Changelog

🏠 Overview  •  📦 Installation  •  📖 Usage  •  🏗️ Architecture  •  🏢 Enterprise  •  🔒 Locking  •  🌐 Networking  •  🐚 Shells  •  🎯 Threat Matrix  •  ❓ FAQ  •  ⚖️ SDKMAN! Comparison  •  📜 Changelog  •  🛡️ Security  •  🤝 Contributing  •  💬 Support

---

All notable changes to the Java Version Manager for Windows will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.0.2] - 2026-09-23

This release delivers an exhaustive defensive security hardening overhaul across the entire JVM runtime engine (jvm.bat), corporate PKI and proxy integration, hermetic lockfile cryptography, next-gen environment profiles, toolchain snapshots, portable bundles, air-gapped distro kits, multi-shell ergonomics, modular architecture documentation, ecosystem supply-chain verification, interactive UI ergonomics, UAC elevation boundaries, CI/CD pipelines, package manifests, micro-UX parameter consistency, stable machine-readable JSON contracts, execution timing telemetry, and an enterprise-grade error management and atomic rollback architecture. It introduces automated GitHub Releases API asset digest extraction, multi-mirror download resilience, interactive unverified checksum prompt fallbacks, and comprehensive error visibility, accompanied by an expanded 327-test automated adversarial security and error-injection test suite spanning 41 MITRE CWE classes (CWE-20 through CWE-918, including CWE-798) across 16 defensive suites achieving a verified 10.0 / 10.0 audit scorecard (327 / 327 PASS).

Next-Gen Portability, Toolchain Bundles & Air-Gapped Distros (Phase P4)

• Named Environment Profiles (jvm profile / profiles): Added full lifecycle management (create, use, activate, list, show, clone, delete) for named multi-toolchain workstation profiles (work, ci, cloud-native). Features multi-tool atomic switching with pre-validation and automatic rollback (CWE-460), non-destructive --dry-run preview, reparse point defense (CWE-59), and universal JSON API envelopes.
• Toolchain Snapshots (jvm snapshot / snapshots): Implemented point-in-time state capture (create, restore, list, delete) storing full active tool configurations, environment variables, and config.json state into lightweight JSON snapshots. Restoration enforces strict transactional consistency: candidate directory junctions are switched first and config.json is committed only upon 100% success, with dual pre-state rollback restoring all junctions and reverting config.json on failure (CWE-460).
• Portable Environment Bundles (jvm bundle / bundles): Added self-contained .jvmbundle container packing (create, inspect, install, list) for exporting and importing active JDK binaries, ecosystem build tools, and .jvm.lock manifests. Hardened against ZipSlip directory traversal (CWE-22), reparse points (CWE-59), and spoofed archives via 0x50 0x4B PK magic byte validation (CWE-494).
• Zero-Network Air-Gapped Toolchain Distros (jvm distro & install.ps1 -Offline): Added jvm distro create --out <dir> generating standalone offline distribution kits with cryptographic distro-manifest.json. Enhanced install.ps1 with [switch]$Offline and [string]$DistroDir parameters to provision JVM and pre-seeded caches with zero outbound network calls.
• Security Test Suite Expansion (327 Tests across 16 Suites): Appended Suite 16 (Portability, Tests 309 through 323, plus Test 315b) covering profile operations, traversal rejections, symlink isolation, dry-run immutability, magic byte verification, ZipSlip defenses, distro creation, and offline installation. Total executed tests: 327 / 327 PASS.

Micro-UX Polish, Structured JSON API Contracts & Execution Timing Breakdown

• Consistent Parameter Grammar & Subcommand Dedicated Help Cards: Standardized parameter grammar across all 30 subcommands and aliases (-h, --help, /?, -v, --version, --timings). Implemented dedicated syntax reference cards (:ShowSubcommandHelp) for all 30 subcommands with syntax, flags, and copy-paste ready examples, alongside early version/help interceptors (:EARLY_VERSION, :EARLY_HELP) that avoid disk writes or interactive prompts.
• Universal Structured JSON API Contracts: Enforced universal schema envelope (ok, command, candidate, resolved, changed) across all CLI query commands (jvm current --json, jvm which --json, jvm list --json, jvm doctor --json, jvm lock check/diff/verify --json, jvm verify --json, jvm policy show/check --json, and :EmitContextualError), guaranteeing long-term backward-compatible machine-readable API contracts for IDE plugins and CI/CD agents.
• Native Centisecond Execution Timing Breakdown (--timings): Added --timings metric breakdown emitting [ TIMINGS ] parse: ... ms | resolve: ... ms | execute: ... ms | total: ... ms powered by 100% native Windows batch centisecond time arithmetic (:CalcElapsedCs, :EmitTimings) with zero external processes. In --json mode, timings are cleanly isolated to stderr (>&2), preserving pure JSON on stdout.

Enterprise Workstation Governance & Corporate PKI (CWE-295 / CWE-319)

• Machine-Wide Policy Enforcement (%ProgramData%\DiamTek\JVM\policy.toml / $env:JVM_POLICY_FILE): Implemented non-bypassable administrative policy governance restricting allowed vendors, release channels, early-access builds, and mandatory lockfiles.
• Enterprise Policy CLI Subcommands (jvm policy show & jvm policy check): Added commands to display active machine policies and audit local project workspaces against organizational rules, with full --json support.
• Corporate Proxy Discovery & Authentication: Automated detection of HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY, plus --proxy and --proxy-auth overrides and seamless Windows Integrated Authentication (NTLM / Kerberos) via DefaultNetworkCredentials.
• Windows Certificate Store Integration: Integrated native Windows Cryptographic APIs (Cert:\LocalMachine\Root and Cert:\CurrentUser\Root) to trust enterprise Root CAs during transit, eliminating PKIX path building failed errors on SSL-inspecting proxies without manual cacerts mutations.

