{border-collapse:collapse;border-spacing:0}
+*,::before,::after{box-sizing:border-box}
+html,body{font-size:100%}
+body{background:#fff;color:rgba(0,0,0,.8);padding:0;margin:0;font-family:"Noto Serif","DejaVu Serif",serif;line-height:1;position:relative;cursor:auto;-moz-tab-size:4;-o-tab-size:4;tab-size:4;word-wrap:anywhere;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased}
+a:hover{cursor:pointer}
+img,object,embed{max-width:100%;height:auto}
+object,embed{height:100%}
+img{-ms-interpolation-mode:bicubic}
+.left{float:left!important}
+.right{float:right!important}
+.text-left{text-align:left!important}
+.text-right{text-align:right!important}
+.text-center{text-align:center!important}
+.text-justify{text-align:justify!important}
+.hide{display:none}
+img,object,svg{display:inline-block;vertical-align:middle}
+textarea{height:auto;min-height:50px}
+select{width:100%}
+.subheader,.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{line-height:1.45;color:#7a2518;font-weight:400;margin-top:0;margin-bottom:.25em}
+div,dl,dt,dd,ul,ol,li,h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6,pre,form,p,blockquote,th,td{margin:0;padding:0}
+a{color:#2156a5;text-decoration:underline;line-height:inherit}
+a:hover,a:focus{color:#1d4b8f}
+a img{border:0}
+p{line-height:1.6;margin-bottom:1.25em;text-rendering:optimizeLegibility}
+p aside{font-size:.875em;line-height:1.35;font-style:italic}
+h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{font-family:"Open Sans","DejaVu Sans",sans-serif;font-weight:300;font-style:normal;color:#ba3925;text-rendering:optimizeLegibility;margin-top:1em;margin-bottom:.5em;line-height:1.0125em}
+h1 small,h2 small,h3 small,#toctitle small,.sidebarblock>.content>.title small,h4 small,h5 small,h6 small{font-size:60%;color:#e99b8f;line-height:0}
+h1{font-size:2.125em}
+h2{font-size:1.6875em}
+h3,#toctitle,.sidebarblock>.content>.title{font-size:1.375em}
+h4,h5{font-size:1.125em}
+h6{font-size:1em}
+hr{border:solid #dddddf;border-width:1px 0 0;clear:both;margin:1.25em 0 1.1875em}
+em,i{font-style:italic;line-height:inherit}
+strong,b{font-weight:bold;line-height:inherit}
+small{font-size:60%;line-height:inherit}
+code{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;font-weight:400;color:rgba(0,0,0,.9)}
+ul,ol,dl{line-height:1.6;margin-bottom:1.25em;list-style-position:outside;font-family:inherit}
+ul,ol{margin-left:1.5em}
+ul li ul,ul li ol{margin-left:1.25em;margin-bottom:0}
+ul.circle{list-style-type:circle}
+ul.disc{list-style-type:disc}
+ul.square{list-style-type:square}
+ul.circle ul:not([class]),ul.disc ul:not([class]),ul.square ul:not([class]){list-style:inherit}
+ol li ul,ol li ol{margin-left:1.25em;margin-bottom:0}
+dl dt{margin-bottom:.3125em;font-weight:bold}
+dl dd{margin-bottom:1.25em}
+blockquote{margin:0 0 1.25em;padding:.5625em 1.25em 0 1.1875em;border-left:1px solid #ddd}
+blockquote,blockquote p{line-height:1.6;color:rgba(0,0,0,.85)}
+@media screen and (min-width:768px){h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2}
+h1{font-size:2.75em}
+h2{font-size:2.3125em}
+h3,#toctitle,.sidebarblock>.content>.title{font-size:1.6875em}
+h4{font-size:1.4375em}}
+table{background:#fff;margin-bottom:1.25em;border:1px solid #dedede;word-wrap:normal}
+table thead,table tfoot{background:#f7f8f7}
+table thead tr th,table thead tr td,table tfoot tr th,table tfoot tr td{padding:.5em .625em .625em;font-size:inherit;color:rgba(0,0,0,.8);text-align:left}
+table tr th,table tr td{padding:.5625em .625em;font-size:inherit;color:rgba(0,0,0,.8)}
+table tr.even,table tr.alt{background:#f8f8f7}
+table thead tr th,table tfoot tr th,table tbody tr td,table tr td,table tfoot tr td{line-height:1.6}
+h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2;word-spacing:-.05em}
+h1 strong,h2 strong,h3 strong,#toctitle strong,.sidebarblock>.content>.title strong,h4 strong,h5 strong,h6 strong{font-weight:400}
+.center{margin-left:auto;margin-right:auto}
+.stretch{width:100%}
+.clearfix::before,.clearfix::after,.float-group::before,.float-group::after{content:" ";display:table}
+.clearfix::after,.float-group::after{clear:both}
+:not(pre).nobreak{word-wrap:normal}
+:not(pre).nowrap{white-space:nowrap}
+:not(pre).pre-wrap{white-space:pre-wrap}
+:not(pre):not([class^=L])>code{font-size:.9375em;font-style:normal!important;letter-spacing:0;padding:.1em .5ex;word-spacing:-.15em;background:#f7f7f8;border-radius:4px;line-height:1.45;text-rendering:optimizeSpeed}
+pre{color:rgba(0,0,0,.9);font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;line-height:1.45;text-rendering:optimizeSpeed}
+pre code,pre pre{color:inherit;font-size:inherit;line-height:inherit}
+pre.nowrap,pre.nowrap pre{white-space:pre;word-wrap:normal}
+em em{font-style:normal}
+strong strong{font-weight:400}
+.keyseq{color:rgba(51,51,51,.8)}
+kbd{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;display:inline-block;color:rgba(0,0,0,.8);font-size:.65em;line-height:1.45;background:#f7f7f7;border:1px solid #ccc;border-radius:3px;box-shadow:0 1px 0 rgba(0,0,0,.2),inset 0 0 0 .1em #fff;margin:0 .15em;padding:.2em .5em;vertical-align:middle;position:relative;top:-.1em;white-space:nowrap}
+.keyseq kbd:first-child{margin-left:0}
+.keyseq kbd:last-child{margin-right:0}
+.menuseq,.menuref{color:#000}
+.menuseq b:not(.caret),.menuref{font-weight:inherit}
+.menuseq{word-spacing:-.02em}
+.menuseq b.caret{font-size:1.25em;line-height:.8}
+.menuseq i.caret{font-weight:bold;text-align:center;width:.45em}
+b.button::before,b.button::after{position:relative;top:-1px;font-weight:400}
+b.button::before{content:"[";padding:0 3px 0 2px}
+b.button::after{content:"]";padding:0 2px 0 3px}
+p a>code:hover{color:rgba(0,0,0,.9)}
+#header,#content,#footnotes,#footer{width:100%;margin:0 auto;max-width:62.5em;*zoom:1;position:relative;padding-left:.9375em;padding-right:.9375em}
+#header::before,#header::after,#content::before,#content::after,#footnotes::before,#footnotes::after,#footer::before,#footer::after{content:" ";display:table}
+#header::after,#content::after,#footnotes::after,#footer::after{clear:both}
+#content{margin-top:1.25em}
+#content::before{content:none}
+#header>h1:first-child{color:rgba(0,0,0,.85);margin-top:2.25rem;margin-bottom:0}
+#header>h1:first-child+#toc{margin-top:8px;border-top:1px solid #dddddf}
+#header>h1:only-child{border-bottom:1px solid #dddddf;padding-bottom:8px}
+#header .details{border-bottom:1px solid #dddddf;line-height:1.45;padding-top:.25em;padding-bottom:.25em;padding-left:.25em;color:rgba(0,0,0,.6);display:flex;flex-flow:row wrap}
+#header .details span:first-child{margin-left:-.125em}
+#header .details span.email a{color:rgba(0,0,0,.85)}
+#header .details br{display:none}
+#header .details br+span::before{content:"\00a0\2013\00a0"}
+#header .details br+span.author::before{content:"\00a0\22c5\00a0";color:rgba(0,0,0,.85)}
+#header .details br+span#revremark::before{content:"\00a0|\00a0"}
+#header #revnumber{text-transform:capitalize}
+#header #revnumber::after{content:"\00a0"}
+#content>h1:first-child:not([class]){color:rgba(0,0,0,.85);border-bottom:1px solid #dddddf;padding-bottom:8px;margin-top:0;padding-top:1rem;margin-bottom:1.25rem}
+#toc{border-bottom:1px solid #e7e7e9;padding-bottom:.5em}
+#toc>ul{margin-left:.125em}
+#toc ul.sectlevel0>li>a{font-style:italic}
+#toc ul.sectlevel0 ul.sectlevel1{margin:.5em 0}
+#toc ul{font-family:"Open Sans","DejaVu Sans",sans-serif;list-style-type:none}
+#toc li{line-height:1.3334;margin-top:.3334em}
+#toc a{text-decoration:none}
+#toc a:active{text-decoration:underline}
+#toctitle{color:#7a2518;font-size:1.2em}
+@media screen and (min-width:768px){#toctitle{font-size:1.375em}
+body.toc2{padding-left:15em;padding-right:0}
+body.toc2 #header>h1:nth-last-child(2){border-bottom:1px solid #dddddf;padding-bottom:8px}
+#toc.toc2{margin-top:0!important;background:#f8f8f7;position:fixed;width:15em;left:0;top:0;border-right:1px solid #e7e7e9;border-top-width:0!important;border-bottom-width:0!important;z-index:1000;padding:1.25em 1em;height:100%;overflow:auto}
+#toc.toc2 #toctitle{margin-top:0;margin-bottom:.8rem;font-size:1.2em}
+#toc.toc2>ul{font-size:.9em;margin-bottom:0}
+#toc.toc2 ul ul{margin-left:0;padding-left:1em}
+#toc.toc2 ul.sectlevel0 ul.sectlevel1{padding-left:0;margin-top:.5em;margin-bottom:.5em}
+body.toc2.toc-right{padding-left:0;padding-right:15em}
+body.toc2.toc-right #toc.toc2{border-right-width:0;border-left:1px solid #e7e7e9;left:auto;right:0}}
+@media screen and (min-width:1280px){body.toc2{padding-left:20em;padding-right:0}
+#toc.toc2{width:20em}
+#toc.toc2 #toctitle{font-size:1.375em}
+#toc.toc2>ul{font-size:.95em}
+#toc.toc2 ul ul{padding-left:1.25em}
+body.toc2.toc-right{padding-left:0;padding-right:20em}}
+#content #toc{border:1px solid #e0e0dc;margin-bottom:1.25em;padding:1.25em;background:#f8f8f7;border-radius:4px}
+#content #toc>:first-child{margin-top:0}
+#content #toc>:last-child{margin-bottom:0}
+#footer{max-width:none;background:rgba(0,0,0,.8);padding:1.25em}
+#footer-text{color:hsla(0,0%,100%,.8);line-height:1.44}
+#content{margin-bottom:.625em}
+.sect1{padding-bottom:.625em}
+@media screen and (min-width:768px){#content{margin-bottom:1.25em}
+.sect1{padding-bottom:1.25em}}
+.sect1:last-child{padding-bottom:0}
+.sect1+.sect1{border-top:1px solid #e7e7e9}
+#content h1>a.anchor,h2>a.anchor,h3>a.anchor,#toctitle>a.anchor,.sidebarblock>.content>.title>a.anchor,h4>a.anchor,h5>a.anchor,h6>a.anchor{position:absolute;z-index:1001;width:1.5ex;margin-left:-1.5ex;display:block;text-decoration:none!important;visibility:hidden;text-align:center;font-weight:400}
+#content h1>a.anchor::before,h2>a.anchor::before,h3>a.anchor::before,#toctitle>a.anchor::before,.sidebarblock>.content>.title>a.anchor::before,h4>a.anchor::before,h5>a.anchor::before,h6>a.anchor::before{content:"\00A7";font-size:.85em;display:block;padding-top:.1em}
+#content h1:hover>a.anchor,#content h1>a.anchor:hover,h2:hover>a.anchor,h2>a.anchor:hover,h3:hover>a.anchor,#toctitle:hover>a.anchor,.sidebarblock>.content>.title:hover>a.anchor,h3>a.anchor:hover,#toctitle>a.anchor:hover,.sidebarblock>.content>.title>a.anchor:hover,h4:hover>a.anchor,h4>a.anchor:hover,h5:hover>a.anchor,h5>a.anchor:hover,h6:hover>a.anchor,h6>a.anchor:hover{visibility:visible}
+#content h1>a.link,h2>a.link,h3>a.link,#toctitle>a.link,.sidebarblock>.content>.title>a.link,h4>a.link,h5>a.link,h6>a.link{color:#ba3925;text-decoration:none}
+#content h1>a.link:hover,h2>a.link:hover,h3>a.link:hover,#toctitle>a.link:hover,.sidebarblock>.content>.title>a.link:hover,h4>a.link:hover,h5>a.link:hover,h6>a.link:hover{color:#a53221}
+details,.audioblock,.imageblock,.literalblock,.listingblock,.stemblock,.videoblock{margin-bottom:1.25em}
+details{margin-left:1.25rem}
+details>summary{cursor:pointer;display:block;position:relative;line-height:1.6;margin-bottom:.625rem;outline:none;-webkit-tap-highlight-color:transparent}
+details>summary::-webkit-details-marker{display:none}
+details>summary::before{content:"";border:solid transparent;border-left:solid;border-width:.3em 0 .3em .5em;position:absolute;top:.5em;left:-1.25rem;transform:translateX(15%)}
+details[open]>summary::before{border:solid transparent;border-top:solid;border-width:.5em .3em 0;transform:translateY(15%)}
+details>summary::after{content:"";width:1.25rem;height:1em;position:absolute;top:.3em;left:-1.25rem}
+.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{text-rendering:optimizeLegibility;text-align:left;font-family:"Noto Serif","DejaVu Serif",serif;font-size:1rem;font-style:italic}
+table.tableblock.fit-content>caption.title{white-space:nowrap;width:0}
+.paragraph.lead>p,#preamble>.sectionbody>[class=paragraph]:first-of-type p{font-size:1.21875em;line-height:1.6;color:rgba(0,0,0,.85)}
+.admonitionblock>table{border-collapse:separate;border:0;background:none;width:100%}
+.admonitionblock>table td.icon{text-align:center;width:80px}
+.admonitionblock>table td.icon img{max-width:none}
+.admonitionblock>table td.icon .title{font-weight:bold;font-family:"Open Sans","DejaVu Sans",sans-serif;text-transform:uppercase}
+.admonitionblock>table td.content{padding-left:1.125em;padding-right:1.25em;border-left:1px solid #dddddf;color:rgba(0,0,0,.6);word-wrap:anywhere}
+.admonitionblock>table td.content>:last-child>:last-child{margin-bottom:0}
+.exampleblock>.content{border:1px solid #e6e6e6;margin-bottom:1.25em;padding:1.25em;background:#fff;border-radius:4px}
+.sidebarblock{border:1px solid #dbdbd6;margin-bottom:1.25em;padding:1.25em;background:#f3f3f2;border-radius:4px}
+.sidebarblock>.content>.title{color:#7a2518;margin-top:0;text-align:center}
+.exampleblock>.content>:first-child,.sidebarblock>.content>:first-child{margin-top:0}
+.exampleblock>.content>:last-child,.exampleblock>.content>:last-child>:last-child,.exampleblock>.content .olist>ol>li:last-child>:last-child,.exampleblock>.content .ulist>ul>li:last-child>:last-child,.exampleblock>.content .qlist>ol>li:last-child>:last-child,.sidebarblock>.content>:last-child,.sidebarblock>.content>:last-child>:last-child,.sidebarblock>.content .olist>ol>li:last-child>:last-child,.sidebarblock>.content .ulist>ul>li:last-child>:last-child,.sidebarblock>.content .qlist>ol>li:last-child>:last-child{margin-bottom:0}
+.literalblock pre,.listingblock>.content>pre{border-radius:4px;overflow-x:auto;padding:1em;font-size:.8125em}
+@media screen and (min-width:768px){.literalblock pre,.listingblock>.content>pre{font-size:.90625em}}
+@media screen and (min-width:1280px){.literalblock pre,.listingblock>.content>pre{font-size:1em}}
+.literalblock pre,.listingblock>.content>pre:not(.highlight),.listingblock>.content>pre[class=highlight],.listingblock>.content>pre[class^="highlight "]{background:#f7f7f8}
+.literalblock.output pre{color:#f7f7f8;background:rgba(0,0,0,.9)}
+.listingblock>.content{position:relative}
+.listingblock pre>code{display:block}
+.listingblock code[data-lang]::before{display:none;content:attr(data-lang);position:absolute;font-size:.75em;top:.425rem;right:.5rem;line-height:1;text-transform:uppercase;color:inherit;opacity:.5}
+.listingblock:hover code[data-lang]::before{display:block}
+.listingblock.terminal pre .command::before{content:attr(data-prompt);padding-right:.5em;color:inherit;opacity:.5}
+.listingblock.terminal pre .command:not([data-prompt])::before{content:"$"}
+.listingblock pre.highlightjs{padding:0}
+.listingblock pre.highlightjs>code{padding:1em;border-radius:4px}
+.listingblock pre.prettyprint{border-width:0}
+.prettyprint{background:#f7f7f8}
+pre.prettyprint .linenums{line-height:1.45;margin-left:2em}
+pre.prettyprint li{background:none;list-style-type:inherit;padding-left:0}
+pre.prettyprint li code[data-lang]::before{opacity:1}
+pre.prettyprint li:not(:first-child) code[data-lang]::before{display:none}
+table.linenotable{border-collapse:separate;border:0;margin-bottom:0;background:none}
+table.linenotable td[class]{color:inherit;vertical-align:top;padding:0;line-height:inherit;white-space:normal}
+table.linenotable td.code{padding-left:.75em}
+table.linenotable td.linenos,pre.pygments .linenos{border-right:1px solid;opacity:.35;padding-right:.5em;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}
+pre.pygments span.linenos{display:inline-block;margin-right:.75em}
+.quoteblock{margin:0 1em 1.25em 1.5em;display:table}
+.quoteblock:not(.excerpt)>.title{margin-left:-1.5em;margin-bottom:.75em}
+.quoteblock blockquote,.quoteblock p{color:rgba(0,0,0,.85);font-size:1.15rem;line-height:1.75;word-spacing:.1em;letter-spacing:0;font-style:italic;text-align:justify}
+.quoteblock blockquote{margin:0;padding:0;border:0}
+.quoteblock blockquote::before{content:"\201c";float:left;font-size:2.75em;font-weight:bold;line-height:.6em;margin-left:-.6em;color:#7a2518;text-shadow:0 1px 2px rgba(0,0,0,.1)}
+.quoteblock blockquote>.paragraph:last-child p{margin-bottom:0}
+.quoteblock .attribution{margin-top:.75em;margin-right:.5ex;text-align:right}
+.verseblock{margin:0 1em 1.25em}
+.verseblock pre{font-family:"Open Sans","DejaVu Sans",sans-serif;font-size:1.15rem;color:rgba(0,0,0,.85);font-weight:300;text-rendering:optimizeLegibility}
+.verseblock pre strong{font-weight:400}
+.verseblock .attribution{margin-top:1.25rem;margin-left:.5ex}
+.quoteblock .attribution,.verseblock .attribution{font-size:.9375em;line-height:1.45;font-style:italic}
+.quoteblock .attribution br,.verseblock .attribution br{display:none}
+.quoteblock .attribution cite,.verseblock .attribution cite{display:block;letter-spacing:-.025em;color:rgba(0,0,0,.6)}
+.quoteblock.abstract blockquote::before,.quoteblock.excerpt blockquote::before,.quoteblock .quoteblock blockquote::before{display:none}
+.quoteblock.abstract blockquote,.quoteblock.abstract p,.quoteblock.excerpt blockquote,.quoteblock.excerpt p,.quoteblock .quoteblock blockquote,.quoteblock .quoteblock p{line-height:1.6;word-spacing:0}
+.quoteblock.abstract{margin:0 1em 1.25em;display:block}
+.quoteblock.abstract>.title{margin:0 0 .375em;font-size:1.15em;text-align:center}
+.quoteblock.excerpt>blockquote,.quoteblock .quoteblock{padding:0 0 .25em 1em;border-left:.25em solid #dddddf}
+.quoteblock.excerpt,.quoteblock .quoteblock{margin-left:0}
+.quoteblock.excerpt blockquote,.quoteblock.excerpt p,.quoteblock .quoteblock blockquote,.quoteblock .quoteblock p{color:inherit;font-size:1.0625rem}
+.quoteblock.excerpt .attribution,.quoteblock .quoteblock .attribution{color:inherit;font-size:.85rem;text-align:left;margin-right:0}
+p.tableblock:last-child{margin-bottom:0}
+td.tableblock>.content{margin-bottom:1.25em;word-wrap:anywhere}
+td.tableblock>.content>:last-child{margin-bottom:-1.25em}
+table.tableblock,th.tableblock,td.tableblock{border:0 solid #dedede}
+table.grid-all>*>tr>*{border-width:1px}
+table.grid-cols>*>tr>*{border-width:0 1px}
+table.grid-rows>*>tr>*{border-width:1px 0}
+table.frame-all{border-width:1px}
+table.frame-ends{border-width:1px 0}
+table.frame-sides{border-width:0 1px}
+table.frame-none>colgroup+*>:first-child>*,table.frame-sides>colgroup+*>:first-child>*{border-top-width:0}
+table.frame-none>:last-child>:last-child>*,table.frame-sides>:last-child>:last-child>*{border-bottom-width:0}
+table.frame-none>*>tr>:first-child,table.frame-ends>*>tr>:first-child{border-left-width:0}
+table.frame-none>*>tr>:last-child,table.frame-ends>*>tr>:last-child{border-right-width:0}
+table.stripes-all>*>tr,table.stripes-odd>*>tr:nth-of-type(odd),table.stripes-even>*>tr:nth-of-type(even),table.stripes-hover>*>tr:hover{background:#f8f8f7}
+th.halign-left,td.halign-left{text-align:left}
+th.halign-right,td.halign-right{text-align:right}
+th.halign-center,td.halign-center{text-align:center}
+th.valign-top,td.valign-top{vertical-align:top}
+th.valign-bottom,td.valign-bottom{vertical-align:bottom}
+th.valign-middle,td.valign-middle{vertical-align:middle}
+table thead th,table tfoot th{font-weight:bold}
+tbody tr th{background:#f7f8f7}
+tbody tr th,tbody tr th p,tfoot tr th,tfoot tr th p{color:rgba(0,0,0,.8);font-weight:bold}
+p.tableblock>code:only-child{background:none;padding:0}
+p.tableblock{font-size:1em}
+ol{margin-left:1.75em}
+ul li ol{margin-left:1.5em}
+dl dd{margin-left:1.125em}
+dl dd:last-child,dl dd:last-child>:last-child{margin-bottom:0}
+li p,ul dd,ol dd,.olist .olist,.ulist .ulist,.ulist .olist,.olist .ulist{margin-bottom:.625em}
+ul.checklist,ul.none,ol.none,ul.no-bullet,ol.no-bullet,ol.unnumbered,ul.unstyled,ol.unstyled{list-style-type:none}
+ul.no-bullet,ol.no-bullet,ol.unnumbered{margin-left:.625em}
+ul.unstyled,ol.unstyled{margin-left:0}
+li>p:empty:only-child::before{content:"";display:inline-block}
+ul.checklist>li>p:first-child{margin-left:-1em}