Hermetic Lockfile Cryptography (CWE-354 / CWE-494)

• Hermetic Freezing (jvm freeze): Converts floating or broad version specifications in .jvm.toml into exact, immutable patch and build coordinates in .jvm.lock. Resolves authentic upstream distribution archive URLs and SHA-256 / SHA-512 checksums via Adoptium API v3 and upstream candidate catalogs, preserves all existing lockfile metadata fields (url, arch, checksum_type), and completely eliminates extracted local file hashing fallbacks (release, java.exe, <tool>.bat), failing closed if authentic coordinates cannot be resolved.
• Controlled Thawing (jvm thaw): Relaxes exact patch and build coordinates back to major semantic versions for safe upgrade discovery.
• 3-State Cryptographic Signature Audits (jvm lock --check): Evaluates .jvm.lock.sig integrity into three distinct states: verified (valid signature under authorized key), failed (invalid/tampered signature, halting with exit code 1), and not_verified (missing signature or secret key, warning cleanly without false-positive claims).
• Cryptographic Anti-Tampering Signatures (.jvm.lock.sig): HMAC-SHA256 signature generation (jvm lock --sign) and verification (jvm lock --verify) rejecting hardcoded fallback keys and requiring explicit caller-managed secrets ($env:JVM_LOCK_SECRET, --secret, --key-file) (CWE-798).

Ecosystem Status & Multi-Shell Ergonomics

• Unified Multi-Tool Ecosystem Dashboard (jvm status / jvm ecosystem): Displays real-time status across Java and all 11 ecosystem candidates (Maven, Gradle, Kotlin, Scala, Groovy, Ant, sbt, JBang, Quarkus, Spring Boot, Micronaut) with --json export.
• Dynamic Context-Aware PowerShell Completions: Rich Register-ArgumentCompleter tab completions for jvm use, jvm uninstall, jvm install --vendor, jvm --channel, candidates, and installed versions.
• Command Prompt DOSKEY Ergonomics (jvm aliases): Lightweight DOSKEY macros (j21, j17, juse, jstat, etc.) and AutoRun registry helper recipes.

Modular Security Architecture Documentation

• Published 5 dedicated architectural guides:
  • docs/ENTERPRISE.md (Enterprise policy, proxy, and PKI deployment)
  • docs/LOCKING.md (Hermetic locking, freezing, and HMAC signing)
  • docs/NETWORKING.md (Proxy negotiation, TLS trust, and CAS caching)
  • docs/SHELLS.md (PowerShell completions, CMD macros, and cross-shell sync)
  • docs/THREAT-MATRIX.md (41-CWE mapping, STRIDE threat modeling, and mutation testing)

Adversarial Robustness, Mutation Testing & Zero Empty Catch Enforcement

• NTFS Alternate Data Stream (ADS) Defense: Rejection of stream delimiters (java:stream) across vendor and candidate parameters (CWE-66).
• Poison Character Fuzzing: Rejection of shell command injection metacharacters (&, |, <, >, ^, %, !, $()) across all CLI entry points (CWE-78).
• AST Zero Empty Catch Enforcement: Enforced repository-wide rule prohibiting empty catch {} blocks across all PowerShell scripts (CWE-390).
• Test Suite Expansion: Added Suites 12 through 16 (Tests 264–323, plus Tests 285b, 285c, 285d, 315b) in tests/Test-JvmSecurity.ps1, expanding the suite to 327 tests across 16 defensive suites achieving 327 / 327 PASS (100% pass rate).

Environment Resolution, Diagnostics & Toolchain Automation

• Multi-Phase Installation UI ([1/6] through [5/6]): Re-engineered interactive and headless candidate installation flows with clear numbered phase indicators: [1/6] Resolving release, [2/6] Querying checksums, [3/6] Streaming package, [4/6] Verifying integrity, [5/6] Extracting runtime, and [6/6] Linking environment.
• Real-Time Throughput & Dynamic ETA Meter: Integrated real-time download telemetry emitting streaming progress, transfer speed (MB/s), and dynamic estimated time of arrival (ETA ss) without third-party dependencies.
• Adaptive Terminal Width Layout: Implemented dynamic terminal dimension detection formatting status cards, candidate listings, and progress bars into normal, compact, or ultra-compact layouts based on active console width.
• Clean Aligned Data Tables: Re-engineered CLI output across list, project, explain, and cache stats to use border-aligned, structured tabular formatting.
• Script-Friendly Single Values (--short, --numeric, --bin, jvm vendor): Added dedicated single-value query flags (jvm current --short, jvm current --numeric, jvm current --bin, jvm vendor [--short]) enabling zero-regex integration with starship prompt widgets, CI build matrices, and PowerShell $PROFILE statuslines.
• Environment Resolution Explainer (jvm why): Added real-time 7-tier decision graph tracer (SESSION override -> directory .java-version -> directory .sdkmanrc -> project .jvm.toml -> .jvm.lock -> user config.json -> system PATH) displaying the exact reason and precedence tier for the active runtime.
• Deep 7-Layer Candidate Analysis (jvm explain <candidate>): Added comprehensive candidate inspection diagnosing Layer 1 Candidate Identity, Layer 2 Storage Hierarchy, Layer 3 Junction Link Status, Layer 4 Environment Bindings, Layer 5 Security DACL Integrity, Layer 6 Lockfile Manifest Status, and Layer 7 CAS Provenance & SHA-256 integrity.
• Polished First-Run Experience & Guided Onboarding: Added transparent first-run banner detailing AppData storage locations, junction mechanics, and non-destructive registry integration, suppressed automatically once initialized (.initialized).
• Interactive Built-in Tutorial (jvm welcome / jvm tutorial): Integrated self-guided onboarding tutorial explaining switching modes, essential commands, security models, and project pinning.
• Smart Contextual Execution (jvm run <task>): Added intelligent contextual task runner automatically detecting project build tools (mvnw.cmd, mvnw.bat, gradlew.bat, gradlew.cmd, pom.xml, build.gradle, build.gradle.kts) and dispatching execution cleanly.
• Proactive Toolchain Conflict Detection: Integrated automated pre-flight toolchain compatibility scanner in jvm run alerting developers when legacy Gradle wrappers are paired with Java 21+ / Java 25+, or when pom.xml target version exceeds the active Java runtime.
• Content-Addressed Storage Telemetry & Deduplication (jvm cache stats & jvm cache dedupe): Added detailed CAS cache telemetry table (jvm cache stats / --stats) itemizing blob counts, disk footprints, and retention policies, paired with jvm cache dedupe to scan and reclaim duplicate binary storage across candidates.
• Sanitized Diagnostic Environment Reporting (jvm report): Added jvm report producing jvm-report.txt with automated redaction of usernames, tokens, credentials, and sensitive environment variables (CWE-209 / CWE-532).
• Automated Issue & Support Bundles (jvm doctor --report & jvm support): Added one-click diagnostic bundling packaging health audits, configs, ownership manifests, and environment reports into jvm-issue-bundle.zip and jvm-support-bundle.zip for GitHub issue submissions.
• Self-Update History & Rollback (jvm self-update --history & --rollback): Added timestamped version history tracking for jvm.bat updates with atomic single-step rollback (jvm self-update --rollback) and pre-restoration EOF integrity verification.
• Adversarial Test Suite Expansion (263 Tests): Appended Tests 239 through 263 to tests/Test-JvmSecurity.ps1, expanding test coverage across single-value queries, why resolution graph, explain 7-layer candidate analysis, welcome tutorial, contextual run dispatch, toolchain conflict detection, cache statistics and deduplication, diagnostic report redaction, issue/support bundle creation, self-update rollback validation, cache bundle import Zip Slip and reparse point rejection (CWE-22 / CWE-59), cache bundle import CAS SHA-256 integrity and fail-safe cleanup (CWE-494 / CWE-460), remote search candidate tool routing and --json output mode (CWE-20), version comparison specification baseline and multi-LTS milestone JEP chaining (CWE-20), transaction journal rollback aliases and automatic stale lock recovery (CWE-460 / CWE-459), and PowerShell profile hook status inspection (CWE-20). Total executed tests: 263 / 263 PASS.