+ul.checklist>li>p:first-child>.fa-square-o:first-child,ul.checklist>li>p:first-child>.fa-check-square-o:first-child{width:1.25em;font-size:.8em;position:relative;bottom:.125em}
+ul.checklist>li>p:first-child>input[type=checkbox]:first-child{margin-right:.25em}
+ul.inline{display:flex;flex-flow:row wrap;list-style:none;margin:0 0 .625em -1.25em}
+ul.inline>li{margin-left:1.25em}
+.unstyled dl dt{font-weight:400;font-style:normal}
+ol.arabic{list-style-type:decimal}
+ol.decimal{list-style-type:decimal-leading-zero}
+ol.loweralpha{list-style-type:lower-alpha}
+ol.upperalpha{list-style-type:upper-alpha}
+ol.lowerroman{list-style-type:lower-roman}
+ol.upperroman{list-style-type:upper-roman}
+ol.lowergreek{list-style-type:lower-greek}
+.hdlist>table,.colist>table{border:0;background:none}
+.hdlist>table>tbody>tr,.colist>table>tbody>tr{background:none}
+td.hdlist1,td.hdlist2{vertical-align:top;padding:0 .625em}
+td.hdlist1{font-weight:bold;padding-bottom:1.25em}
+td.hdlist2{word-wrap:anywhere}
+.literalblock+.colist,.listingblock+.colist{margin-top:-.5em}
+.colist td:not([class]):first-child{padding:.4em .75em 0;line-height:1;vertical-align:top}
+.colist td:not([class]):first-child img{max-width:none}
+.colist td:not([class]):last-child{padding:.25em 0}
+.thumb,.th{line-height:0;display:inline-block;border:4px solid #fff;box-shadow:0 0 0 1px #ddd}
+.imageblock.left{margin:.25em .625em 1.25em 0}
+.imageblock.right{margin:.25em 0 1.25em .625em}
+.imageblock>.title{margin-bottom:0}
+.imageblock.thumb,.imageblock.th{border-width:6px}
+.imageblock.thumb>.title,.imageblock.th>.title{padding:0 .125em}
+.image.left,.image.right{margin-top:.25em;margin-bottom:.25em;display:inline-block;line-height:0}
+.image.left{margin-right:.625em}
+.image.right{margin-left:.625em}
+a.image{text-decoration:none;display:inline-block}
+a.image object{pointer-events:none}
+sup.footnote,sup.footnoteref{font-size:.875em;position:static;vertical-align:super}
+sup.footnote a,sup.footnoteref a{text-decoration:none}
+sup.footnote a:active,sup.footnoteref a:active,#footnotes .footnote a:first-of-type:active{text-decoration:underline}
+#footnotes{padding-top:.75em;padding-bottom:.75em;margin-bottom:.625em}
+#footnotes hr{width:20%;min-width:6.25em;margin:-.25em 0 .75em;border-width:1px 0 0}
+#footnotes .footnote{padding:0 .375em 0 .225em;line-height:1.3334;font-size:.875em;margin-left:1.2em;margin-bottom:.2em}
+#footnotes .footnote a:first-of-type{font-weight:bold;text-decoration:none;margin-left:-1.05em}
+#footnotes .footnote:last-of-type{margin-bottom:0}
+#content #footnotes{margin-top:-.625em;margin-bottom:0;padding:.75em 0}
+div.unbreakable{page-break-inside:avoid}
+.big{font-size:larger}
+.small{font-size:smaller}
+.underline{text-decoration:underline}
+.overline{text-decoration:overline}
+.line-through{text-decoration:line-through}
+.aqua{color:#00bfbf}
+.aqua-background{background:#00fafa}
+.black{color:#000}
+.black-background{background:#000}
+.blue{color:#0000bf}
+.blue-background{background:#0000fa}
+.fuchsia{color:#bf00bf}
+.fuchsia-background{background:#fa00fa}
+.gray{color:#606060}
+.gray-background{background:#7d7d7d}
+.green{color:#006000}
+.green-background{background:#007d00}
+.lime{color:#00bf00}
+.lime-background{background:#00fa00}
+.maroon{color:#600000}
+.maroon-background{background:#7d0000}
+.navy{color:#000060}
+.navy-background{background:#00007d}
+.olive{color:#606000}
+.olive-background{background:#7d7d00}
+.purple{color:#600060}
+.purple-background{background:#7d007d}
+.red{color:#bf0000}
+.red-background{background:#fa0000}
+.silver{color:#909090}
+.silver-background{background:#bcbcbc}
+.teal{color:#006060}
+.teal-background{background:#007d7d}
+.white{color:#bfbfbf}
+.white-background{background:#fafafa}
+.yellow{color:#bfbf00}
+.yellow-background{background:#fafa00}
+span.icon>.fa{cursor:default}
+a span.icon>.fa{cursor:inherit}
+.admonitionblock td.icon [class^="fa icon-"]{font-size:2.5em;text-shadow:1px 1px 2px rgba(0,0,0,.5);cursor:default}
+.admonitionblock td.icon .icon-note::before{content:"\f05a";color:#19407c}
+.admonitionblock td.icon .icon-tip::before{content:"\f0eb";text-shadow:1px 1px 2px rgba(155,155,0,.8);color:#111}
+.admonitionblock td.icon .icon-warning::before{content:"\f071";color:#bf6900}
+.admonitionblock td.icon .icon-caution::before{content:"\f06d";color:#bf3400}
+.admonitionblock td.icon .icon-important::before{content:"\f06a";color:#bf0000}
+.conum[data-value]{display:inline-block;color:#fff!important;background:rgba(0,0,0,.8);border-radius:50%;text-align:center;font-size:.75em;width:1.67em;height:1.67em;line-height:1.67em;font-family:"Open Sans","DejaVu Sans",sans-serif;font-style:normal;font-weight:bold}
+.conum[data-value] *{color:#fff!important}
+.conum[data-value]+b{display:none}
+.conum[data-value]::after{content:attr(data-value)}
+pre .conum[data-value]{position:relative;top:-.125em}
+b.conum *{color:inherit!important}
+.conum:not([data-value]):empty{display:none}
+dt,th.tableblock,td.content,div.footnote{text-rendering:optimizeLegibility}
+h1,h2,p,td.content,span.alt,summary{letter-spacing:-.01em}
+p strong,td.content strong,div.footnote strong{letter-spacing:-.005em}
+p,blockquote,dt,td.content,td.hdlist1,span.alt,summary{font-size:1.0625rem}
+p{margin-bottom:1.25rem}
+.sidebarblock p,.sidebarblock dt,.sidebarblock td.content,p.tableblock{font-size:1em}
+.exampleblock>.content{background:#fffef7;border-color:#e0e0dc;box-shadow:0 1px 4px #e0e0dc}
+.print-only{display:none!important}
+@page{margin:1.25cm .75cm}
+@media print{*{box-shadow:none!important;text-shadow:none!important}
+html{font-size:80%}
+a{color:inherit!important;text-decoration:underline!important}
+a.bare,a[href^="#"],a[href^="mailto:"]{text-decoration:none!important}
+a[href^="http:"]:not(.bare)::after,a[href^="https:"]:not(.bare)::after{content:"(" attr(href) ")";display:inline-block;font-size:.875em;padding-left:.25em}
+abbr[title]{border-bottom:1px dotted}
+abbr[title]::after{content:" (" attr(title) ")"}
+pre,blockquote,tr,img,object,svg{page-break-inside:avoid}
+thead{display:table-header-group}
+svg{max-width:100%}
+p,blockquote,dt,td.content{font-size:1em;orphans:3;widows:3}
+h2,h3,#toctitle,.sidebarblock>.content>.title{page-break-after:avoid}
+#header,#content,#footnotes,#footer{max-width:none}
+#toc,.sidebarblock,.exampleblock>.content{background:none!important}
+#toc{border-bottom:1px solid #dddddf!important;padding-bottom:0!important}
+body.book #header{text-align:center}
+body.book #header>h1:first-child{border:0!important;margin:2.5em 0 1em}
+body.book #header .details{border:0!important;display:block;padding:0!important}
+body.book #header .details span:first-child{margin-left:0!important}
+body.book #header .details br{display:block}
+body.book #header .details br+span::before{content:none!important}
+body.book #toc{border:0!important;text-align:left!important;padding:0!important;margin:0!important}
+body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-break-before:always}
+.listingblock code[data-lang]::before{display:block}
+#footer{padding:0 .9375em}
+.hide-on-print{display:none!important}
+.print-only{display:block!important}
+.hide-for-print{display:none!important}
+.show-for-print{display:inherit!important}}
+@media amzn-kf8,print{#header>h1:first-child{margin-top:1.25rem}
+.sect1{padding:0!important}
+.sect1+.sect1{border:0}
+#footer{background:none}
+#footer-text{color:rgba(0,0,0,.6);font-size:.9em}}
+@media amzn-kf8{#header,#content,#footnotes,#footer{padding:0}}
+</style>
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.18.3/styles/github.min.css">
+<style>
+/*! Asciidoctor Tabs | Copyright (c) 2018-present Dan Allen | MIT License */
+.tabs {
+    margin-bottom: 1.25em;
+}
+
+.tablist > ul {
+    display: flex;
+    flex-wrap: wrap;
+    list-style: none;
+    margin: 0;
+    padding: 0;
+}
+
+.tablist > ul li {
+    align-items: center;
+    background-color: #fff;
+    cursor: pointer;
+    display: flex;
+    font-weight: bold;
+    line-height: 1.5;
+    padding: 0.25em 1em;
+    position: relative;
+}
+
+.tablist > ul li:focus-visible {
+    outline: none;
+}
+
+.tablist.ulist,
+.tablist.ulist > ul li {
+    margin: 0;
+}
+
+.tablist.ulist > ul li + li {
+    margin-left: 0.25em;
+}
+
+.tabs .tablist li::after {
+    content: "";
+    display: block;
+    height: 1px;
+    position: absolute;
+    bottom: -1px;
+    left: 0;
+    right: 0;
+}
+
+.tabs.is-loading .tablist li:not(:first-child),
+.tabs:not(.is-loading) .tablist li:not(.is-selected) {
+    background-color: #f5f5f5;
+}
+
+.tabs.is-loading .tablist li:first-child::after,
+.tabs:not(.is-loading) .tablist li.is-selected::after {
+    background-color: #fff;
+}
+
+/*
+.tabs:not(.is-loading) .tablist li,
+.tabs:not(.is-loading) .tablist li::after {
+  transition: background-color 200ms ease-in-out;
+}
+*/
+
+.tablist > ul p {
+    line-height: inherit;
+    margin: 0;
+}
+
+.tabpanel {
+    background-color: #fff;
+    padding: 1.25em;
+}
+
+.tablist > ul li,
+.tabpanel {
+    border: 1px solid #dcdcdc;
+}
+
+.tablist > ul li {
+    border-bottom: 0;
+}
+
+.tabs.is-loading .tabpanel + .tabpanel,
+.tabs:not(.is-loading) .tabpanel.is-hidden {
+    display: none;
+}
+
+.tabpanel > :first-child {
+    margin-top: 0;
+}
+
+/* #content is a signature of the Asciidoctor standalone HTML output */
+#content .tabpanel > :last-child,
+#content .tabpanel > :last-child > :last-child,
+#content .tabpanel > :last-child > :last-child > li:last-child > :last-child {
+    margin-bottom: 0;
+}
+
+.tablecontainer {
+    overflow-x: auto;
+}
+
+#content .tablecontainer {
+    margin-bottom: 1.25em;
+}
+
+#content .tablecontainer > table.tableblock {
+    margin-bottom: 0;
+}
+</style>
+</head>
+<body class="article">
+<div id="header">
+<h1>Pkl 0.31 Release Notes</h1>
+</div>
+<div id="content">
+<div id="preamble">
+<div class="sectionbody">
+<div class="paragraph">
+<p><a href="ROOT:partial$component-attributes.adoc" class="bare include">ROOT:partial$component-attributes.adoc</a></p>
+</div>
+<div class="paragraph">
+<p>Pkl 0.31 was released on TBD.<br>
+<span class="small">The latest bugfix release is 0.XX.0. (<a href="changelog.html">All Versions</a>)</span></p>
+</div>
+<div class="paragraph">
+<p>The next release (0.XX) is scheduled for ???..
+To see what&#8217;s coming in the future, follow the {uri-pkl-roadmap}[Pkl Roadmap].</p>
+</div>
+<div class="paragraph">
+<p>Please send feedback and questions to <a href="https://github.com/apple/pkl/discussions">GitHub Discussions</a>, or submit an issue on <a href="https://github.com/apple/pkl/issues/new">GitHub</a>.<br></p>
+</div>
+<div class="paragraph">
+<p><span class="small">Pkl is hosted on <a href="https://github.com/apple/pkl">GitHub</a>.
+To get started, follow <a href="../../pkl-cli/pages/index.html#installation">Installation</a>.</span></p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_highlights">Highlights <span class="small">💖</span></h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>News you don&#8217;t want to miss.</p>
+</div>
+<div class="sect2">
+<h3 id="_xxx">XXX</h3>
+
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_noteworthy">Noteworthy <span class="small">🎶</span></h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Ready when you need them.</p>
+</div>
+<div class="sect2">
+<h3 id="_new_standard_library_methods">New standard library methods</h3>
+<div class="paragraph">
+<p>The following APIs have been added to the standard library:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="{uri-stdlib-List}#isNotEmpty">List.isNotEmpty</a></p>
+</li>
+<li>
+<p><a href="{uri-stdlib-Map}#isNotEmpty">Map.isNotEmpty</a></p>
+</li>
+<li>
+<p><a href="{uri-stdlib-Set}#isNotEmpty">Set.isNotEmpty</a></p>
+</li>
+<li>
+<p><a href="{uri-stdlib-Listing}#isNotEmpty">Listing.isNotEmpty</a></p>
+</li>
+<li>
+<p><a href="{uri-stdlib-Mapping}#isNotEmpty">Mapping.isNotEmpty</a></p>
+</li>
+<li>
+<p><a href="{uri-stdlib-String}#isNotEmpty">String.isNotEmpty</a></p>
+</li>
+<li>
+<p><a href="{uri-stdlib-String}#isNotBlank">String.isNotBlank</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_breaking_changes">Breaking Changes <span class="small">💔</span></h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Things to watch out for when upgrading.</p>
+</div>
+<div class="sect2">
+<h3 id="_xxx_2">XXX</h3>
+
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_miscellaneous">Miscellaneous <span class="small">🐸</span></h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p>XXX</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_bugs_fixed">Bugs fixed <span class="small">🐜</span></h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The following bugs have been fixed.</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>XXX (<a href="https://github.com/apple/pkl/issues/XXX">XXX</a>)</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_contributors">Contributors <span class="small">🙏</span></h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>We would like to thank the contributors to this release (in alphabetical order):</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>XXX</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+</div>
+<div id="footer">
+<div id="footer-text">
+Last updated 2026-01-08 12:57:37 -0800
+</div>
+</div>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.18.3/highlight.min.js"></script>
+<script>
+if (!hljs.initHighlighting.called) {
+  hljs.initHighlighting.called = true
+  ;[].slice.call(document.querySelectorAll('pre.highlight > code[data-lang]')).forEach(function (el) { hljs.highlightBlock(el) })
+}
+</script>
+<script>
+;(function () { /*! Asciidoctor Tabs | Copyright (c) 2018-present Dan Allen | MIT License */
+  'use strict'
+
+  var config = (document.currentScript || {}).dataset || {}
+  var forEach = Array.prototype.forEach
+
+  init(document.querySelectorAll('.tabs'))
+
+  function init (tabsBlocks) {
+    if (!tabsBlocks.length) return
+    forEach.call(tabsBlocks, function (tabs) {
+      var syncIds = tabs.classList.contains('is-sync') ? {} : undefined
+      var tablist = tabs.querySelector('.tablist ul')
+      tablist.setAttribute('role', 'tablist')
+      var start
+      forEach.call(tablist.querySelectorAll('li'), function (tab, idx) {
+        tab.tabIndex = -1
+        tab.setAttribute('role', tab.classList.add('tab') || 'tab')
+        var id, anchor, syncId
+        if (!(id = tab.id) && (anchor = tab.querySelector('a[id]'))) {
+          id = tab.id = anchor.parentNode.removeChild(anchor).id
+        }
+        var panel = id && tabs.querySelector('.tabpanel[aria-labelledby~="' + id + '"]')
+        if (!panel) return idx ? undefined : toggleSelected(tab, true) // invalid state
+        syncIds && (((syncId = tab.textContent.trim()) in syncIds) ? (syncId = undefined) : true) &&
+        (syncIds[(tab.dataset.syncId = syncId)] = tab)
+        idx || (syncIds && (start = { tab: tab, panel: panel })) ? toggleHidden(panel, true) : toggleSelected(tab, true)
+        tab.setAttribute('aria-controls', panel.id)
+        panel.setAttribute('role', 'tabpanel')
+        var onClick = syncId === undefined ? activateTab : activateTabSync
+        tab.addEventListener('click', onClick.bind({ tabs: tabs, tab: tab, panel: panel }))
+      })
+      if (!tabs.closest('.tabpanel')) {
+        forEach.call(tabs.querySelectorAll('.tabpanel table.tableblock'), function (table) {
+          var container = Object.assign(document.createElement('div'), { className: 'tablecontainer' })
+          table.parentNode.insertBefore(container, table).appendChild(table)
+        })
+      }
+      if (start) {
+        var syncGroupId
+        for (var i = 0, lst = tabs.classList, len = lst.length, className; i !== len; i++) {
+          if (!(className = lst.item(i)).startsWith('data-sync-group-id=')) continue
+          tabs.dataset.syncGroupId = syncGroupId = lst.remove(className) || className.slice(19).replace(/\u00a0/g, ' ')
+          break
+        }
+        if (syncGroupId === undefined) tabs.dataset.syncGroupId = syncGroupId = Object.keys(syncIds).sort().join('|')
+        var preferredSyncId = 'syncStorageKey' in config &&
+          window[(config.syncStorageScope || 'local') + 'Storage'].getItem(config.syncStorageKey + '-' + syncGroupId)
+        var tab = preferredSyncId && syncIds[preferredSyncId]
+        tab && Object.assign(start, { tab: tab, panel: document.getElementById(tab.getAttribute('aria-controls')) })
+        toggleSelected(start.tab, true) || toggleHidden(start.panel, false)
+      }
+    })
+    onHashChange()
+    toggleClassOnEach(tabsBlocks, 'is-loading', 'remove')
+    window.setTimeout(toggleClassOnEach.bind(null, tabsBlocks, 'is-loaded', 'add'), 0)
+    window.addEventListener('hashchange', onHashChange)
+  }
+
+  function activateTab (e) {
+    var tab = this.tab
+    var tabs = this.tabs || (this.tabs = tab.closest('.tabs'))
+    var panel = this.panel || (this.panel = document.getElementById(tab.getAttribute('aria-controls')))
+    querySelectorWithSiblings(tabs, '.tablist .tab', 'tab').forEach(function (el) {
+      toggleSelected(el, el === tab)
+    })
+    querySelectorWithSiblings(tabs, '.tabpanel', 'tabpanel').forEach(function (el) {
+      toggleHidden(el, el !== panel)
+    })
+    if (!this.isSync && 'syncStorageKey' in config && 'syncGroupId' in tabs.dataset) {
+      var storageKey = config.syncStorageKey + '-' + tabs.dataset.syncGroupId
+      window[(config.syncStorageScope || 'local') + 'Storage'].setItem(storageKey, tab.dataset.syncId)
+    }
+    if (!e) return
+    var loc = window.location
+    var hashIdx = loc.hash ? loc.href.indexOf('#') : -1
+    if (~hashIdx) window.history.replaceState(null, '', loc.href.slice(0, hashIdx))
+    e.preventDefault()
+  }
+
+  function activateTabSync (e) {
+    activateTab.call(this, e)
+    var thisTabs = this.tabs
+    var thisTab = this.tab
+    var initialY = thisTabs.getBoundingClientRect().y
+    forEach.call(document.querySelectorAll('.tabs'), function (tabs) {
+      if (tabs === thisTabs || tabs.dataset.syncGroupId !== thisTabs.dataset.syncGroupId) return
+      querySelectorWithSiblings(tabs, '.tablist .tab', 'tab').forEach(function (tab) {
+        if (tab.dataset.syncId === thisTab.dataset.syncId) activateTab.call({ tabs: tabs, tab: tab, isSync: true })
+      })
+    })
+    var shiftedBy = thisTabs.getBoundingClientRect().y - initialY
+    if (shiftedBy && (shiftedBy = Math.round(shiftedBy))) window.scrollBy({ top: shiftedBy, behavior: 'instant' })
+  }
+
+  function querySelectorWithSiblings (scope, selector, siblingClass) {
+    var el = scope.querySelector(selector)
+    if (!el) return []
+    var result = [el]
+    while ((el = el.nextElementSibling) && el.classList.contains(siblingClass)) result.push(el)
+    return result
+  }
+
+  function toggleClassOnEach (elements, className, method) {
+    forEach.call(elements, function (el) {
+      el.classList[method](className)
+    })
+  }
+
+  function toggleHidden (el, state) {
+    el.classList[(el.hidden = state) ? 'add' : 'remove']('is-hidden')
+  }
+
+  function toggleSelected (el, state) {
+    el.setAttribute('aria-selected', '' + state)
+    el.classList[state ? 'add' : 'remove']('is-selected')
+    el.tabIndex = state ? 0 : -1
+  }
+
+  function onHashChange () {
+    var id = window.location.hash.slice(1)
+    if (!id) return
+    var tab = document.getElementById(~id.indexOf('%') ? decodeURIComponent(id) : id)
+    if (!(tab && tab.classList.contains('tab'))) return
+    'syncId' in tab.dataset ? activateTabSync.call({ tab: tab }) : activateTab.call({ tab: tab })
+  }
+})()
+</script>
+</body>
+</html>