Configuration Engine & Directory Switching

• Unified Configuration Engine (jvm config & config.json — CWE-20 / CWE-74): Added persistent global configuration management located at %LOCALAPPDATA%\DiamTek\JVM\config.json. Supports jvm config get [key], jvm config set <key> <value>, and jvm config reset, with automatic factory default recovery and strict key allowlisting (default_vendor, mode, channel, auto_update_check, auto_switch, color, telemetry, cache_size, retries, timeout).
• Project Toolchain Configuration (.jvm.toml, .jvmrc & jvm project — CWE-20 / CWE-78): Added native support for project-level toolchain configuration files (.jvm.toml and .jvmrc). Subcommand jvm project inspects active toolchain readiness and declared versions. Parsing executes with metacharacter filtering to prevent shell escape attacks.
• Environment Delta Inspection (jvm env --diff): Added delta inspection mode comparing live terminal environment variables (JAVA_HOME, PATH) against persistent Windows registry baselines (HKCU / HKLM) in a structured diff view.
• Automated Self-Healing (jvm doctor --fix & --dry-run — CWE-59 / CWE-460): Added --fix repair capabilities to jvm doctor to automatically unbind orphaned directory junctions and purge stale Oracle javapath entries from PATH. Added --dry-run to preview pending repairs without modifying disk or registry state.
• Universal Simulation Flag (--dry-run — CWE-460): Added universal --dry-run flag support across mutating operations (jvm clean --dry-run, jvm cache clean --dry-run, jvm cache prune --dry-run, jvm doctor --fix --dry-run, jvm uninstall <ver> --dry-run, jvm self-update --dry-run, and jvm update --all --dry-run), allowing developers and automation pipelines to safely inspect proposed filesystem and environment modifications without altering system state.
• Universal Quiet & Scripting Mode (--quiet / -q — CWE-209): Added --quiet and -q flags to suppress decorative banners, non-essential status logs, and interactive countdown pauses, enabling clean piping in CI/CD environments.
• Universal Diagnostics & Verbose Mode (--verbose — CWE-209): Added --verbose flag activating enhanced runtime tracing, network query logs, and diagnostic telemetry.
• Standardized Semantic Exit Codes (CWE-252): Standardized process exit codes across all batch routines (0 = Success, 1 = General Error, 2 = Invalid Arguments, 3 = Missing Target, 4 = Network/Download Failure, 5 = Integrity/Checksum Mismatch, 6 = Reparse/Junction Failure, 7 = Registry Error, 8 = Elevation/Permission Denied, 9 = Lock Contention, 10 = User Cancelled). Propagated consistently across CMD and subshell boundaries via exit /b !FINAL_RET!.
• Contextual Actionable Errors Subsystem (:EmitContextualError — CWE-209): Re-engineered CLI error reporting with a 4-part structured diagnostic format: Title, Reason (Reason:), System State (State:), and concrete Remediation (Remediation:). When --json is supplied, emits structured JSON payloads ({"error":...,"reason":...,"state":...,"remediation":...}) to standard error while preserving semantic non-zero exit codes.
• CMD AutoRun Hook & PowerShell Directory Navigation Hook (CWE-427 / CWE-73):
  • In install.ps1, registers a native CMD Command Processor AutoRun hook (HKCU:\Software\Microsoft\Command Processor\AutoRun) installing cmd_hook.cmd and defining doskey cd=call ... --session-cd $* for transparent directory-level switching under Command Prompt.
  • Enhanced the PowerShell $PROFILE prompt hook to automatically detect .jvm.toml, .jvmrc, or .java-version upon changing directories, activating session JDKs and restoring host environment baselines upon exiting project boundaries.
  • Added complete uninstallation cleanup in uninstall.ps1 to strip cmd_hook.cmd from AutoRun and delete the hook file.
• Content-Addressed Artifact Storage (CAS) & Cache Engine (jvm cache — CWE-73 / CWE-20): Added central artifact cache located at %LOCALAPPDATA%\DiamTek\JVM\cache\ with content-addressed storage layout (cache\sha256\xx\...) preventing redundant payload downloads across toolchains. Added cache management commands: jvm cache list, jvm cache size, jvm cache clean, jvm cache prune, jvm cache export --bundle <file>, and jvm cache import <file>.
• True Air-Gapped Offline Mode (--offline — CWE-918): Enhanced jvm install <version> --offline to inspect and provision directly from the local CAS artifact cache without making network calls.
• Resumable Downloads & Smart Retry Backoff (CWE-400 / CWE-754): Enhanced downloader pipeline with HTTP Range headers to resume interrupted multi-hundred MB downloads using .part staging files (HTTP 206 Partial Content). Implemented smart retry with exponential backoff on HTTP 429 (1s, 2s, 4s, 8s) and jitter on 5xx/timeout, terminating immediately on HTTP 404 and hash mismatches.
• Enterprise Download Mirrors & Exact Semantic Builds (CWE-319 / CWE-20): Added mirror setting to config.json (jvm config set mirror <url>) with strict checksum preservation. Added support for exact semantic vendor build strings containing + (e.g., 25.0.1+8) in :ValidateStrictIdentifier and jvm list-remote java.
• Remote Search, Release Info & Comparison Engine (CWE-20): Introduced jvm search <candidate> [query] for remote catalog metadata inspection, jvm info [version] for release date, LTS status, and CVE classification, and jvm compare <v1> <v2> for structured feature/JEP deltas across versions.
• Security-Aware Update Channel (jvm update --security): Added --security flag restricting automated updates strictly to confirmed CVE security patches.
• Variable Ownership Tracking (ownership.json — CWE-73): Added %LOCALAPPDATA%\DiamTek\JVM\ownership.json to record variables and PATH entries managed by DiamTek JVM. Updated uninstall.ps1 to cross-reference ownership markers and preserve unowned user environment variables.
• Adversarial Test Suite Expansion (238 Tests): Added Tests 219 through 238 to tests/Test-JvmSecurity.ps1, expanding test coverage across CAS structures, air-gapped installation, cache management, resumable range downloads, exponential retry backoff, mirror routing, semantic build tags, remote search, release comparison, variable ownership tracking, universal --dry-run simulation, --quiet/-q banner suppression, --verbose tracing, standardized semantic exit codes 0–10, and contextual actionable error reporting.

Ecosystem Downloader & Cryptographic Verification (CWE-494)

• GitHub Releases API Asset Digest Auto-Discovery (jvm.bat — CWE-494): In :ExecuteSharedDownloader, whenever an upstream ecosystem candidate does not publish standalone .zip.sha256 or .sha512 files (such as Micronaut CLI micronaut-projects/micronaut-starter), JVM now queries the official GitHub Releases REST API (api.github.com/repos/<owner>/<repo>/releases/tags/<tag>) to automatically retrieve the asset’s cryptographic digest (sha256:<hex>). Endpoints are strictly validated against SSRF (CWE-918) and Open Redirects (CWE-601) via Test-TrustedJvmUri.
• Apache Maven Multi-Mirror Fallback: Added downloads.apache.org as the primary download endpoint with automatic fallback to repo.maven.apache.org and archive.apache.org, eliminating HTTP 404 download errors on newly released Apache Maven binaries.
• Interactive UI Unverified Checksum Prompt: If an ecosystem candidate lacks both standalone checksum files and API digests, and the user is in interactive UI mode (IS_INTERACTIVE_UI=1), JVM now prompts Do you want to continue installation without checksum verification? (y/N) instead of failing closed with an unusable CLI flag instruction (--skip-checksum).

Interactive UI Ergonomics & Candidate Management

• Guaranteed Error Visibility on Failure Paths: Added interactive pause calls across all failure and exit paths in :InstallCandidate (if "!CLI_COMMAND!"=="" if "!IS_UPDATER!"=="" pause). Error logs and diagnostic details remain visible on screen until acknowledged, preventing errors from vanishing when returning to the interactive menu.
• Interactive Version Activation Prompts:
  • When installing a new version of an ecosystem candidate when an older version is already installed and active, :InstallCandidate now asks: Would you like to activate <Tool> <Version> now? (y/N): .
  • In :EcoPerformCheck (Ecosystem Tool Updater), if the newest version is already installed locally on disk but not active, JVM clarifies the state (Latest version (<version>) is installed, but active version is <current>) and offers to switch (Do you want to switch active <Tool> to <Version>? [Y,N]?). In CLI mode (jvm update <candidate>), it automatically activates the installed latest version.
• Ecosystem CLI Command Routing: Enhanced :RouteEcosystemCandidate to seamlessly handle jvm update <candidate>, jvm <candidate> update, and jvm <candidate> list.
• Strict CRLF Self-Healing & Line Ending Parity: Enforced 100% Windows CRLF (\r\n) across all repository files and scripts, with zero bare LF and UTF-8 No BOM.

Multi-Vendor & Universal Ecosystem Expansion

• Expansion to 12 Upstream JDK Vendors (jvm.bat — CWE-20 / CWE-754): Added first-class native support for 4 new enterprise JDK distributions: SAP SapMachine (direct zero-rate-limit release API, SHA256 verification), Red Hat Mandrel (downstream GraalVM Native Image optimized for Quarkus, GitHub Releases API), Alibaba Dragonwell (high-throughput e-commerce runtime with JWarmup/Wisp, GitHub Releases API), and Tencent Kona (cloud-scale OpenJDK with MD5/SHA256 checksums). Expanded interactive vendor menus with GET_BV_CHOICE_MANUAL safe input handling when choices exceed 9, added --vendor tab completion for all 12 vendors, and updated .sdkmanrc translations (-sapm, -mandrel, -dragonwell, -kona).
• Expansion to 11 Ecosystem Build Tools (jvm.bat): Added native support for 6 new ecosystem tools: Apache Ant (Apache mirror API, SHA512 verification), sbt (Scala Build Tool, GitHub Releases, SHA256), JBang (GitHub Releases, SHA256), Quarkus CLI (GitHub Releases, multi-line SHA256 checksum file parsing), Spring Boot CLI (Spring repo, SHA1), and Micronaut (GitHub Releases, SHA256, mn.bat binary mapping). Added full CLI routing (jvm ant, jvm sbt, jvm jbang, jvm quarkus, jvm spring, jvm micronaut, jvm mn), double-dash flags, auto-switching, and candidate folder navigation.
• Direct Candidate Update Routing (jvm update <candidate>): Added direct support for checking and updating individual ecosystem candidates via CLI commands like jvm update maven, jvm update ant, jvm quarkus update, or jvm micronaut update.
• Strict 12-Variable Environment Parity across install.ps1, uninstall.ps1, and jvm.bat: Synchronized $allowedVars and uninstallation scrubbing lists for all 12 environment variables: JAVA_HOME, MAVEN_HOME, GRADLE_HOME, KOTLIN_HOME, SCALA_HOME, GROOVY_HOME, ANT_HOME, SBT_HOME, JBANG_HOME, QUARKUS_HOME, SPRING_HOME, and MICRONAUT_HOME.
• Build Version Bump: Updated build identifier to Build 20261014.159.