docs/modules/release-notes/pages/changelog.adoc

@@ -1,7 +1,12 @@
 = Changelog
 include::ROOT:partial$component-attributes.adoc[]
 
+[[release-0.31.0]]
+== 0.31.0 (UNRELEASED)
+
+xref:0.31.adoc[Release Notes]
 [[release-0.30.2]]
+
 == 0.30.2 (2025-12-15)
 
 === Fixes

docs/modules/release-notes/pages/index.adoc

@@ -2,6 +2,7 @@
 
 The Pkl team aims to release a new version of Pkl in February, June, and October of each year.
 
+* xref:0.31.adoc[0.31 Release Notes]
 * xref:0.30.adoc[0.30 Release Notes]
 * xref:0.29.adoc[0.29 Release Notes]
 * xref:0.28.adoc[0.28 Release Notes]

docs/nav.adoc

@@ -41,6 +41,7 @@
 * xref:ROOT:evolution-and-roadmap.adoc[Evolution and Roadmap]
 
 * xref:release-notes:index.adoc[Release Notes]
+** xref:release-notes:0.31.adoc[0.31 Release Notes]
 ** xref:release-notes:0.30.adoc[0.30 Release Notes]
 ** xref:release-notes:0.29.adoc[0.29 Release Notes]
 ** xref:release-notes:0.28.adoc[0.28 Release Notes]

gradle.properties

@@ -1,7 +1,7 @@
 # suppress inspection "UnusedProperty" for whole file
 
 group=org.pkl-lang
-version=0.30.2
+version=0.31.0
 
 # google-java-format requires jdk.compiler exports
 org.gradle.jvmargs= \

gradle/libs.versions.toml

@@ -9,12 +9,18 @@ googleJavaFormat = "1.25.2"
 # must not use `+` because used in download URL
 # 23.1.x requires JDK 20+
 graalVm = "25.0.0"
+#noinspection UnusedVersionCatalogEntry
 graalVmJdkVersion = "25.0.0"
 # slightly hacky but convenient place so we remember to update the checksum
+#noinspection UnusedVersionCatalogEntry
 graalVmSha256-macos-x64 = "04278cf867d040e29dc71dd7727793f0ea67eb72adce8a35d04b87b57906778d"
+#noinspection UnusedVersionCatalogEntry
 graalVmSha256-macos-aarch64 = "c446d5aaeda98660a4c14049d299e9fba72105a007df89f19d27cf3979d37158"
+#noinspection UnusedVersionCatalogEntry
 graalVmSha256-linux-x64 = "1862f2ce97387a303cae4c512cb21baf36fafd2457c3cbbc10d87db94b89d3dd"
+#noinspection UnusedVersionCatalogEntry
 graalVmSha256-linux-aarch64 = "6c3c8b7617006c5d174d9cf7d357ccfb4bae77a4df1294ee28084fcb6eea8921"
+#noinspection UnusedVersionCatalogEntry
 graalVmSha256-windows-x64 = "33ef1d186b5c1e95465fcc97e637bc26e72d5f2250a8615b9c5d667ed5c17fd0"
 ideaExtPlugin = "1.1.9"
 intellijPlugin = "2.10.1"
@@ -62,6 +68,7 @@ geantyref = { group = "io.leangen.geantyref", name = "geantyref", version.ref =
 graalCompiler = { group = "org.graalvm.compiler", name = "compiler", version.ref = "graalVm" }
 graalSdk = { group = "org.graalvm.sdk", name = "graal-sdk", version.ref = "graalVm" }
 graalJs = { group = "org.graalvm.js", name = "js", version.ref = "graalVm" }
+#noinspection UnusedVersionCatalogEntry
 intellij = { group = "com.jetbrains.intellij.idea", name = "ideaIC", version.ref = "intellij" }
 javaPoet = { group = "com.palantir.javapoet", name = "javapoet", version.ref = "javaPoet" }
 javaxInject = { group = "javax.inject", name = "javax.inject", version.ref = "javaxInject" }
@@ -75,7 +82,6 @@ junitApi = { group = "org.junit.jupiter", name = "junit-jupiter-api", version.re
 junitEngine = { group = "org.junit.jupiter", name = "junit-jupiter-engine", version.ref = "junit" }
 junitParams = { group = "org.junit.jupiter", name = "junit-jupiter-params", version.ref = "junit" }
 junitLauncher = { group = "org.junit.platform", name = "junit-platform-launcher", version.ref = "junitPlatform" }
-kotlinCompilerEmbeddable = { group = "org.jetbrains.kotlin", name = "kotlin-compiler-embeddable", version.ref = "kotlin" }
 kotlinPlugin = { group = "org.jetbrains.kotlin", name = "kotlin-gradle-plugin", version.ref = "kotlin" }
 kotlinPoet = { group = "com.squareup", name = "kotlinpoet", version.ref = "kotlinPoet" }
 kotlinReflect = { group = "org.jetbrains.kotlin", name = "kotlin-reflect", version.ref = "kotlin" }
@@ -84,8 +90,10 @@ kotlinStdLib = { group = "org.jetbrains.kotlin", name = "kotlin-stdlib-jdk8", ve
 kotlinxHtml = { group = "org.jetbrains.kotlinx", name = "kotlinx-html-jvm", version.ref = "kotlinxHtml" }
 kotlinxSerializationJson = { group = "org.jetbrains.kotlinx", name = "kotlinx-serialization-json", version.ref = "kotlinxSerialization" }
 kotlinxCoroutinesCore = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-core", version.ref = "kotlinxCoroutines" }
+#noinspection UnusedVersionCatalogEntry
 log4j12Api = { group = "org.apache.logging.log4j", name = "log4j-1.2-api", version.ref = "log4j" }
 msgpack = { group = "org.msgpack", name = "msgpack-core", version.ref = "msgpack" }
+#noinspection UnusedVersionCatalogEntry
 nuValidator = { group = "nu.validator", name = "validator", version.ref = "nuValidator" }
 # to be replaced with https://github.com/usethesource/capsule or https://github.com/lacuna/bifurcan
 paguro = { group = "org.organicdesign", name = "Paguro", version.ref = "paguro" }