Interactive Ergonomics & Update Engine Hardening

• Reproducible Lockfiles (.jvm.lock & jvm install --locked) (CWE-354 / CWE-494): Added native lockfile specification and engine (jvm lock / jvm install --locked, -l, --lock). Records exact candidate name, version, vendor, architecture, official download URL, and cryptographic SHA-256 digest in a structured Schema v2 .jvm.lock manifest. Features atomic staged commits (.stage.<guid>.tmp -> .jvm.lock), compositional multi-tool locking (merging Java and candidate tools), hierarchical ancestor directory search, lockfile auditing (--check, --diff, --update), symlink/reparse point validation (CWE-59), official domain allowlist verification (CWE-918), and fail-closed SHA-256 integrity verification before payload extraction.
• Cryptographic Provenance Verification (jvm verify): Added a 6-tier cryptographic and provenance verification engine (jvm verify <version|all>) that audits local binaries for artifact existence, HTTPS origins, host trust (CWE-918), SHA-256 integrity, Authenticode signatures, and complete provenance chains.
• Crash-Safe Transaction State Machine (jvm transaction — CWE-460 / CWE-362): Realigned transaction commit boundaries to ensure journals remain IN_PROGRESS through candidate activation, executing :CommitTransaction strictly after runtime verification succeeds. Enhanced :BeginTransaction to capture full pre-state (including prev_junction), deferred backup garbage-collection until post-commit, and hardened jvm transaction rollback <id> to restore directory junctions and clean staged artifacts automatically.
• Timestamped Process Identity Locking & TOCTOU Defense (state.lock — CWE-362): Restored atomic move /y takeover on stale owner.pid files (preventing directory delete/re-create races) and anchored process identity to PID|StartTimeTicks. Removed unvalidated GUID fallbacks for JVM_CALLER_PID, enforcing strict fail-closed termination on unverified process IDs.
• Honest Cryptographic Attestation Semantics (jvm verify): Upgraded jvm verify checklist and JSON output (--json) to distinguish between digest validation (Integrity) and cryptographic attestation (Provenance), reporting [⚠] Provenance unavailable when vendor SLSA attestations are not published.
• JDK Update Checker Parenthesized Parsing Fix (jvm.bat): Fixed CMD parse crash ') was unexpected at this time.' during update checks on Oracle JDKs by fixing regex character escaping in the dynamically generated update checker script. Added Mozilla/5.0 User-Agent to Mandrel, Dragonwell, and Kona update queries.
• Interactive jvm uninstall Selection Menu (jvm.bat — CWE-20 / CWE-754): When jvm uninstall, jvm rm, or jvm remove is run without specifying a version argument, JVM now presents an interactive numbered selection list of all installed JDKs (with paths and [ACTIVE] indicator) and prompts the user to select which version to permanently uninstall or cancel. Also supports --vendor <name> filtering.
• Vendor Build Alignment across All 12 Vendors (jvm update — CWE-20 / CWE-754): Resolved false-positive update loops by normalizing IMPLEMENTOR_VERSION across IBM Semeru, Amazon Corretto, SAP SapMachine, Red Hat Mandrel, Alibaba Dragonwell, and Tencent Kona, with directory name fallback (jdk-<version>), properly recognizing installed JDKs as up-to-date ([ OK ] You are already running the latest build).
• Interactive set /p Ctrl+C Offset Skip Guard (jvm.bat — CWE-754 / CWE-755): Implemented 20-character colon guards (::::::::::::::::::::) and 6-space indentation immediately after all interactive set /p prompts in jvm.bat to absorb cmd.exe’s 3-byte offset skip bug on Ctrl+C (which previously caused cmd.exe to skip if and attempt to execute not as an external command). Added native cancel keyword recognition (cancel, c, q, quit, exit, back).
• UPDATE_CHECKER_PS1 Pipe Metacharacter Escaping (jvm.bat — CWE-78 / CWE-20): Fixed unescaped pipe operator in Write-Output "ERROR|Invalid major version" inside the inline PowerShell generation echo block, preventing cmd.exe from interpreting | as a shell command separator and executing 'Invalid' as an external command.
• HTTP 404 vs Offline Error Discrimination (jvm.bat): Enhanced update checkers to inspect upstream API error responses for 404 and report [ WARNING] No remote release found ... (HTTP 404) rather than erroneously claiming the user is offline.
• CLI Header Suppression (jvm.bat): Suppressed the 15-line interactive menu banner and system Java diagnostic block during non-interactive CLI subcommand execution (jvm uninstall, jvm install, jvm rm), ensuring clean and focused terminal output.
• Machine-Readable CLI JSON Contract (--json — CWE-20 / CWE-754): Added --json output flag emitting clean, schema-compliant JSON without ANSI codes, status tags, or UI rules across current, which, doctor, and list for external tooling and IDE integration.
• Air-Gapped & Offline Isolation (--offline — CWE-918 / CWE-754): Added --offline network isolation that immediately fails closed on mutating operations (install, update, self-update, candidate installs) while permitting read-only inspection commands (current, which, doctor) without hanging.
• Process Concurrency & Mutex State Lock (state.lock — CWE-362 / CWE-400): Implemented atomic directory-based state locks (state.lock) and owner.pid tracking to prevent race conditions during parallel invocations, with dead-PID stale lock auto-recovery and a --no-lock override flag.
• Installed JDK Existence Assertion for jvm pin (CWE-252): Hardened jvm pin to verify that the specified version or alias exists among installed JDKs before committing .java-version, preventing silent creation of unresolvable project pins.
• Test Suite Expansion to 238 Tests (tests/Test-JvmSecurity.ps1): Added Tests 191 through 238 to tests/Test-JvmSecurity.ps1, expanding test coverage to 238 automated tests across 40 MITRE CWE classes with a 100% pass rate. Includes live mid-flight process tree termination (taskkill /T) during installations (Test 215/216), pre-state directory junction recovery (Test 217), fail-closed process identity locking validation (Test 218), config.json key validation and atomic serialization (Test 219), .jvm.toml metacharacter isolation (Test 220), jvm env --diff host immutability (Test 221), jvm doctor --fix orphaned junction repair (Test 222), CMD AutoRun registration lifecycle (Test 223), CAS directory structure and air-gapped installation (Tests 224–226), cache CLI management and bundling (Tests 227–229), resumable range downloads and smart retry backoff (Tests 230–231), mirror validation and exact build strings (Tests 232–233), remote search, info, and comparison (Tests 234–235), variable ownership tracking (Test 236), universal simulation, quiet, and verbose flags (Test 237), and standardized semantic exit codes with contextual error handling (Test 238).
• Fail-Closed Nightly Verification & ACL Enforcement (install.ps1 — CWE-494 / CWE-276): Made Nightly Git-blob SHA-1 integrity checks fail closed when metadata is unreachable, and enforced strict fail-closed termination if icacls.exe cannot set restrictive directory DACLs on %LOCALAPPDATA%\DiamTek\JVM.

Runtime Fixes & Test Suite Hardening

• JDK Major Version Parsing & Directory Name Fallback (jvm.bat): Fixed a bug where installed JDKs (such as Adoptium jdk-21.0.12.1+1 and IBM Semeru jdk-26.0.2.10) were parsed as JDK 0 in jvm list and failed quick-switching (jvm 26), caused by an invalid :== substitution check inside the batch major version validator. Added directory name fallback (DIR_VER) extracting versions directly from folder names (jdk-21..., jdk-26...) when release metadata is missing or unreadable.
• CLI Error Message Alignment (jvm.bat): Removed an extra space before Please ensure it is installed and try again. (aligned 11 spaces) to match the [ ERROR ] prefix.
• Uninstaller Fail-Closed Validation & Non-Interactive Safety (uninstall.ps1 — CWE-73): Enforced an immediate fail-closed abort (exit 1) when an invalid -SourceDir is passed, preventing accidental environment scrubbing or interactive prompts. Guarded all Read-Host prompts with [Environment]::UserInteractive -and -not [Console]::IsInputRedirected.
• PowerShell Core Cross-Version ACL Inspection (tests/Test-JvmSecurity.ps1 — CWE-377): Replaced [System.IO.DirectoryInfo]::GetAccessControl() in Tests 61 and 81 with Get-Acl and native Win32 icacls.exe fallback, ensuring 100% test compatibility across PowerShell 5.1 and PowerShell Core 7+.

Error Management, Atomic Rollback & Deterministic Resource Hygiene

• Atomic State Rollback on Failure Paths (CWE-460):
  • Active Junction Rollback & Double-Fault Recovery (CURRENT_SYMLINK & :SwitchCandidate): Stores existing junction target in PREV_JUNCTION_TARGET prior to unlinking. If mklink /J fails, the previous junction is atomically re-linked. If both mklink /J operations fail (double-fault condition), jvm.bat emits a prominent emergency warning with the exact manual command needed to restore the active JDK.
  • Installer Staging Rollback (install.ps1): Snapshots existing jvm.bat to $batBackup = "$batPath.bak.<guid>.tmp". If companion file verification fails or an exception occurs, the overarching finally block atomically restores $batBackup back to $batPath.
  • MSI Test Emergency Rollback (packages/msi/test-msi.ps1): Outer finally block registers an emergency msiexec.exe /x $MsiPath /qn /norestart rollback if interrupted mid-test.
  • Chocolatey Manifest Rollback (packages/choco/build-choco.ps1): Snapshots original .nuspec, chocolateyInstall.ps1, and chocolateyUninstall.ps1 manifests and restores all three files in catch blocks if XML parsing or packaging fails.
  • Registry Backup Pre-Scrub Preservation (:ClearJavaEnvironment): Pre-generates redundant registry exports (call :BackupRegistry) before wiping environment variables, and supports headless jvm clear -y execution.
• Deterministic Handle & Resource Lifecycle (CWE-459):
  • Wrapped all Win32 registry handles (OpenSubKey) in install.ps1, uninstall.ps1, and build-msi.ps1 in try / finally { if ($key) { $key.Close() } }.
  • Wrapped all HttpWebResponse, StreamReader, FileStream, and crypto providers (SHA1, SHA256) in jvm.bat, install.ps1, and build scripts in try / finally disposal routines.
  • Released WScript.Shell, IWshShortcut, and WindowsInstaller.Installer COM apartments deterministically via Marshal::ReleaseComObject in finally blocks.
  • Purged partial downloads ($OutFile) in Invoke-TrustedGitHubDownload and staged temporary files (*.stage.*.tmp, *.bak.*.tmp) in finally.
• Zero-Silent-Catch AST Architecture & Path Redaction (CWE-209 / CWE-390):
  • Verified 0 empty catch {} blocks across all 9 repository PowerShell scripts via PowerShell AST parser inspection (Test 157).
  • Redacted %LOCALAPPDATA% and %USERPROFILE% filesystem paths from user-visible exception warnings and stripped newlines for clean single-line logging.
• Strict Exit Code Propagation (CWE-252 / CWE-754 / CWE-755):
  • Routed all CLI subcommands (clean, which, doctor, open, exec, hook, clear, channel, pin) through :CLI_DONE across setlocal boundaries with non-zero exit codes.
  • Hardened all 6 UAC elevation handoffs (Start-Process -Verb RunAs) to specify -PassThru, dispose child process handles, and propagate $p.ExitCode.