pkl-bom/pkl-bom.gradle.kts

@@ -0,0 +1,60 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins {
+  pklAllProjects
+  `java-platform`
+  `maven-publish`
+  signing
+}
+
+description = "Pkl BOM that includes all modules"
+
+dependencies {
+  constraints {
+    api(projects.pklCli)
+    api(projects.pklCodegenJava)
+    api(projects.pklCodegenKotlin)
+    // Use explicit coordinates for pkl-config-java to avoid ambiguity with fatJar publication
+    api("${project.group}:pkl-config-java:${project.version}")
+    api("${project.group}:pkl-config-java-all:${project.version}")
+    api(projects.pklConfigKotlin)
+    api(projects.pklCore)
+    api(projects.pklDoc)
+    api(projects.pklExecutor)
+    api(projects.pklFormatter)
+    api(projects.pklGradle)
+    api(projects.pklParser)
+    api(projects.pklTools)
+  }
+}
+
+publishing {
+  publications {
+    create<MavenPublication>("library") {
+      from(components["javaPlatform"])
+      pom {
+        url.set("https://github.com/apple/pkl/tree/main/pkl-bom")
+        description.set("Bill of Materials for managing Pkl dependency versions")
+      }
+    }
+  }
+}
+
+configurePklPomMetadata()
+
+configurePomValidation()
+
+configurePklSigning()

pkl-cli/src/main/kotlin/org/pkl/cli/CliEvaluator.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -263,13 +263,15 @@ constructor(
       }
       val moduleSource = toModuleSource(moduleUri, inputStream)
       val output = evaluator.evaluateOutputFiles(moduleSource)
+      val realOutputDir = if (outputDir.exists()) outputDir.toRealPath() else outputDir
+
       for ((pathSpec, fileOutput) in output) {
         checkPathSpec(pathSpec)
-        val resolvedPath = outputDir.resolve(pathSpec).normalize()
+        val resolvedPath = realOutputDir.resolve(pathSpec).normalize()
         val realPath = if (resolvedPath.exists()) resolvedPath.toRealPath() else resolvedPath
-        if (!realPath.startsWith(outputDir)) {
+        if (!realPath.startsWith(realOutputDir)) {
           throw CliException(
-            "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is outside output directory `$outputDir`."
+            "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is outside output directory `$realOutputDir`."
           )
         }
         val previousOutput = writtenFiles[realPath]

pkl-cli/src/main/kotlin/org/pkl/cli/CliFormatterCommand.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -110,7 +110,6 @@ constructor(
 
         val formatted = format(contents)
         if (contents != formatted) {
-          status.update(FORMATTING_VIOLATION)
           if (diffNameOnly || overwrite) {
             // if `--diff-name-only` or `-w` is specified, only write file names
             writeLine(pathStr)
@@ -118,6 +117,9 @@ constructor(
 
           if (overwrite) {
             path.writeText(formatted, Charsets.UTF_8)
+          } else {
+            // only exit on violation for "check" operations, not when overwriting
+            status.update(FORMATTING_VIOLATION)
           }
         }
 

pkl-cli/src/main/kotlin/org/pkl/cli/CliProjectResolver.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,9 +15,11 @@
  */
 package org.pkl.cli
 
+import java.io.IOException
 import java.io.Writer
 import java.nio.file.Path
 import org.pkl.commons.cli.CliBaseOptions
+import org.pkl.core.PklException
 import org.pkl.core.SecurityManagers
 import org.pkl.core.module.ProjectDependenciesManager
 import org.pkl.core.packages.PackageResolver
@@ -46,9 +48,13 @@ class CliProjectResolver(
       val dependencies = ProjectDependenciesResolver(project, packageResolver, errWriter).resolve()
       val depsFile =
         projectFile.parent.resolve(ProjectDependenciesManager.PKL_PROJECT_DEPS_FILENAME).toFile()
-      depsFile.outputStream().use { dependencies.writeTo(it) }
-      consoleWriter.appendLine(depsFile.toString())
-      consoleWriter.flush()
+      try {
+        depsFile.outputStream().use { dependencies.writeTo(it) }
+        consoleWriter.appendLine(depsFile.toString())
+        consoleWriter.flush()
+      } catch (e: IOException) {
+        throw PklException("Failed to write to $depsFile: ${e.message}", e)
+      }
     }
   }
 }

pkl-cli/src/main/kotlin/org/pkl/cli/CliRepl.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -71,7 +71,7 @@ internal class CliRepl(private val options: CliEvaluatorOptions) : CliCommand(op
           options.base.color?.hasColor() ?: false,
           options.base.traceMode ?: TraceMode.COMPACT,
         )
-      Repl(options.base.normalizedWorkingDir, server).run()
+      Repl(options.base.normalizedWorkingDir, server, options.base.color?.hasColor() ?: false).run()
     }
   }
 }

pkl-cli/src/main/kotlin/org/pkl/cli/CliTestRunner.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import org.pkl.commons.cli.*
 import org.pkl.core.Closeables
 import org.pkl.core.EvaluatorBuilder
 import org.pkl.core.ModuleSource.uri
+import org.pkl.core.PklException
 import org.pkl.core.TestResults
 import org.pkl.core.stdlib.test.report.JUnitReport
 import org.pkl.core.stdlib.test.report.SimpleReport
@@ -106,6 +107,9 @@ constructor(
         } catch (ex: Exception) {
           errWriter.appendLine("Error evaluating module ${moduleUri.path}:")
           errWriter.write(ex.message ?: "")
+          if (ex !is PklException) {
+            errWriter.write(ex.stackTraceToString())
+          }
           if (moduleUri != sources.last()) {
             errWriter.appendLine()
           }

pkl-cli/src/main/kotlin/org/pkl/cli/repl/Repl.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,22 +18,40 @@ package org.pkl.cli.repl
 import java.io.IOException
 import java.net.URI
 import java.nio.file.Path
+import java.util.regex.Pattern
 import kotlin.io.path.deleteIfExists
 import org.fusesource.jansi.Ansi
 import org.jline.reader.EndOfFileException
+import org.jline.reader.Highlighter
+import org.jline.reader.LineReader
 import org.jline.reader.LineReader.Option
 import org.jline.reader.LineReaderBuilder
 import org.jline.reader.UserInterruptException
 import org.jline.reader.impl.completer.AggregateCompleter
 import org.jline.reader.impl.history.DefaultHistory
 import org.jline.terminal.TerminalBuilder
+import org.jline.utils.AttributedString
 import org.jline.utils.InfoCmp
 import org.pkl.core.repl.ReplRequest
 import org.pkl.core.repl.ReplResponse
 import org.pkl.core.repl.ReplServer
+import org.pkl.core.util.AnsiStringBuilder
+import org.pkl.core.util.AnsiStringBuilder.AnsiCode
 import org.pkl.core.util.IoUtils
+import org.pkl.core.util.SyntaxHighlighter
 
-internal class Repl(workingDir: Path, private val server: ReplServer) {
+class PklHighlighter : Highlighter {
+  override fun highlight(reader: LineReader, buffer: String): AttributedString {
+    val ansi = AnsiStringBuilder(true).apply { SyntaxHighlighter.writeTo(this, buffer) }.toString()
+    return AttributedString.fromAnsi(ansi)
+  }
+
+  override fun setErrorPattern(pattern: Pattern) {}
+
+  override fun setErrorIndex(idx: Int) {}
+}
+
+internal class Repl(workingDir: Path, private val server: ReplServer, private val color: Boolean) {
   private val terminal = TerminalBuilder.builder().apply { jansi(true) }.build()
   private val history = DefaultHistory()
   private val reader =
@@ -41,12 +59,12 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
       .apply {
         history(history)
         terminal(terminal)
+        if (color) {
+          highlighter(PklHighlighter())
+        }
         completer(AggregateCompleter(CommandCompleter, FileCompleter(workingDir)))
         option(Option.DISABLE_EVENT_EXPANSION, true)
-        variable(
-          org.jline.reader.LineReader.HISTORY_FILE,
-          (IoUtils.getPklHomeDir().resolve("repl-history")),
-        )
+        variable(LineReader.HISTORY_FILE, (IoUtils.getPklHomeDir().resolve("repl-history")))
       }
       .build()
 
@@ -55,6 +73,12 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
   private var maybeQuit = false
   private var nextRequestId = 0
 
+  private fun String.faint(): String {
+    val sb = AnsiStringBuilder(color)
+    sb.append(AnsiCode.FAINT, this)
+    return sb.toString()
+  }
+
   fun run() {
     // JLine 2 history file is incompatible with JLine 3
     IoUtils.getPklHomeDir().resolve("repl-history.bin").deleteIfExists()
@@ -70,11 +94,11 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
           try {
             if (continuation) {
               nextRequestId -= 1
-              reader.readLine(" ".repeat("pkl$nextRequestId> ".length))
+              reader.readLine(" ".repeat("pkl$nextRequestId> ".length).faint())
             } else {
-              reader.readLine("pkl$nextRequestId> ")
+              reader.readLine("pkl$nextRequestId> ".faint())
             }
-          } catch (e: UserInterruptException) {
+          } catch (_: UserInterruptException) {
             if (!continuation && reader.buffer.length() == 0) {
               if (maybeQuit) quit()
               else {
@@ -87,7 +111,7 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
             inputBuffer = ""
             continuation = false
             continue
-          } catch (e: EndOfFileException) {
+          } catch (_: EndOfFileException) {
             ":quit"
           }
 
@@ -111,10 +135,10 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
     } finally {
       try {
         history.save()
-      } catch (ignored: IOException) {}
+      } catch (_: IOException) {}
       try {
         terminal.close()
-      } catch (ignored: IOException) {}
+      } catch (_: IOException) {}
     }
   }
 
@@ -124,10 +148,12 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
       candidates.isEmpty() -> {
         println("Unknown command: `${inputBuffer.drop(1)}`")
       }
+
       candidates.size > 1 -> {
         print("Which of the following did you mean?  ")
         println(candidates.joinToString(separator = "  ") { "`:${it.type}`" })
       }
+
       else -> {
         doExecuteCommand(candidates.single())
       }
@@ -193,16 +219,20 @@ internal class Repl(workingDir: Path, private val server: ReplServer) {
         is ReplResponse.EvalSuccess -> {
           println(response.result)
         }
+
         is ReplResponse.EvalError -> {
           println(response.message)
         }
+
         is ReplResponse.InternalError -> {
           throw response.cause
         }
+
         is ReplResponse.IncompleteInput -> {
           assert(responses.size == 1)
           continuation = true
         }
+
         else -> throw IllegalStateException("Unexpected response: $response")
       }
     }

pkl-cli/src/test/kotlin/org/pkl/cli/CliEvaluatorTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1634,6 +1634,95 @@ result = someLib.x
       )
   }
 
+  @Test
+  @DisabledOnOs(OS.WINDOWS)
+  fun `multiple file output works with symlinked output directory`() {
+    val realOutputDir = tempDir.resolve("real-output").createDirectories()
+
+    val symlinkOutputDir =
+      Files.createSymbolicLink(tempDir.resolve("symlink-output"), realOutputDir)
+
+    val sourceFile =
+      writePklFile(
+        "test.pkl",
+        """
+          pigeon {
+            name = "Pigeon"
+            diet = "Seeds"
+          }
+          parrot {
+            name = "Parrot"
+            diet = "Seeds"
+          }
+          output {
+            files {
+              ["pigeon.json"] {
+                value = pigeon
+                renderer = new JsonRenderer {}
+              }
+              ["birds/parrot.yaml"] {
+                value = parrot
+                renderer = new YamlRenderer {}
+              }
+            }
+          }
+        """
+          .trimIndent(),
+      )
+
+    val options =
+      CliEvaluatorOptions(
+        CliBaseOptions(sourceModules = listOf(sourceFile), workingDir = tempDir),
+        multipleFileOutputPath = symlinkOutputDir.toString(),
+      )
+
+    CliEvaluator(options).run()
+
+    checkOutputFile(
+      realOutputDir.resolve("pigeon.json"),
+      "pigeon.json",
+      """
+        {
+          "name": "Pigeon",
+          "diet": "Seeds"
+        }
+      """
+        .trimIndent(),
+    )
+
+    checkOutputFile(
+      realOutputDir.resolve("birds/parrot.yaml"),
+      "parrot.yaml",
+      """
+        name: Parrot
+        diet: Seeds
+      """
+        .trimIndent(),
+    )
+
+    checkOutputFile(
+      symlinkOutputDir.resolve("pigeon.json"),
+      "pigeon.json",
+      """
+        {
+          "name": "Pigeon",
+          "diet": "Seeds"
+        }
+      """
+        .trimIndent(),
+    )
+
+    checkOutputFile(
+      symlinkOutputDir.resolve("birds/parrot.yaml"),
+      "parrot.yaml",
+      """
+        name: Parrot
+        diet: Seeds
+      """
+        .trimIndent(),
+    )
+  }
+
   private fun evalModuleThatImportsPackage(certsFile: Path?, testPort: Int = -1) {
     val moduleUri =
       writePklFile(

pkl-cli/src/test/kotlin/org/pkl/cli/CliProjectResolverTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,9 @@ package org.pkl.cli
 import java.io.File
 import java.io.StringWriter
 import java.nio.file.Path
+import kotlin.io.path.createDirectories
 import org.assertj.core.api.Assertions.assertThat
+import org.assertj.core.api.Assertions.assertThatCode
 import org.junit.jupiter.api.AfterAll
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.assertThrows
@@ -27,6 +29,7 @@ import org.pkl.commons.cli.CliBaseOptions
 import org.pkl.commons.cli.CliException
 import org.pkl.commons.test.FileTestUtils
 import org.pkl.commons.test.PackageServer
+import org.pkl.commons.writeString
 import org.pkl.core.util.IoUtils
 
 class CliProjectResolverTest {
@@ -457,4 +460,40 @@ class CliProjectResolverTest {
           .trimIndent()
       )
   }
+
+  @Test
+  fun `IOException when writing to PklProject-deps-json`(@TempDir tempDir: Path) {
+    val consoleOut = StringWriter()
+    val errOut = StringWriter()
+    tempDir
+      .resolve("PklProject")
+      .writeString(
+        """
+      amends "pkl:Project"
+
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
+        }
+      }
+    """
+          .trimIndent()
+      )
+    // coerce an IOException by making this a directory
+    val depsJsonFile = tempDir.resolve("PklProject.deps.json").also { it.createDirectories() }
+    assertThatCode {
+        CliProjectResolver(
+            CliBaseOptions(
+              caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+              testPort = packageServer.port,
+              noCache = true,
+            ),
+            listOf(tempDir),
+            consoleWriter = consoleOut,
+            errWriter = errOut,
+          )
+          .run()
+      }
+      .hasMessageContaining("Failed to write to $depsJsonFile")
+  }
 }

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/JavaCodeGenerator.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,6 +13,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+@file:Suppress("unused")
+
 package org.pkl.codegen.java
 
 import com.palantir.javapoet.*

pkl-codegen-java/src/test/kotlin/org/pkl/codegen/java/JavaCodeGeneratorTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -595,10 +595,7 @@ class JavaCodeGeneratorTest {
     assertAll(
       "toString() returns Pkl name",
       javaClass.enumConstants.zip(cases) { enumConstant, (pklName, _) ->
-        {
-          assertThat(enumConstant.toString()).isEqualTo(pklName)
-          Unit
-        }
+        { assertThat(enumConstant.toString()).isEqualTo(pklName) }
       },
     )
   }
@@ -2264,7 +2261,7 @@ class JavaCodeGeneratorTest {
   }
 
   private fun Map<String, String>.validateContents(
-    vararg assertions: kotlin.Pair<String, List<String>>
+    @Suppress("RemoveRedundantQualifierName") vararg assertions: kotlin.Pair<String, List<String>>
   ) {
     val files = toMutableMap()
 
@@ -2289,7 +2286,7 @@ class JavaCodeGeneratorTest {
   }
 
   private fun JavaCodeGeneratorOptions.generateFiles(
-    vararg pklModules: kotlin.Pair<String, String>
+    @Suppress("RemoveRedundantQualifierName") vararg pklModules: kotlin.Pair<String, String>
   ): Map<String, String> =
     generateFiles(*pklModules.map { (name, text) -> PklModule(name, text) }.toTypedArray())
 

pkl-codegen-kotlin/src/main/kotlin/org/pkl/codegen/kotlin/KotlinCodeGenerator.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,6 +13,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+@file:Suppress("unused")
+
 package org.pkl.codegen.kotlin
 
 import com.squareup.kotlinpoet.*
@@ -66,6 +68,7 @@ class KotlinCodeGenerator(
     private val STRING = String::class.asClassName()
     private val ANY_NULL = ANY.copy(nullable = true)
     private val NOTHING = Nothing::class.asClassName()
+    @Suppress("RemoveRedundantQualifierName")
     private val KOTLIN_PAIR = kotlin.Pair::class.asClassName()
     private val COLLECTION = Collection::class.asClassName()
     private val LIST = List::class.asClassName()

pkl-codegen-kotlin/src/test/kotlin/org/pkl/codegen/kotlin/KotlinCodeGeneratorTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2054,7 +2054,7 @@ class KotlinCodeGeneratorTest {
   }
 
   private fun Map<String, String>.validateContents(
-    vararg assertions: kotlin.Pair<String, List<String>>
+    @Suppress("RemoveRedundantQualifierName") vararg assertions: kotlin.Pair<String, List<String>>
   ) {
     val files = toMutableMap()
 
@@ -2079,7 +2079,7 @@ class KotlinCodeGeneratorTest {
   }
 
   private fun KotlinCodeGeneratorOptions.generateFiles(
-    vararg pklModules: kotlin.Pair<String, String>
+    @Suppress("RemoveRedundantQualifierName") vararg pklModules: kotlin.Pair<String, String>
   ): Map<String, String> =
     generateFiles(*pklModules.map { (name, text) -> PklModule(name, text) }.toTypedArray())
 

pkl-commons-cli/src/test/kotlin/org/pkl/commons/cli/CliCommandTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,11 +23,11 @@ import org.pkl.core.SecurityManagers
 
 class CliCommandTest {
 
-  class CliTest(private val options: CliBaseOptions) : CliCommand(options) {
+  class CliTest(options: CliBaseOptions) : CliCommand(options) {
     override fun doRun() = Unit
 
-    val _allowedResources = allowedResources
-    val _allowedModules = allowedModules
+    val myAllowedResources = allowedResources
+    val myAllowedModules = allowedModules
   }
 
   private val cmd =
@@ -57,12 +57,12 @@ class CliCommandTest {
     )
     val opts = cmd.baseOptions.baseOptions(emptyList(), null, true)
     val cliTest = CliTest(opts)
-    assertThat(cliTest._allowedModules.map { it.pattern() })
+    assertThat(cliTest.myAllowedModules.map { it.pattern() })
       .isEqualTo(
         SecurityManagers.defaultAllowedModules.map { it.pattern() } +
           listOf("\\Qscheme3:\\E", "\\Qscheme4:\\E", "\\Qscheme+ext:\\E")
       )
-    assertThat(cliTest._allowedResources.map { it.pattern() })
+    assertThat(cliTest.myAllowedResources.map { it.pattern() })
       .isEqualTo(
         SecurityManagers.defaultAllowedResources.map { it.pattern() } +
           listOf("\\Qscheme1:\\E", "\\Qscheme2:\\E", "\\Qscheme+ext:\\E")

pkl-config-java/src/main/java/org/pkl/config/java/Config.java

@@ -110,7 +110,7 @@ public interface Config {
     return fromPklBinary(inputStream, ValueMapper.preconfigured());
   }
 
-  private static Config makeConfig(Object decoded, ValueMapper mapper) {
+  static Config makeConfig(Object decoded, ValueMapper mapper) {
     if (decoded instanceof Composite composite) {
       return new CompositeConfig("", mapper, composite);
     }

pkl-config-java/src/main/java/org/pkl/config/java/ConfigEvaluator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -41,6 +41,12 @@ public interface ConfigEvaluator extends AutoCloseable {
   /** Evaluates the given module source into a {@link Config} tree. */
   Config evaluate(ModuleSource moduleSource);
 
+  /** Evaluates the given module's {@code output.value} property into a {@link Config} tree. */
+  Config evaluateOutputValue(ModuleSource moduleSource);
+
+  /** Evaluates the Pkl expression represented as {@code expression} into a {@link Config} tree. */
+  Config evaluateExpression(ModuleSource moduleSource, String expression);
+
   /**
    * Releases all resources held by this evaluator. If an {@code evaluate} method is currently
    * executing, this method blocks until cancellation of that execution has completed.

pkl-config-java/src/main/java/org/pkl/config/java/ConfigEvaluatorImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,18 @@ final class ConfigEvaluatorImpl implements ConfigEvaluator {
     return new CompositeConfig("", mapper, module);
   }
 
+  @Override
+  public Config evaluateOutputValue(ModuleSource moduleSource) {
+    var value = evaluator.evaluateOutputValue(moduleSource);
+    return Config.makeConfig(value, mapper);
+  }
+
+  @Override
+  public Config evaluateExpression(ModuleSource moduleSource, String expression) {
+    var value = evaluator.evaluateExpression(moduleSource, expression);
+    return Config.makeConfig(value, mapper);
+  }
+
   @Override
   public ValueMapper getValueMapper() {
     return mapper;

pkl-config-java/src/test/java/org/pkl/config/java/ConfigTest.java

@@ -15,16 +15,20 @@
  */
 package org.pkl.config.java;
 
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.pkl.core.ModuleSource.text;
 
+import org.junit.jupiter.api.Test;
+
 public class ConfigTest extends AbstractConfigTest {
   private static final ConfigEvaluator evaluator = ConfigEvaluator.preconfigured();
 
+  private static final String pigeonText =
+      "pigeon { age = 30; friends = List(\"john\", \"mary\"); address { street = \"Fuzzy St.\" } }";
+
   @Override
   protected Config getPigeonConfig() {
-    return evaluator.evaluate(
-        text(
-            "pigeon { age = 30; friends = List(\"john\", \"mary\"); address { street = \"Fuzzy St.\" } }"));
+    return evaluator.evaluate(text(pigeonText));
   }
 
   @Override
@@ -42,4 +46,20 @@ public class ConfigTest extends AbstractConfigTest {
   protected Config getMapConfig() {
     return evaluator.evaluate(text("x = Map(\"one\", 1, \"two\", 2)"));
   }
+
+  @Test
+  public void evaluateOutputValue() {
+    var valueConfig =
+        evaluator.evaluateOutputValue(
+            text(pigeonText + "\noutput { value = (outer) { pigeon { age = 99 } } }"));
+    var pigeon = valueConfig.get("pigeon").as(Person.class);
+    assertThat(pigeon.age).isEqualTo(99);
+  }
+
+  @Test
+  public void evaluateExpression() {
+    var addressConfig = evaluator.evaluateExpression(text(pigeonText), "pigeon.address");
+    var address = addressConfig.as(Address.class);
+    assertThat(address.street).isEqualTo("Fuzzy St.");
+  }
 }

pkl-config-java/src/test/java/org/pkl/config/java/JavaTypeTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -89,6 +89,7 @@ public class JavaTypeTest {
     assertThat(javaType.getType()).isEqualTo(Types.mapOf(String.class, Types.listOf(URI.class)));
   }
 
+  @SuppressWarnings({"EqualsWithItself", "AssertBetweenInconvertibleTypes"})
   @Test
   public void sameTypesConstructedInDifferentWaysAreEqual() {
     var type1 = JavaType.mapOf(JavaType.of(String.class), JavaType.listOf(URI.class));

pkl-config-java/src/test/java/org/pkl/config/java/mapper/ConversionsTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,46 +28,51 @@ import org.pkl.core.DurationUnit;
 public class ConversionsTest {
   @Test
   public void pStringToFile() {
-    var file = Conversions.pStringToFile.converter.convert("relative/path", null);
+    var file =
+        Conversions.pStringToFile.converter.convert("relative/path", ValueMapper.preconfigured());
     assertThat(file).isEqualTo(new File("relative/path"));
 
-    var file2 = Conversions.pStringToFile.converter.convert("/absolute/path", null);
+    var file2 =
+        Conversions.pStringToFile.converter.convert("/absolute/path", ValueMapper.preconfigured());
     assertThat(file2).isEqualTo(new File("/absolute/path"));
 
-    var file3 = Conversions.pStringToFile.converter.convert("", null);
+    var file3 = Conversions.pStringToFile.converter.convert("", ValueMapper.preconfigured());
     assertThat(file3).isEqualTo(new File(""));
   }
 
   @Test
   public void pStringToPath() {
-    var path = Conversions.pStringToPath.converter.convert("relative/path", null);
+    var path =
+        Conversions.pStringToPath.converter.convert("relative/path", ValueMapper.preconfigured());
     assertThat(path).isEqualTo(Path.of("relative/path"));
 
-    var path2 = Conversions.pStringToPath.converter.convert("/absolute/path", null);
+    var path2 =
+        Conversions.pStringToPath.converter.convert("/absolute/path", ValueMapper.preconfigured());
     assertThat(path2).isEqualTo(Path.of("/absolute/path"));
 
-    var path3 = Conversions.pStringToPath.converter.convert("", null);
+    var path3 = Conversions.pStringToPath.converter.convert("", ValueMapper.preconfigured());
     assertThat(path3).isEqualTo(Path.of(""));
   }
 
   @Test
   public void pStringToPattern() {
     var str = "(?i)\\w*";
-    var pattern = Conversions.pStringToPattern.converter.convert(str, null);
+    var pattern = Conversions.pStringToPattern.converter.convert(str, ValueMapper.preconfigured());
     assertThat(pattern.pattern()).isEqualTo(str);
   }
 
   @Test
   public void pRegexToString() {
     var regex = Pattern.compile("(?i)\\w*");
-    var str = Conversions.pRegexToString.converter.convert(regex, null);
+    var str = Conversions.pRegexToString.converter.convert(regex, ValueMapper.preconfigured());
     assertThat(str).isEqualTo("(?i)\\w*");
   }
 
   @Test
   public void pDurationToDuration() {
     var pDuration = new Duration(100, DurationUnit.MINUTES);
-    var duration = Conversions.pDurationToDuration.converter.convert(pDuration, null);
+    var duration =
+        Conversions.pDurationToDuration.converter.convert(pDuration, ValueMapper.preconfigured());
     assertThat(duration).isEqualTo(java.time.Duration.of(100, ChronoUnit.MINUTES));
   }
 }

pkl-config-java/src/test/java/org/pkl/config/java/mapper/PModuleToDataObjectTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@ public class PModuleToDataObjectTest {
 
   private static final PModule module =
       evaluator.evaluate(modulePath("org/pkl/config/java/mapper/PModuleToDataObjectTest.pkl"));
-  PObjectToDataObjectTest.Person pigeon =
+  private final PObjectToDataObjectTest.Person pigeon =
       new PObjectToDataObjectTest.Person(
           "pigeon",
           40,

pkl-config-java/src/test/java/org/pkl/config/java/mapper/PNullToAnyTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@ import org.pkl.core.PNull;
 public class PNullToAnyTest {
   private static final ValueMapper mapper = ValueMapperBuilder.preconfigured().build();
 
+  @SuppressWarnings("DataFlowIssue")
   @Test
   public void test() {
     // due to Conversions.identities

pkl-core/src/main/java/org/pkl/core/JsonRenderer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -105,7 +105,8 @@ final class JsonRenderer implements ValueRenderer {
     @Override
     public void visitBytes(byte[] value) {
       throw new RendererException(
-          String.format("Values of type `Bytes` cannot be rendered as JSON. Value: %s", value));
+          String.format(
+              "Values of type `Bytes` cannot be rendered as JSON. Value: %s", (Object) value));
     }
 
     @Override

pkl-core/src/main/java/org/pkl/core/PropertiesRenderer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -110,7 +110,8 @@ final class PropertiesRenderer implements ValueRenderer {
     public String convertBytes(byte[] value) {
       throw new RendererException(
           String.format(
-              "Values of type `Bytes` cannot be rendered as Properties. Value: %s", value));
+              "Values of type `Bytes` cannot be rendered as Properties. Value: %s",
+              (Object) value));
     }
 
     @Override

pkl-core/src/main/java/org/pkl/core/ast/MemberNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 package org.pkl.core.ast;
 
 import com.oracle.truffle.api.frame.FrameDescriptor;
+import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
 import org.pkl.core.ast.member.DefaultPropertyBodyNode;
 import org.pkl.core.runtime.VmExceptionBuilder;
@@ -46,7 +47,8 @@ public abstract class MemberNode extends PklRootNode {
     return new VmExceptionBuilder().withSourceSection(getHeaderSection());
   }
 
-  public boolean isUndefined() {
-    return bodyNode instanceof DefaultPropertyBodyNode propBodyNode && propBodyNode.isUndefined();
+  public boolean isUndefined(VirtualFrame frame) {
+    return bodyNode instanceof DefaultPropertyBodyNode propBodyNode
+        && propBodyNode.isUndefined(frame);
   }
 }

pkl-core/src/main/java/org/pkl/core/ast/builder/AstBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2449,8 +2449,7 @@ public class AstBuilder extends AbstractAstBuilder<Object> {
       if (dataSizeUnit != null) {
         //noinspection ConstantConditions
         return new ConstantValueNode(
-            sourceSection,
-            new VmDataSize(((IntLiteralNode) receiver).executeInt(null), dataSizeUnit));
+            sourceSection, new VmDataSize(intLiteralNode.executeInt(null), dataSizeUnit));
       }
     }
 
@@ -2465,8 +2464,7 @@ public class AstBuilder extends AbstractAstBuilder<Object> {
       if (dataSizeUnit != null) {
         //noinspection ConstantConditions
         return new ConstantValueNode(
-            sourceSection,
-            new VmDataSize(((FloatLiteralNode) receiver).executeFloat(null), dataSizeUnit));
+            sourceSection, new VmDataSize(floatLiteralNode.executeFloat(null), dataSizeUnit));
       }
     }
 

pkl-core/src/main/java/org/pkl/core/ast/builder/SymbolTable.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -327,6 +327,8 @@ public final class SymbolTable {
     }
 
     public final boolean isClassMemberScope() {
+      var effectiveScope = skipLambdaScopes();
+      var parent = effectiveScope.parent;
       if (parent == null) return false;
 
       return parent.isClassScope()

pkl-core/src/main/java/org/pkl/core/ast/expression/binary/NotEqualNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -100,6 +100,7 @@ public abstract class NotEqualNode extends ExpressionNode {
     return true;
   }
 
+  @SuppressWarnings("JavaExistingMethodCanBeUsed")
   protected static boolean isIncompatibleTypes(Object left, Object right) {
     var leftClass = left.getClass();
     var rightClass = right.getClass();

pkl-core/src/main/java/org/pkl/core/ast/expression/literal/SpecializedObjectLiteralNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -67,7 +67,6 @@ public abstract class SpecializedObjectLiteralNode extends ObjectLiteralNode {
 
   // only runs once per VmClass (which often means once per PropertiesLiteralNode)
   // unless an XYZUncached specialization is active
-  @SuppressWarnings("ExtractMethodRecommender")
   @TruffleBoundary
   @Idempotent
   protected boolean checkIsValidTypedAmendment(Object parent) {

pkl-core/src/main/java/org/pkl/core/ast/expression/member/InferParentWithinMethodNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -67,7 +67,7 @@ public final class InferParentWithinMethodNode extends ExpressionNode {
 
     var returnTypeDefaultValue =
         returnTypeNode.createDefaultValue(
-            language, method.getHeaderSection(), method.getQualifiedName());
+            frame, language, method.getHeaderSection(), method.getQualifiedName());
     if (returnTypeDefaultValue != null) {
       inferredParent = returnTypeDefaultValue;
       ownerNode = null;

pkl-core/src/main/java/org/pkl/core/ast/expression/member/InferParentWithinObjectMethodNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -75,7 +75,7 @@ public final class InferParentWithinObjectMethodNode extends ExpressionNode {
 
     Object defaultReturnTypeValue =
         returnTypeNode.createDefaultValue(
-            language, member.getHeaderSection(), member.getQualifiedName());
+            frame, language, member.getHeaderSection(), member.getQualifiedName());
     if (defaultReturnTypeValue != null) {
       inferredParent = defaultReturnTypeValue;
       ownerNode = null;

pkl-core/src/main/java/org/pkl/core/ast/expression/member/InferParentWithinPropertyNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.pkl.core.ast.expression.member;
 import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.dsl.NodeChild;
 import com.oracle.truffle.api.dsl.Specialization;
+import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.runtime.*;
@@ -35,9 +36,9 @@ public abstract class InferParentWithinPropertyNode extends ExpressionNode {
   }
 