Security & Defensive Hardening

• Complete Adversarial Input Sanitization (:ValidateStrictIdentifier & :RejectExclamationArg): Engineered a centralized, multi-stage sanitization pipeline in jvm.bat that validates all external inputs across link, unlink, which, pin, exec, --vendor, candidate version switches, candidate installation, uninstallation, and configuration parsing:
  • Pre-Delayed-Expansion Exclamation Guard (:RejectExclamationArg): Inspects raw CLI parameters (%~1..%~9) under setlocal disabledelayedexpansion prior to setlocal enabledelayedexpansion, preventing cmd.exe from silently stripping unpaired ! characters (foo!bar -> foobar) during Phase 2 parser expansion.
  • Win32 Trailing Space & Dot Canonicalization Bypass: Proactively strips trailing spaces and trailing dots (. and ` ) before reserved keyword evaluation, completely neutralizing Win32 filesystem canonicalization bypass attacks that attempted to target or overwrite current (e.g., current., current , current…., current `).
  • NTFS Alternate Data Stream (ADS) Neutralization: Detects and strips colon stream delimiters (:), thwarting hidden NTFS Alternate Data Stream execution vectors (e.g., test:stream).
  • Directory Traversal & Keyword Protection: Enforces strict rejection of directory traversal sequences (.., /, \), single-dot aliases (.), leading hyphen flag injection (--evil-flag), and reserved keywords (current in link, unlink, pin, and candidate switches).
  • Poison Character, URL/PS Metacharacter, Quote-Smuggling & for /f Semicolon (eol=;) Bypass Neutralization (CWE-20 / CWE-78 / CWE-88 / CWE-94): Neutralizes dangerous cmd.exe command chaining, embedded double-quote smuggling (set _VSI_DQ=" / if "!_VSI_CH!"=="!_VSI_DQ!"), URL/PowerShell injection metacharacters (#, @, ', $, `, (, ), ,, space), and poison characters (&, |, <, >, ^, ;, ", *, ?) via pure-batch character loop inspection (:VSI_CharLoop) and internal substitution checks without spawning subshells or piping untrusted input; neutralized set /a arithmetic expression evaluation (CWE-94) on JAVA_VERSION metadata in :ShowDynamicMenu and preserved INITIAL_SESSION_JH across menu scans; validated CAND_ID, V_NAME, CAND_NAME, CUSTOM_VER, REL_ADOPTIUM, and ORACLE_LATEST_LTS via :ValidateStrictIdentifier; and eliminated cmd.exe default eol=; comment-skipping bypasses (for /f "eol= delims=0123456789") and double-double quote bugs across numeric validators (DL_VERSION validated at the top of :DownloadJDK_Headless prior to interactive vendor prompts) and PATH export loops.
  • jvm open (:OpenFolderInExplorer) Argument Injection & Fail-Closed Target Guard (CWE-88): Hardened jvm open to fail closed on unknown or uninstalled CLI_TARGET arguments (instead of silently opening JAVA_HOME), canonicalized OPEN_PATH via %%~fI, and explicitly blocked comma argument delimiters (,), UNC paths (\\), leading / flags, and ::{ shell CLSID namespaces when invoking explorer.exe.
  • Pipe-Free Subshell Elimination (jvm doctor, jvm list, & :SwitchCandidate — CWE-78): Replaced piped echo !VENDOR_RAW! | %FIND_BIN%, echo "%%A" | %FINDSTR_BIN%, and echo(!PATH! | %FINDSTR_BIN% subshells with pure in-memory delayed-expansion string substitution checks (!VAR:sub=! and !CHECK_PATH:;!SYMLINK_PATH!\bin;=!), neutralizing poison characters inside untrusted JDK release files and PATH entries and emitting .jvm_session_target via :EmitSessionEnv.
  • Upstream LATEST_VER Post-Resolution Validation (:InstallCandidate & :SwitchCandidate — CWE-20): Moved latest version resolution (:ResolveLatestEcosystemCandidate and directory sorting) before :ValidateStrictIdentifier so upstream-resolved LATEST_VER strings are strictly sanitized against path traversal and poison characters prior to constructing download URLs or directory paths.
  • DOS Reserved Device & Win32 Device Namespace Rejection (CWE-66): Blocks legacy DOS 8.3 reserved hardware device names (CON, PRN, AUX, NUL, COM1-9, LPT1-9), extended DOS device names with extensions (CON.jdk, NUL.21, AUX.txt, COM1.jdk via base-name extraction before .), and Win32 raw device path namespaces (\\.\, \\?\, \??\) in jvm link.
  • Subcommand & Project Config File Hardening (.java-version, .sdkmanrc, jvm exec — CWE-20 / CWE-88): Guarded automatic .java-version and .sdkmanrc parsing with if not defined CLI_COMMAND so read-only subcommands (--version, list, doctor) never mutate .jvm_session_target; eliminated findstr /v pre-filtering on .java-version and .sdkmanrc (java= and ecosystem entries) so unsafe or malformed lines are never silently dropped and always trigger fail-closed validation (JV_PARSE_ERR=1 / SDK_PARSE_ERR=1 / SDK_ECO_ERR=1 -> exit /b 1); stripped UTF-8 BOM sequences (), normalized jdk-/java-/1.8 prefixes, validated --vendor strictly via :ValidateStrictIdentifier, blocked --legacy/--registry mode hijacking inside .java-version, and hardened jvm exec to execute via "%CMD_BIN%" /d /s /c ""!EXEC_CMD!"" with AutoRun disabled (/d) and whitespace-only command rejection.
• System32 Binary Pinning, Canonical Global Install & Shortcut Target Hardening (CWE-426 / CWE-427 / CWE-428):
  • Added %SystemRoot% spoofing fallback (if not exist "%SystemRoot%\System32\cmd.exe" set "SystemRoot=C:\Windows"), pinned all external Windows system binaries (cmd.exe, reg.exe, find.exe, findstr.exe, where.exe, choice.exe, timeout.exe, fsutil.exe, powershell.exe, chcp.com, icacls.exe, attrib.exe, explorer.exe) to %SYS32% (%..._BIN%), and enforced NoDefaultCurrentDirectoryInExePath=1, completely preventing current-working-directory (CWD) binary planting and PATH search-order hijacking when invoking jvm inside untrusted repositories.
  • Updated all where.exe call sites (jvm list, jvm which, jvm doctor, and active binary resolution) to %WHERE_BIN% $PATH:java, forcing where.exe to search strictly %PATH% and never an untrusted current working directory.
  • Hardened :InstallGlobalCommand (CWE-427) to copy jvm.bat into canonical %LOCALAPPDATA%\DiamTek\JVM\bin (guarded with fsutil reparsepoint query and icacls /inheritance:r) rather than registering an arbitrary SCRIPT_DIR into HKCU\Environment\Path, while preserving unexpanded %...% tokens via DoNotExpandEnvironmentNames.
  • Hardened install.ps1 (CWE-428 / CWE-276 / CWE-59) with Initialize-SecureDirectory (enforcing Test-HasReparsePointInLineage before/after directory creation and icacls /inheritance:r on $repoRoot and $installDir), Remove-ReparsePointOrFail on $batPath, $destFile, and $channelFile, Invoke-TrustedGitHubDownload (5 MB payload ceiling & redirect host allowlist), made $systemPowerShell (System32\WindowsPowerShell\v1.0\powershell.exe) fail closed if missing, added -NonInteractive and -Quiet to QuietUninstallString, and pinned Start Menu .lnk shortcut TargetPath to $sysCmd (System32\cmd.exe) or $wtCandidate.