   @Specialization(guards = "!owner.isPrototype()")
-  protected Object evalTypedObject(VmTyped owner) {
+  protected Object evalTypedObject(VirtualFrame frame, VmTyped owner) {
     if (isLocalProperty) {
-      return getLocalPropertyDefaultValue(owner);
+      return getLocalPropertyDefaultValue(frame, owner);
     }
 
     try {
@@ -51,7 +52,7 @@ public abstract class InferParentWithinPropertyNode extends ExpressionNode {
   }
 
   @Specialization(guards = "owner.isPrototype()")
-  protected Object evalPrototype(VmTyped owner) {
+  protected Object evalPrototype(VirtualFrame frame, VmTyped owner) {
     var property =
         isLocalProperty
             ?
@@ -66,7 +67,7 @@ public abstract class InferParentWithinPropertyNode extends ExpressionNode {
     var typeNode = property.getTypeNode();
     if (typeNode == null || typeNode.isUnknownType()) return VmDynamic.empty();
 
-    var result = typeNode.getDefaultValue();
+    var result = typeNode.getDefaultValue(frame);
     if (result != null) return result;
 
     // no default exists for this property type
@@ -76,18 +77,18 @@ public abstract class InferParentWithinPropertyNode extends ExpressionNode {
   }
 
   @Specialization
-  protected Object eval(@SuppressWarnings("unused") VmDynamic owner) {
+  protected Object eval(VirtualFrame frame, @SuppressWarnings("unused") VmDynamic owner) {
     if (isLocalProperty) {
-      return getLocalPropertyDefaultValue(owner);
+      return getLocalPropertyDefaultValue(frame, owner);
     }
 
     return VmDynamic.empty();
   }
 
   @Specialization
-  protected Object eval(@SuppressWarnings("unused") VmListing owner) {
+  protected Object eval(VirtualFrame frame, @SuppressWarnings("unused") VmListing owner) {
     if (isLocalProperty) {
-      return getLocalPropertyDefaultValue(owner);
+      return getLocalPropertyDefaultValue(frame, owner);
     }
 
     assert ownPropertyName == Identifier.DEFAULT;
@@ -96,9 +97,9 @@ public abstract class InferParentWithinPropertyNode extends ExpressionNode {
   }
 
   @Specialization
-  protected Object eval(@SuppressWarnings("unused") VmMapping owner) {
+  protected Object eval(VirtualFrame frame, @SuppressWarnings("unused") VmMapping owner) {
     if (isLocalProperty) {
-      return getLocalPropertyDefaultValue(owner);
+      return getLocalPropertyDefaultValue(frame, owner);
     }
 
     assert ownPropertyName == Identifier.DEFAULT;
@@ -106,13 +107,13 @@ public abstract class InferParentWithinPropertyNode extends ExpressionNode {
     return VmUtils.readMember(BaseModule.getMappingClass().getPrototype(), ownPropertyName);
   }
 
-  private Object getLocalPropertyDefaultValue(VmObjectLike owner) {
+  private Object getLocalPropertyDefaultValue(VirtualFrame frame, VmObjectLike owner) {
     assert isLocalProperty;
 
     var member = owner.getMember(ownPropertyName);
     assert member != null;
 
-    var defaultValue = member.getLocalPropertyDefaultValue();
+    var defaultValue = member.getLocalPropertyDefaultValue(frame);
     if (defaultValue != null) return defaultValue;
 
     // no default exists for this property type

pkl-core/src/main/java/org/pkl/core/ast/expression/member/InvokeSuperMethodNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@ import com.oracle.truffle.api.source.SourceSection;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.member.ClassMethod;
 import org.pkl.core.runtime.Identifier;
+import org.pkl.core.runtime.VmFunction;
 import org.pkl.core.runtime.VmUtils;
 
 public abstract class InvokeSuperMethodNode extends ExpressionNode {
@@ -66,6 +67,10 @@ public abstract class InvokeSuperMethodNode extends ExpressionNode {
 
   protected ClassMethod findSupermethod(VirtualFrame frame) {
     var owner = VmUtils.getOwner(frame);
+    while (owner instanceof VmFunction) {
+      owner = owner.getEnclosingOwner();
+    }
+    assert owner != null : "VmFunction always has a parent";
     assert owner.isPrototype();
 
     var superclass = owner.getVmClass().getSuperclass();

pkl-core/src/main/java/org/pkl/core/ast/member/DefaultPropertyBodyNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -38,14 +38,14 @@ public final class DefaultPropertyBodyNode extends ExpressionNode {
     this.typeNode = typeNode;
   }
 
-  public boolean isUndefined() {
-    return typeNode == null || typeNode.getDefaultValue() == null;
+  public boolean isUndefined(VirtualFrame frame) {
+    return typeNode == null || typeNode.getDefaultValue(frame) == null;
   }
 
   @Override
   public Object executeGeneric(VirtualFrame frame) {
     if (typeNode != null) {
-      var defaultValue = typeNode.getDefaultValue();
+      var defaultValue = typeNode.getDefaultValue(frame);
       if (defaultValue != null) return defaultValue;
     }
 

pkl-core/src/main/java/org/pkl/core/ast/member/LocalTypedPropertyNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -45,11 +45,11 @@ public final class LocalTypedPropertyNode extends RegularMemberNode {
     this.unresolvedTypeNode = unresolvedTypeNode;
   }
 
-  public @Nullable Object getDefaultValue() {
+  public @Nullable Object getDefaultValue(VirtualFrame frame) {
     if (!defaultValueInitialized) {
       defaultValue =
           typeNode.createDefaultValue(
-              language, member.getHeaderSection(), member.getQualifiedName());
+              frame, language, member.getHeaderSection(), member.getQualifiedName());
       defaultValueInitialized = true;
     }
     return defaultValue;

pkl-core/src/main/java/org/pkl/core/ast/member/ObjectMember.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ package org.pkl.core.ast.member;
 
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.RootCallTarget;
+import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
 import org.pkl.core.ast.ConstantNode;
 import org.pkl.core.ast.MemberNode;
@@ -102,14 +103,14 @@ public final class ObjectMember extends Member {
     return callTarget;
   }
 
-  public boolean isUndefined() {
-    return getMemberNode() != null && getMemberNode().isUndefined();
+  public boolean isUndefined(VirtualFrame frame) {
+    return getMemberNode() != null && getMemberNode().isUndefined(frame);
   }
 
-  public @Nullable Object getLocalPropertyDefaultValue() {
+  public @Nullable Object getLocalPropertyDefaultValue(VirtualFrame frame) {
     assert isProp() && isLocal();
     return getMemberNode() instanceof LocalTypedPropertyNode propertyNode
-        ? propertyNode.getDefaultValue()
+        ? propertyNode.getDefaultValue(frame)
         : VmDynamic.empty();
   }
 

pkl-core/src/main/java/org/pkl/core/ast/member/PropertyTypeNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -64,12 +64,16 @@ public final class PropertyTypeNode extends PklRootNode {
     return typeNode.execute(frame, frame.getArguments()[2]);
   }
 
-  public @Nullable Object getDefaultValue() {
+  public @Nullable Object getDefaultValue(VirtualFrame frame) {
     if (!defaultValueInitialized) {
       defaultValue =
           typeNode.createDefaultValue(
-              VmLanguage.get(this), getSourceSection(), qualifiedPropertyName);
-      defaultValueInitialized = true;
+              frame, VmLanguage.get(this), getSourceSection(), qualifiedPropertyName);
+      // can't cache default value for `module` type in a non-final module because it's a self-type
+      // (the default value changes when inherited).
+      if (typeNode.isFinalType()) {
+        defaultValueInitialized = true;
+      }
     }
     return defaultValue;
   }

pkl-core/src/main/java/org/pkl/core/ast/type/GetParentForTypeNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@ import org.pkl.core.util.LateInit;
 /** Resolves `<type>` to the type's default value in `new <type> { ... }`. */
 public final class GetParentForTypeNode extends ExpressionNode {
   @Child private UnresolvedTypeNode unresolvedTypeNode;
+  @Child private TypeNode typeNode;
   private final String qualifiedName;
 
   @CompilationFinal @LateInit Object defaultValue;
@@ -37,17 +38,32 @@ public final class GetParentForTypeNode extends ExpressionNode {
     this.qualifiedName = qualifiedName;
   }
 
+  private TypeNode getTypeNode(VirtualFrame frame) {
+    if (typeNode == null) {
+      CompilerDirectives.transferToInterpreterAndInvalidate();
+      typeNode = unresolvedTypeNode.execute(frame);
+      adoptChildren();
+    }
+    return typeNode;
+  }
+
   @Override
   public Object executeGeneric(VirtualFrame frame) {
     if (defaultValue != null) return defaultValue;
-
     CompilerDirectives.transferToInterpreterAndInvalidate();
 
-    var typeNode = unresolvedTypeNode.execute(frame);
-    defaultValue = typeNode.createDefaultValue(VmLanguage.get(this), sourceSection, qualifiedName);
+    var typeNode = getTypeNode(frame);
+    var defaultValue =
+        typeNode.createDefaultValue(frame, VmLanguage.get(this), sourceSection, qualifiedName);
+
+    // can't cache default value for `module` type in a non-final module because it's a self-type
+    // (the default value changes when inherited).
+    if (typeNode.isFinalType() && defaultValue != null) {
+      unresolvedTypeNode = null;
+      this.defaultValue = defaultValue;
+    }
 
     if (defaultValue != null) {
-      unresolvedTypeNode = null;
       return defaultValue;
     }
 

pkl-core/src/main/java/org/pkl/core/ast/type/TypeNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -116,6 +116,7 @@ public abstract class TypeNode extends PklNode {
 
   // method arguments are used when default value contains a root node
   public @Nullable Object createDefaultValue(
+      VirtualFrame frame,
       VmLanguage language,
       // header section of the property or method that carries the type annotation
       SourceSection headerSection,
@@ -124,11 +125,23 @@ public abstract class TypeNode extends PklNode {
     return null;
   }
 
-  /**
-   * Visit child type nodes; but not parameterized types (does not visit {@code String} in {@code
-   * Listing<String>}).
-   */
-  protected abstract boolean acceptTypeNode(TypeNodeConsumer consumer);
+  public final boolean isFinalType() {
+    var ret = new MutableBoolean(true);
+    acceptTypeNode(
+        true,
+        typeNode -> {
+          // assumption: don't need to worry about `NonFinalClassTypeNode`
+          if (typeNode instanceof NonFinalModuleTypeNode) {
+            ret.set(false);
+            return false;
+          }
+          return true;
+        });
+    return ret.get();
+  }
+
+  /** Visit child type nodes of this type. */
+  protected abstract boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer);
 
   public static TypeNode forClass(SourceSection sourceSection, VmClass clazz) {
     return clazz.isClosed()
@@ -216,7 +229,6 @@ public abstract class TypeNode extends PklNode {
     public TypeNode initWriteSlotNode(int slot) {
       CompilerDirectives.transferToInterpreterAndInvalidate();
       this.slot = slot;
-      //noinspection DataFlowIssue
       writeFrameSlotNode = WriteFrameSlotNodeGen.create(sourceSection, slot, null);
       return this;
     }
@@ -321,7 +333,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -373,7 +385,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -418,9 +430,18 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
+
+    @Override
+    public @Nullable Object createDefaultValue(
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
+      return TypeNode.createDefaultValue(moduleClass);
+    }
   }
 
   /** The `module` type for an open module. */
@@ -470,9 +491,19 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
+
+    @Override
+    public @Nullable Object createDefaultValue(
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
+      var moduleClass = ((VmTyped) getModuleNode.executeGeneric(frame)).getVmClass();
+      return TypeNode.createDefaultValue(moduleClass);
+    }
   }
 
   public static final class StringLiteralTypeNode extends ObjectSlotTypeNode {
@@ -504,7 +535,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return literal;
     }
@@ -520,7 +554,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -548,7 +582,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -572,7 +606,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return VmDynamic.empty();
     }
@@ -583,7 +620,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -622,7 +659,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return TypeNode.createDefaultValue(clazz);
     }
@@ -636,14 +676,15 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
 
   /**
-   * An `open` or `abstract` class type. Since this node is not used for String/Boolean/Int/Float
-   * and their supertypes, only `VmValue`s can possibly pass its type check.
+   * An {@code open} or {@code abstract} class type. Since this node is not used for
+   * String/Boolean/Int/Float and their supertypes, only {@link VmValue}s can possibly pass its type
+   * check.
    */
   public abstract static class NonFinalClassTypeNode extends ObjectSlotTypeNode {
     protected final VmClass clazz;
@@ -691,7 +732,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return TypeNode.createDefaultValue(clazz);
     }
@@ -705,7 +749,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -734,10 +778,13 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return VmNull.withDefault(
-          elementTypeNode.createDefaultValue(language, headerSection, qualifiedName));
+          elementTypeNode.createDefaultValue(frame, language, headerSection, qualifiedName));
     }
 
     @Override
@@ -772,11 +819,8 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
-      if (!consumer.accept(this)) {
-        return false;
-      }
-      return elementTypeNode.acceptTypeNode(consumer);
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      return consumer.accept(this) && elementTypeNode.acceptTypeNode(visitTypeArguments, consumer);
     }
   }
 
@@ -817,12 +861,15 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return defaultIndex == -1
           ? null
           : elementTypeNodes[defaultIndex].createDefaultValue(
-              language, headerSection, qualifiedName);
+              frame, language, headerSection, qualifiedName);
     }
 
     @Override
@@ -861,7 +908,7 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     @ExplodeLoop
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       if (!consumer.accept(this)) {
         return false;
       }
@@ -872,7 +919,7 @@ public abstract class TypeNode extends PklNode {
         if (!ret) {
           continue;
         }
-        if (!elementTypeNodes[i].acceptTypeNode(consumer)) {
+        if (!elementTypeNodes[i].acceptTypeNode(visitTypeArguments, consumer)) {
           ret = false;
         }
       }
@@ -892,6 +939,7 @@ public abstract class TypeNode extends PklNode {
       var seenParameterizedClasses = EconomicSets.<VmClass>create();
       var ret = new MutableBoolean(false);
       this.acceptTypeNode(
+          false,
           (typeNode) -> {
             if (!typeNode.isParametric()) {
               return true;
@@ -1016,14 +1064,16 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
 
     @Override
-    @TruffleBoundary
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return unionDefault;
     }
@@ -1063,7 +1113,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return VmList.EMPTY;
     }
@@ -1089,7 +1142,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
 
@@ -1146,13 +1199,19 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments) {
+        return consumer.accept(this) && elementTypeNode.acceptTypeNode(true, consumer);
+      }
       return consumer.accept(this);
     }
 
     @Override
     public Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return VmList.EMPTY;
     }
@@ -1240,7 +1299,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public final Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return VmSet.EMPTY;
     }
@@ -1273,7 +1335,10 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments) {
+        return consumer.accept(this) && elementTypeNode.acceptTypeNode(true, consumer);
+      }
       return consumer.accept(this);
     }
 
@@ -1332,7 +1397,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       return VmMap.EMPTY;
     }
@@ -1367,7 +1435,12 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments) {
+        return consumer.accept(this)
+            && keyTypeNode.acceptTypeNode(true, consumer)
+            && valueTypeNode.acceptTypeNode(true, consumer);
+      }
       return consumer.accept(this);
     }
 
@@ -1462,7 +1535,10 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments) {
+        return consumer.accept(this) && valueTypeNode.acceptTypeNode(true, consumer);
+      }
       return consumer.accept(this);
     }
   }
@@ -1535,7 +1611,11 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments) {
+        assert keyTypeNode != null;
+        return consumer.accept(this) && valueTypeNode.acceptTypeNode(true, consumer);
+      }
       return consumer.accept(this);
     }
   }
@@ -1586,45 +1666,48 @@ public abstract class TypeNode extends PklNode {
       return valueTypeCastNode;
     }
 
-    // either (if defaultMemberValue != null):
-    // x: Listing<Foo> // = new Listing {
-    //   default = name -> new Foo {}
-    // }
-    // or (if defaultMemberValue == null):
-    // x: Listing<Int> // = new Listing {
-    //   default = Undefined()
-    // }
-    @Override
     @TruffleBoundary
-    public final Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
-
-      if (valueTypeNode instanceof UnknownTypeNode) {
-        if (isListing()) {
-          return new VmListing(
-              VmUtils.createEmptyMaterializedFrame(),
-              BaseModule.getListingClass().getPrototype(),
-              EconomicMaps.create(),
-              0);
-        }
-
-        return new VmMapping(
+    private Object newEmptyListingOrMapping() {
+      if (isListing()) {
+        return new VmListing(
             VmUtils.createEmptyMaterializedFrame(),
-            BaseModule.getMappingClass().getPrototype(),
-            EconomicMaps.create());
+            BaseModule.getListingClass().getPrototype(),
+            EconomicMaps.create(),
+            0);
       }
 
+      return new VmMapping(
+          VmUtils.createEmptyMaterializedFrame(),
+          BaseModule.getMappingClass().getPrototype(),
+          EconomicMaps.create());
+    }
+
+    @TruffleBoundary
+    private Object newEmptyListingOrMapping(ObjectMember defaultMember) {
+      if (isListing()) {
+        return new VmListing(
+            VmUtils.createEmptyMaterializedFrame(),
+            BaseModule.getListingClass().getPrototype(),
+            EconomicMaps.of(Identifier.DEFAULT, defaultMember),
+            0);
+      }
+
+      return new VmMapping(
+          VmUtils.createEmptyMaterializedFrame(),
+          BaseModule.getMappingClass().getPrototype(),
+          EconomicMaps.of(Identifier.DEFAULT, defaultMember));
+    }
+
+    @TruffleBoundary
+    private ObjectMember createDefaultMember(
+        SourceSection headerSection, String qualifiedName, @Nullable Object defaultMemberValue) {
       var defaultMember =
           new ObjectMember(
               headerSection,
               headerSection,
               VmModifier.HIDDEN,
               Identifier.DEFAULT,
-              qualifiedName + ".default");
-
-      var defaultMemberValue =
-          valueTypeNode.createDefaultValue(language, headerSection, qualifiedName);
-
+              VmUtils.concat(qualifiedName, ".default"));
       if (defaultMemberValue == null) {
         defaultMember.initMemberNode(
             new UntypedObjectMemberNode(
@@ -1645,23 +1728,38 @@ public abstract class TypeNode extends PklNode {
                     language,
                     new FrameDescriptor(),
                     headerSection,
-                    defaultMember.getQualifiedName() + ".<function>",
+                    VmUtils.concat(defaultMember.getQualifiedName(), ".<function>"),
                     new ConstantValueNode(defaultMemberValue)),
                 null));
       }
+      return defaultMember;
+    }
 
-      if (isListing()) {
-        return new VmListing(
-            VmUtils.createEmptyMaterializedFrame(),
-            BaseModule.getListingClass().getPrototype(),
-            EconomicMaps.of(Identifier.DEFAULT, defaultMember),
-            0);
+    // either (if defaultMemberValue != null):
+    // x: Listing<Foo> // = new Listing {
+    //   default = name -> new Foo {}
+    // }
+    // or (if defaultMemberValue == null):
+    // x: Listing<Int> // = new Listing {
+    //   default = Undefined()
+    // }
+    @Override
+    public final Object createDefaultValue(
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
+
+      if (valueTypeNode instanceof UnknownTypeNode) {
+        return newEmptyListingOrMapping();
       }
 
-      return new VmMapping(
-          VmUtils.createEmptyMaterializedFrame(),
-          BaseModule.getMappingClass().getPrototype(),
-          EconomicMaps.of(Identifier.DEFAULT, defaultMember));
+      var defaultMemberValue =
+          valueTypeNode.createDefaultValue(frame, language, headerSection, qualifiedName);
+
+      var defaultMember = createDefaultMember(headerSection, qualifiedName, defaultMemberValue);
+
+      return newEmptyListingOrMapping(defaultMember);
     }
 
     protected void doEagerCheck(VirtualFrame frame, VmObject object) {
@@ -1790,7 +1888,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
 
@@ -1861,7 +1959,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
 
@@ -1938,7 +2036,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
 
@@ -2009,7 +2107,12 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments) {
+        return consumer.accept(this)
+            && firstTypeNode.acceptTypeNode(true, consumer)
+            && secondTypeNode.acceptTypeNode(true, consumer);
+      }
       return consumer.accept(this);
     }
 
@@ -2030,7 +2133,10 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       CompilerDirectives.transferToInterpreter();
       throw exceptionBuilder()
@@ -2059,7 +2165,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
 
@@ -2113,7 +2219,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2148,7 +2254,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2191,7 +2297,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected final boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected final boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2260,7 +2366,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2304,7 +2410,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2348,7 +2454,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2441,34 +2547,41 @@ public abstract class TypeNode extends PklNode {
       }
     }
 
-    @Override
     @TruffleBoundary
+    private VmFunction newMixin(VmLanguage language, String qualifiedName) {
+      //noinspection ConstantConditions
+      return new VmFunction(
+          VmUtils.createEmptyMaterializedFrame(),
+          // Assumption: don't need to set the correct `thisValue`
+          // because it is guaranteed to be never accessed.
+          null,
+          1,
+          new IdentityMixinNode(
+              language,
+              new FrameDescriptor(),
+              getSourceSection(),
+              qualifiedName,
+              typeArgumentNodes.length == 1
+                  ?
+                  // shouldn't need to deepCopy() this node because it isn't used as @Child
+                  // anywhere else
+                  typeArgumentNodes[0]
+                  : null),
+          null);
+    }
+
+    @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
       if (typeAlias == BaseModule.getMixinTypeAlias()) {
-        //noinspection ConstantConditions
-        return new VmFunction(
-            VmUtils.createEmptyMaterializedFrame(),
-            // Assumption: don't need to set the correct `thisValue`
-            // because it is guaranteed to be never accessed.
-            null,
-            1,
-            new IdentityMixinNode(
-                language,
-                new FrameDescriptor(),
-                getSourceSection(),
-                qualifiedName,
-                typeArgumentNodes.length == 1
-                    ?
-                    // shouldn't need to deepCopy() this node because it isn't used as @Child
-                    // anywhere else
-                    typeArgumentNodes[0]
-                    : null),
-            null);
+        return newMixin(language, qualifiedName);
       }
 
-      return aliasedTypeNode.createDefaultValue(language, headerSection, qualifiedName);
+      return aliasedTypeNode.createDefaultValue(frame, language, headerSection, qualifiedName);
     }
 
     @Override
@@ -2498,11 +2611,8 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
-      if (!consumer.accept(this)) {
-        return false;
-      }
-      return aliasedTypeNode.acceptTypeNode(consumer);
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      return consumer.accept(this) && aliasedTypeNode.acceptTypeNode(visitTypeArguments, consumer);
     }
 
     @Override
@@ -2593,9 +2703,12 @@ public abstract class TypeNode extends PklNode {
 
     @Override
     public @Nullable Object createDefaultValue(
-        VmLanguage language, SourceSection headerSection, String qualifiedName) {
+        VirtualFrame frame,
+        VmLanguage language,
+        SourceSection headerSection,
+        String qualifiedName) {
 
-      return childNode.createDefaultValue(language, headerSection, qualifiedName);
+      return childNode.createDefaultValue(frame, language, headerSection, qualifiedName);
     }
 
     public SourceSection getBaseTypeSection() {
@@ -2622,11 +2735,11 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       if (!consumer.accept(this)) {
         return false;
       }
-      return childNode.acceptTypeNode(consumer);
+      return childNode.acceptTypeNode(visitTypeArguments, consumer);
     }
 
     public VmTyped getMirror() {
@@ -2662,7 +2775,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2690,7 +2803,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2749,7 +2862,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2777,7 +2890,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2817,7 +2930,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }
@@ -2857,7 +2970,7 @@ public abstract class TypeNode extends PklNode {
     }
 
     @Override
-    protected boolean acceptTypeNode(TypeNodeConsumer consumer) {
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
       return consumer.accept(this);
     }
   }

pkl-core/src/main/java/org/pkl/core/project/ProjectPackager.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -62,7 +62,6 @@ import org.pkl.core.util.ErrorMessages;
 import org.pkl.core.util.GlobResolver;
 import org.pkl.core.util.GlobResolver.InvalidGlobPatternException;
 import org.pkl.core.util.IoUtils;
-import org.pkl.core.util.Nullable;
 
 /**
  * Given a list of project directories, prepares artifacts to be published as a package.
@@ -441,7 +440,7 @@ public final class ProjectPackager {
     }
   }
 
-  private @Nullable List<ImportsAndReadsParser.Entry> getImportsAndReads(Path pklModulePath) {
+  private List<ImportsAndReadsParser.Entry> getImportsAndReads(Path pklModulePath) {
     try {
       var moduleKey = ModuleKeys.file(pklModulePath);
       var resolvedModuleKey = ResolvedModuleKeys.file(moduleKey, moduleKey.getUri(), pklModulePath);

pkl-core/src/main/java/org/pkl/core/repl/ReplServer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -45,10 +45,12 @@ import org.pkl.core.repl.ReplResponse.EvalSuccess;
 import org.pkl.core.repl.ReplResponse.InvalidRequest;
 import org.pkl.core.resource.ResourceReader;
 import org.pkl.core.runtime.*;
+import org.pkl.core.util.AnsiStringBuilder;
 import org.pkl.core.util.EconomicMaps;
 import org.pkl.core.util.IoUtils;
 import org.pkl.core.util.MutableReference;
 import org.pkl.core.util.Nullable;
+import org.pkl.core.util.SyntaxHighlighter;
 import org.pkl.parser.Parser;
 import org.pkl.parser.ParserError;
 import org.pkl.parser.syntax.Class;
@@ -69,6 +71,7 @@ public class ReplServer implements AutoCloseable {
   private final VmExceptionRenderer errorRenderer;
   private final PackageResolver packageResolver;
   private final @Nullable ProjectDependenciesManager projectDependenciesManager;
+  private final boolean color;
 
   public ReplServer(
       SecurityManager securityManager,
@@ -90,6 +93,7 @@ public class ReplServer implements AutoCloseable {
     this.securityManager = securityManager;
     this.moduleResolver = new ModuleResolver(moduleKeyFactories);
     this.errorRenderer = new VmExceptionRenderer(new StackTraceRenderer(frameTransformer), color);
+    this.color = color;
     replState = new ReplState(createEmptyReplModule(BaseModule.getModuleClass().getPrototype()));
 
     var languageRef = new MutableReference<VmLanguage>(null);
@@ -172,7 +176,7 @@ public class ReplServer implements AutoCloseable {
         .collect(Collectors.toList());
   }
 
-  @SuppressWarnings({"StatementWithEmptyBody", "DataFlowIssue"})
+  @SuppressWarnings({"StatementWithEmptyBody"})
   private List<Object> evaluate(
       ReplState replState,
       String requestId,
@@ -448,7 +452,10 @@ public class ReplServer implements AutoCloseable {
   }
 
   private String render(Object value) {
-    return VmValueRenderer.multiLine(Integer.MAX_VALUE).render(value);
+    var sb = new AnsiStringBuilder(color);
+    var src = VmValueRenderer.multiLine(Integer.MAX_VALUE).render(value);
+    SyntaxHighlighter.writeTo(sb, src);
+    return sb.toString();
   }
 
   private static class ReplState {

pkl-core/src/main/java/org/pkl/core/runtime/MinPklVersionChecker.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -63,7 +63,11 @@ final class MinPklVersionChecker {
         if (!Identifier.MIN_PKL_VERSION.toString().equals(prop.getIdentifier().getValue()))
           continue;
 
-        var versionText = prop.getExpr().text(source.toCharArray());
+        var versionTextExpr = prop.getExpr();
+        if (versionTextExpr == null) {
+          return;
+        }
+        var versionText = versionTextExpr.text(source.toCharArray());
 
         Version version;
         try {

pkl-core/src/main/java/org/pkl/core/runtime/MirrorFactories.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -184,7 +184,10 @@ public final class MirrorFactories {
             property ->
                 property.getProperty().isAbstract()
                         || property.getProperty().isExternal()
-                        || property.getProperty().getInitializer().isUndefined()
+                        || property
+                            .getProperty()
+                            .getInitializer()
+                            .isUndefined(VmUtils.createEmptyMaterializedFrame())
                     ? VmNull.withoutDefault()
                     :
                     // get default from prototype because it's cached there

pkl-core/src/main/java/org/pkl/core/runtime/StackTraceRenderer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ import org.pkl.core.StackFrame;
 import org.pkl.core.util.AnsiStringBuilder;
 import org.pkl.core.util.AnsiTheme;
 import org.pkl.core.util.Nullable;
+import org.pkl.core.util.SyntaxHighlighter;
 
 public final class StackTraceRenderer {
   private final Function<StackFrame, StackFrame> frameTransformer;
@@ -104,9 +105,11 @@ public final class StackTraceRenderer {
 
     var prefix = frame.getStartLine() + " | ";
     out.append(AnsiTheme.STACK_TRACE_MARGIN, leftMargin)
-        .append(AnsiTheme.STACK_TRACE_LINE_NUMBER, prefix)
-        .append(sourceLine)
-        .append('\n')
+        .append(AnsiTheme.STACK_TRACE_LINE_NUMBER, prefix);
+
+    SyntaxHighlighter.writeTo(out, sourceLine);
+
+    out.append('\n')
         .append(AnsiTheme.STACK_TRACE_MARGIN, leftMargin)
         .append(" ".repeat(prefix.length() + startColumn - 1))
         .append(AnsiTheme.STACK_TRACE_CARET, "^".repeat(endColumn - startColumn + 1))

pkl-core/src/main/java/org/pkl/core/runtime/VmBytes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,7 +37,7 @@ public final class VmBytes extends VmValue implements Iterable<Long> {
   private final byte[] bytes;
   private @Nullable VmDataSize size;
 
-  public static VmBytes EMPTY = new VmBytes(new byte[0]);
+  public static final VmBytes EMPTY = new VmBytes(new byte[0]);
 
   @TruffleBoundary
   public static VmBytes createFromConstantNodes(ExpressionNode[] elements) {

pkl-core/src/main/java/org/pkl/core/runtime/VmDynamic.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -100,7 +100,8 @@ public final class VmDynamic extends VmObject {
   @Override
   @TruffleBoundary
   public boolean equals(Object obj) {
-    if (this == obj) return true;
+    if (this == obj) // noinspection Contract
+    return true;
     if (!(obj instanceof VmDynamic other)) return false;
 
     // could use shallow force, but deep force is cached

pkl-core/src/main/java/org/pkl/core/runtime/VmImportAnalyzer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -94,9 +94,6 @@ public class VmImportAnalyzer {
     } catch (IOException err) {
       throw new VmExceptionBuilder().evalError("ioErrorLoadingModule", moduleKey.getUri()).build();
     }
-    if (importsAndReads == null) {
-      return Set.of();
-    }
     var result = new HashSet<ImportEntry>();
     for (var entry : importsAndReads) {
       if (!entry.isModule()) {

pkl-core/src/main/java/org/pkl/core/runtime/VmLanguage.java

@@ -33,7 +33,7 @@ import org.pkl.parser.syntax.Module;
 @TruffleLanguage.Registration(
     id = "pkl",
     name = "Pkl",
-    version = "0.30.2",
+    version = "0.31.0-dev",
     characterMimeTypes = VmLanguage.MIME_TYPE,
     contextPolicy = ContextPolicy.SHARED)
 public final class VmLanguage extends TruffleLanguage<VmContext> {

pkl-core/src/main/java/org/pkl/core/runtime/VmMapping.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -119,7 +119,8 @@ public final class VmMapping extends VmListingOrMapping {
   @Override
   @TruffleBoundary
   public boolean equals(Object obj) {
-    if (this == obj) return true;
+    if (this == obj) // noinspection Contract
+    return true;
     if (!(obj instanceof VmMapping other)) return false;
 
     // could use shallow force, but deep force is cached
@@ -180,4 +181,8 @@ public final class VmMapping extends VmListingOrMapping {
     cachedLength = count.get();
     return cachedLength;
   }
+
+  public boolean isEmpty() {
+    return getLength() == 0;
+  }
 }

pkl-core/src/main/java/org/pkl/core/runtime/VmUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -909,4 +909,9 @@ public final class VmUtils {
     return frame.getArguments().length != 4
         || frame.getArguments()[3] != VmUtils.SKIP_TYPECHECK_MARKER;
   }
+
+  @TruffleBoundary
+  public static String concat(String str1, String str2) {
+    return str1 + str2;
+  }
 }

pkl-core/src/main/java/org/pkl/core/stdlib/base/BaseNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -52,14 +52,14 @@ public final class BaseNodes {
 
   public abstract static class NaN extends ExternalPropertyNode {
     @Specialization
-    protected double eval(VmTyped self) {
+    protected double eval(VmTyped ignored) {
       return Double.NaN;
     }
   }
 
   public abstract static class Infinity extends ExternalPropertyNode {
     @Specialization
-    protected double eval(VmTyped self) {
+    protected double eval(VmTyped ignored) {
       return Double.POSITIVE_INFINITY;
     }
   }

pkl-core/src/main/java/org/pkl/core/stdlib/base/DataSizeNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,7 +27,8 @@ public final class DataSizeNodes {
   private DataSizeNodes() {}
 
   @ImportStatic(MathUtils.class)
-  public abstract static class value extends ExternalPropertyNode {
+  @PklName("value")
+  public abstract static class valueProperty extends ExternalPropertyNode {
     @Specialization(guards = "isMathematicalInteger(self.getValue())")
     protected long evalInt(VmDataSize self) {
       return (long) self.getValue();

pkl-core/src/main/java/org/pkl/core/stdlib/base/DurationNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,7 +29,8 @@ public final class DurationNodes {
   private DurationNodes() {}
 
   @ImportStatic(MathUtils.class)
-  public abstract static class value extends ExternalPropertyNode {
+  @PklName("value")
+  public abstract static class valueProperty extends ExternalPropertyNode {
     @Specialization(guards = "isMathematicalInteger(self.getValue())")
     protected long evalInt(VmDuration self) {
       return (long) self.getValue();

pkl-core/src/main/java/org/pkl/core/stdlib/base/ListNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -56,6 +56,13 @@ public final class ListNodes {
     }
   }
 
+  public abstract static class isNotEmpty extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(VmList self) {
+      return !self.isEmpty();
+    }
+  }
+
   public abstract static class lastIndex extends ExternalPropertyNode {
     @Specialization
     protected long eval(VmList self) {

pkl-core/src/main/java/org/pkl/core/stdlib/base/ListingNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -46,6 +46,13 @@ public final class ListingNodes {
     }
   }
 
+  public abstract static class isNotEmpty extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(VmListing self) {
+      return !self.isEmpty();
+    }
+  }
+
   public abstract static class lastIndex extends ExternalPropertyNode {
     @Specialization
     protected long eval(VmListing self) {

pkl-core/src/main/java/org/pkl/core/stdlib/base/MapNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -52,6 +52,13 @@ public final class MapNodes {
     }
   }
 
+  public abstract static class isNotEmpty extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(VmMap self) {
+      return !self.isEmpty();
+    }
+  }
+
   public abstract static class keys extends ExternalPropertyNode {
     @Specialization
     protected VmSet eval(VmMap self) {

pkl-core/src/main/java/org/pkl/core/stdlib/base/MappingNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,7 +15,6 @@
  */
 package org.pkl.core.stdlib.base;
 
-import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.dsl.Specialization;
 import com.oracle.truffle.api.nodes.IndirectCallNode;
 import org.pkl.core.ast.lambda.ApplyVmFunction1Node;
@@ -28,7 +27,6 @@ import org.pkl.core.stdlib.ExternalMethod0Node;
 import org.pkl.core.stdlib.ExternalMethod1Node;
 import org.pkl.core.stdlib.ExternalMethod2Node;
 import org.pkl.core.stdlib.ExternalPropertyNode;
-import org.pkl.core.util.EconomicMaps;
 import org.pkl.core.util.MutableBoolean;
 import org.pkl.core.util.MutableReference;
 
@@ -37,15 +35,15 @@ public final class MappingNodes {
 
   public abstract static class isEmpty extends ExternalPropertyNode {
     @Specialization
-    @TruffleBoundary
     protected boolean eval(VmMapping self) {
-      for (VmObjectLike curr = self; curr != null; curr = curr.getParent()) {
-        var cursor = EconomicMaps.getEntries(curr.getMembers());
-        while (cursor.advance()) {
-          if (!(cursor.getKey() instanceof Identifier)) return false;
-        }
-      }
-      return true;
+      return self.isEmpty();
+    }
+  }
+
+  public abstract static class isNotEmpty extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(VmMapping self) {
+      return !self.isEmpty();
     }
   }
 

pkl-core/src/main/java/org/pkl/core/stdlib/base/PairNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.pkl.core.stdlib.base;
 import com.oracle.truffle.api.dsl.Specialization;
 import org.pkl.core.runtime.VmPair;
 import org.pkl.core.stdlib.ExternalPropertyNode;
+import org.pkl.core.stdlib.PklName;
 
 public final class PairNodes {
   private PairNodes() {}
@@ -43,7 +44,8 @@ public final class PairNodes {
     }
   }
 
-  public abstract static class value extends ExternalPropertyNode {
+  @PklName("value")
+  public abstract static class valueProperty extends ExternalPropertyNode {
     @Specialization
     protected Object eval(VmPair self) {
       return self.getSecond();

pkl-core/src/main/java/org/pkl/core/stdlib/base/SetNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -46,6 +46,13 @@ public final class SetNodes {
     }
   }
 
+  public abstract static class isNotEmpty extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(VmSet self) {
+      return !self.isEmpty();
+    }
+  }
+
   public abstract static class isEmpty extends ExternalPropertyNode {
     @Specialization
     protected boolean eval(VmSet self) {

pkl-core/src/main/java/org/pkl/core/stdlib/base/StringNodes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -131,6 +131,13 @@ public final class StringNodes {
     }
   }
 
+  public abstract static class isNotEmpty extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(String self) {
+      return !self.isEmpty();
+    }
+  }
+
   public abstract static class isBlank extends ExternalPropertyNode {
     @Specialization
     protected boolean eval(String self) {
@@ -138,6 +145,13 @@ public final class StringNodes {
     }
   }
 
+  public abstract static class isNotBlank extends ExternalPropertyNode {
+    @Specialization
+    protected boolean eval(String self) {
+      return !StringUtils.isBlank(self);
+    }
+  }
+
   public abstract static class isRegex extends ExternalPropertyNode {
     @Specialization
     @TruffleBoundary

pkl-core/src/main/java/org/pkl/core/stdlib/test/report/JUnitReport.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,6 @@ import java.io.Writer;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.function.Consumer;
-import java.util.stream.Collectors;
 import org.graalvm.collections.EconomicMap;
 import org.pkl.core.TestResults;
 import org.pkl.core.TestResults.Error;
@@ -57,9 +56,8 @@ public final class JUnitReport implements TestReport {
 
   @Override
   public void summarize(List<TestResults> allTestResults, Writer writer) throws IOException {
-    var totalTests = allTestResults.stream().collect(Collectors.summingLong(r -> r.totalTests()));
-    var totalFailures =
-        allTestResults.stream().collect(Collectors.summingLong(r -> r.totalFailures()));
+    var totalTests = allTestResults.stream().mapToLong(TestResults::totalTests).sum();
+    var totalFailures = allTestResults.stream().mapToLong(TestResults::totalFailures).sum();
 
     assert aggregateSuiteName != null;
 
@@ -69,12 +67,11 @@ public final class JUnitReport implements TestReport {
             "tests", totalTests,
             "failures", totalFailures);
 
-    var tests =
-        allTestResults.stream()
-            .map(r -> buildSuite(r))
-            .collect(Collectors.toCollection(ArrayList::new));
-
-    var suite = buildXmlElement("testsuites", attrs, tests.toArray(new VmDynamic[0]));
+    var suite =
+        buildXmlElement(
+            "testsuites",
+            attrs,
+            allTestResults.stream().map(this::buildSuite).toArray(VmDynamic[]::new));
 
     writer.append(renderXML("    ", "1.0", suite));
   }

pkl-core/src/main/java/org/pkl/core/util/AnsiStringBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import java.io.PrintWriter;
 import java.util.EnumSet;
 import java.util.Set;
 
-@SuppressWarnings("DuplicatedCode")
+@SuppressWarnings({"DuplicatedCode", "UnusedReturnValue"})
 public final class AnsiStringBuilder {
   private final StringBuilder builder = new StringBuilder();
   private final boolean usingColor;
@@ -108,6 +108,25 @@ public final class AnsiStringBuilder {
     return this;
   }
 
+  /** Provides a runnable where anything appended is not affected by the existing context. */
+  public AnsiStringBuilder appendSandboxed(Runnable runnable) {
+    if (!usingColor) {
+      runnable.run();
+      return this;
+    }
+    var myCodes = currentCodes;
+    var myDeclaredCodes = declaredCodes;
+    currentCodes = EnumSet.noneOf(AnsiCode.class);
+    declaredCodes = EnumSet.noneOf(AnsiCode.class);
+    doReset();
+    runnable.run();
+    doReset();
+    currentCodes = myCodes;
+    declaredCodes = myDeclaredCodes;
+    doAppendCodes(currentCodes);
+    return this;
+  }
+
   /**
    * Append a string whose contents are unknown, and might contain ANSI color codes.
    *
@@ -180,6 +199,14 @@ public final class AnsiStringBuilder {
     return new PrintWriter(new StringBuilderWriter(builder));
   }
 
+  public int length() {
+    return builder.length();
+  }
+
+  public void setLength(int length) {
+    builder.setLength(length);
+  }
+
   /** Builds the data represented by this builder into a {@link String}. */
   public String toString() {
     // be a good citizen and unset any ansi escape codes currently set.

pkl-core/src/main/java/org/pkl/core/util/AnsiTheme.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,5 +37,15 @@ public final class AnsiTheme {
   public static final AnsiCode TEST_NAME = AnsiCode.FAINT;
   public static final AnsiCode TEST_FACT_SOURCE = AnsiCode.RED;
   public static final AnsiCode TEST_FAILURE_MESSAGE = AnsiCode.RED;
-  public static final Set<AnsiCode> TEST_EXAMPLE_OUTPUT = EnumSet.of(AnsiCode.RED, AnsiCode.BOLD);
+  public static final EnumSet<AnsiCode> TEST_EXAMPLE_OUTPUT =
+      EnumSet.of(AnsiCode.RED, AnsiCode.BOLD);
+
+  public static final AnsiCode SYNTAX_KEYWORD = AnsiCode.BLUE;
+  public static final AnsiCode SYNTAX_NUMBER = AnsiCode.GREEN;
+  public static final AnsiCode SYNTAX_STRING = AnsiCode.YELLOW;
+  public static final AnsiCode SYNTAX_STRING_ESCAPE = AnsiCode.BRIGHT_YELLOW;
+  public static final AnsiCode SYNTAX_COMMENT = AnsiCode.FAINT;
+  public static final AnsiCode SYNTAX_OPERATOR = AnsiCode.RESET;
+  public static final AnsiCode SYNTAX_CONTROL = AnsiCode.BLUE;
+  public static final AnsiCode SYNTAX_CONSTANT = AnsiCode.CYAN;
 }

pkl-core/src/main/java/org/pkl/core/util/SyntaxHighlighter.java

@@ -0,0 +1,172 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.core.util;
+
+import static org.pkl.parser.Token.FALSE;
+import static org.pkl.parser.Token.NULL;
+import static org.pkl.parser.Token.STRING_ESCAPE_BACKSLASH;
+import static org.pkl.parser.Token.STRING_ESCAPE_NEWLINE;
+import static org.pkl.parser.Token.STRING_ESCAPE_QUOTE;
+import static org.pkl.parser.Token.STRING_ESCAPE_RETURN;
+import static org.pkl.parser.Token.STRING_ESCAPE_TAB;
+import static org.pkl.parser.Token.STRING_ESCAPE_UNICODE;
+import static org.pkl.parser.Token.TRUE;
+
+import java.util.EnumSet;
+import org.pkl.parser.Lexer;
+import org.pkl.parser.ParserError;
+import org.pkl.parser.Token;
+
+/** Syntax highlighter that emits ansi color codes. */
+public final class SyntaxHighlighter {
+  private SyntaxHighlighter() {}
+
+  private static final EnumSet<Token> stringEscape =
+      EnumSet.of(
+          STRING_ESCAPE_NEWLINE,
+          STRING_ESCAPE_TAB,
+          STRING_ESCAPE_RETURN,
+          STRING_ESCAPE_QUOTE,
+          STRING_ESCAPE_BACKSLASH,
+          STRING_ESCAPE_UNICODE);
+
+  private static final EnumSet<Token> constant = EnumSet.of(TRUE, FALSE, NULL);
+
+  private static final EnumSet<Token> operator =
+      EnumSet.of(
+          Token.COALESCE,
+          Token.LT,
+          Token.GT,
+          Token.NOT,
+          Token.EQUAL,
+          Token.NOT_EQUAL,
+          Token.LTE,
+          Token.GTE,
+          Token.AND,
+          Token.OR,
+          Token.PLUS,
+          Token.MINUS,
+          Token.POW,
+          Token.STAR,
+          Token.DIV,
+          Token.INT_DIV,
+          Token.MOD,
+          Token.PIPE);
+
+  private static final EnumSet<Token> keyword =
+      EnumSet.of(
+          Token.AMENDS,
+          Token.AS,
+          Token.EXTENDS,
+          Token.CLASS,
+          Token.TYPE_ALIAS,
+          Token.FUNCTION,
+          Token.MODULE,
+          Token.IMPORT,
+          Token.IMPORT_STAR,
+          Token.READ,
+          Token.READ_STAR,
+          Token.READ_QUESTION,
+          Token.TRACE,
+          Token.THROW,
+          Token.UNKNOWN,
+          Token.NOTHING,
+          Token.OUTER,
+          Token.SUPER,
+          Token.THIS,
+          Token.HIDDEN,
+          Token.ABSTRACT,
+          Token.CONST,
+          Token.FIXED,
+          Token.LOCAL,
+          Token.OPEN);
+
+  private static final EnumSet<Token> control =
+      EnumSet.of(Token.NEW, Token.IF, Token.ELSE, Token.WHEN, Token.FOR, Token.IN, Token.OUT);
+
+  private static final EnumSet<Token> number =
+      EnumSet.of(Token.INT, Token.FLOAT, Token.BIN, Token.OCT, Token.HEX);
+
+  public static void writeTo(AnsiStringBuilder out, String src) {
+    var prevLength = out.length();
+    try {
+      var lexer = new Lexer(src);
+      doHighlightNormal(out, lexer.next(), lexer, Token.EOF);
+    } catch (ParserError err) {
+      // bail out and emit everything un-highlighted
+      out.setLength(prevLength);
+      out.append(src);
+    }
+  }
+
+  private static void highlightString(AnsiStringBuilder out, Lexer lexer, Token token) {
+    out.append(
+        AnsiTheme.SYNTAX_STRING,
+        () -> {
+          var next = token;
+          while (next != Token.STRING_END && next != Token.EOF) {
+            if (stringEscape.contains(next)) {
+              out.append(AnsiTheme.SYNTAX_STRING_ESCAPE, lexer.text());
+              next = advance(out, lexer);
+              continue;
+            } else if (next == Token.INTERPOLATION_START) {
+              out.append(AnsiTheme.SYNTAX_STRING_ESCAPE, lexer.text());
+              out.appendSandboxed(() -> doHighlightNormal(out, lexer.next(), lexer, Token.RPAREN));
+              out.append(AnsiTheme.SYNTAX_STRING_ESCAPE, lexer.text());
+              lexer.next();
+            }
+            out.append(lexer.text());
+            next = advance(out, lexer);
+          }
+          out.append(lexer.text());
+        });
+  }
+
+  private static void doHighlightNormal(AnsiStringBuilder out, Token next, Lexer lexer, Token end) {
+    {
+      while (next != end && next != Token.EOF) {
+        if (constant.contains(next)) {
+          out.append(AnsiTheme.SYNTAX_CONSTANT, lexer.text());
+        } else if (operator.contains(next)) {
+          out.append(AnsiTheme.SYNTAX_OPERATOR, lexer.text());
+        } else if (control.contains(next)) {
+          out.append(AnsiTheme.SYNTAX_CONTROL, lexer.text());
+        } else if (keyword.contains(next)) {
+          out.append(AnsiTheme.SYNTAX_KEYWORD, lexer.text());
+        } else if (next.isAffix()) {
+          out.append(AnsiTheme.SYNTAX_COMMENT, lexer.text());
+        } else if (number.contains(next)) {
+          out.append(AnsiTheme.SYNTAX_NUMBER, lexer.text());
+        } else if (next == Token.STRING_MULTI_START || next == Token.STRING_START) {
+          highlightString(out, lexer, next);
+        } else {
+          out.append(lexer.text());
+        }
+        next = advance(out, lexer);
+      }
+    }
+  }
+
+  private static Token advance(AnsiStringBuilder out, Lexer lexer) {
+    var prevCursor = lexer.getCursor();
+    var next = lexer.next();
+    // fill in any whitespace (includes semicolons)
+    if (lexer.getStartCursor() > prevCursor) {
+      out.append(lexer.textFor(prevCursor, lexer.getStartCursor() - prevCursor));
+    }
+    return next;
+  }
+}

pkl-core/src/main/java/org/pkl/core/util/json/Json.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -362,7 +362,7 @@ public final class Json {
     }
 
     @Override
-    public Object put(String key, Object value) {
+    public @Nullable Object put(String key, Object value) {
       return delegate.put(key, value);
     }
 

pkl-core/src/test/files/LanguageSnippetTests/input/api/list.pkl

@@ -12,6 +12,11 @@ facts {
     !list1.isEmpty
   }
 
+  ["isNotEmpty"] {
+    !List().isNotEmpty
+    list1.isNotEmpty
+  }
+
   ["every()"] {
     list1.every((x) -> x <= 3)
     !list1.every((x) -> x > 2)

pkl-core/src/test/files/LanguageSnippetTests/input/api/listing.pkl

@@ -42,7 +42,16 @@ facts {
     !altered.isEmpty
     !computedIndex.isEmpty
   }
-  
+
+  ["isNotEmpty"] {
+    !empty.isNotEmpty
+    !empty2.isNotEmpty
+    base.isNotEmpty
+    derived.isNotEmpty
+    altered.isNotEmpty
+    computedIndex.isNotEmpty
+  }
+
   ["lastIndex"] {
     empty.lastIndex == -1
     empty2.lastIndex == -1