  • Hardened all 60+ for /f ('%..._BIN% ...') command loops (including !CURR_JAVA_BIN! version detection) to preserve inner argument quoting around -Command "..." and registry queries without cmd.exe /c outer-quote stripping.
• ACL-Locked & Reparse-Safe Isolated Temp, Config & Registry Backup Workspaces (:EnsureSecureTemp, :WriteConfigFile, :BackupRegistry, & :EmitSessionEnv — CWE-59 / CWE-276 / CWE-330 / CWE-377 / CWE-378 / CWE-532):
  • Migrated temporary helper scripts and .jvm_session_target files out of world-writable shared %TEMP% into an ACL-locked per-user workspace (%LOCALAPPDATA%\DiamTek\JVM\temp) verified against reparse points (%FSUTIL_BIN% reparsepoint query) before and after creation, and hardened atomically via icacls /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" "%USERNAME%:(OI)(CI)F" with fail-closed exit checking (if errorlevel 1 exit /b 1).
  • Added :WriteConfigFile (CWE-59) to guard persistent configuration files (%LOCALAPPDATA%\DiamTek\JVM\channel.txt and mode.txt) and :HANDLE_LINKS (jvm link / jvm unlink) against directory collisions and NTFS reparse points before writing or creating junctions, while permitting legitimate Windows JDK directory paths containing commas (,) and auto-sanitizing commas/spaces to - in default junction aliases.
  • Hardened :BackupRegistry (CWE-532 / CWE-276) to verify %LOCALAPPDATA%\DiamTek\JVM\backups against NTFS reparse points (%FSUTIL_BIN% reparsepoint query) and lock down directory permissions with icacls /inheritance:r prior to invoking reg export on HKCU\Environment and HKLM\...\Environment.
  • Eliminated 100% of predictable 15-bit !RANDOM! / %RANDOM% temporary filenames across jvm.bat (CWE-330), replacing every temporary script and verification output path with CSPRNG [System.IO.Path]::GetRandomFileName().Replace('.', '') to guarantee parallel terminal session isolation without cross-instance interference.
  • Added :EmitSessionEnv to validate JVM_CALLER_PID strictly as a positive numeric PID (blocking .., /, \, and -) and reject directory/reparse collisions on .jvm_session_target and .jvm_session_target_<PID> before writing (CWE-59), and synchronized install.ps1 ($profileCode) with :InstallPowerShellHook.
• Transport Security, Vendor Host Allowlisting, Open Redirect Defense & Failure-Path Cleanup (:SelfUpdate, :ExecuteSharedDownloader, :ResolveLatestEcosystemCandidate, :CheckUpdateStatus, & :VerifyDownloadedScript — CWE-295 / CWE-319 / CWE-345 / CWE-354 / CWE-409 / CWE-459 / CWE-494 / CWE-601 / CWE-918):
  • Enforced TLS 1.2 + TLS 1.3 ([Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor 12288) and strict https:// URI scheme validation on $env:DL_URL, $env:DL_CHKSUM_URL, :Run_API_Query, UPDATE_CHECKER_PS1, :ResolveLatestEcosystemCandidate, :CheckUpdateStatus, and post-redirect $response.ResponseUri, blocking plaintext http://, file://, and UNC downgrade/SSRF vectors.
  • Added Test-TrustedJvmUri (CWE-918 / CWE-601) and Get-TrustedChecksumText in :ExecuteSharedDownloader, anchored GitHub release tag redirect regexes in :ResolveLatestEcosystemCandidate and :CheckUpdateStatus, plus redirect host verification in :VerifyDownloadedScript, validating initial URLs and post-redirect $response.ResponseUri hostnames across both primary payload downloads and remote checksum endpoints ($env:DL_CHKSUM_URL / $fallbackUrl with 15s timeouts and 4 KB stream ceiling) against an explicit allowlist of official vendor domains (api.adoptium.net, github.com, objects.githubusercontent.com, download.oracle.com, corretto.aws, api.azul.com, repo.maven.apache.org, services.gradle.org, etc.) to block SSRF and open-redirect attacks.
  • Made :CheckUpdateStatus execute unconditionally during jvm self-update (even when --yes / -y is passed) and validated REMOTE_VER, REMOTE_BUILD, and REMOTE_REF via :ValidateStrictIdentifier, blocking version and monotonic JVM_BUILD downgrade attacks (AHEAD_OF_STABLE / AHEAD_OF_NIGHTLY).
  • Added byte[] UTF-8 stream decoding for SHA256SUMS.txt in PowerShell 7+, strict 64-hex-character SHA-256 manifest parsing (CWE-354), try/finally { $zip.Dispose() } archive handle release, and full cleanup of partial downloads ($out) and extraction directories ($env:DL_EXTRACT) in catch blocks (CWE-459).
  • Nightly Channel Fail-Closed Git Blob SHA-1 & Companion uninstall.ps1 Cryptographic Verification (:SelfUpdate & install.ps1 — CWE-494): Hardened NIGHTLY channel self-updates in jvm.bat (:SelfUpdate verifying install.ps1 with fail-closed NO_META_SHA rejection and UPDATER_BAT reparse checks) and install.ps1 (verifying both jvm.bat and staged companion uninstall.ps1 via fail-closed Test-GitBlobSha1, recording a DACL-protected uninstall.ps1.sha256 sidecar digest, plus mandatory SHA256SUMS.txt verification of uninstall.ps1 on Stable with mutable HEAD fallback disabled) to query the GitHub Contents API (https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/contents/<file>?ref=<ref>) and verify the downloaded payload’s Git Blob SHA-1 (SHA1("blob " + length + "\0" + bytes) across raw, LF, and CRLF normalized byte representations) against the commit tree’s .sha digest, immediately aborting on tampering or missing manifest entries.
  • Dynamic %ProgramFiles% / %ProgramFiles(x86)% Discovery & Windows ARM64 Vendor Fallback (:Resolve_Oracle & :Resolve_GraalVM): Replaced hardcoded C:\Program Files and C:\Program Files (x86) references across LOCATIONS[0..11], DEST_DIR, and ENV_PURGE_LIST with %JVM_PF% (%ProgramFiles%), %JVM_PF86% (%ProgramFiles(x86)%), and %JVM_SYSDRIVE% (%SystemDrive%) with safe fallbacks, and added explicit Windows ARM64 (aarch64) architecture warnings and x64 Windows 11 Prism emulation fallback in :Resolve_Oracle and :Resolve_GraalVM.
  • Unified Stable & Nightly Cryptographic Uninstaller Trust Chain (:UninstallJVM_Complete & :VerifyDownloadedScript — CWE-494): Hardened jvm self-uninstall to verify local and downloaded uninstall.ps1 scripts across both STABLE (v!JVM_VERSION! SHA256SUMS.txt) and NIGHTLY (main GitHub Contents API Git Blob SHA-1 + uninstall.ps1.sha256 sidecar) channels, checking for NTFS reparse points (fsutil reparsepoint query) and automatically falling back to downloading and cryptographically verifying a fresh copy in %JVM_SECURE_TEMP% if a local uninstall.ps1 is missing or modified.
• Strict ZipSlip, Zip Bomb Decompression Bounds (CWE-409), DL_STRIP_ROOT Argument Injection & Canonical Destination Defense (CWE-22 / CWE-66 / CWE-88 / CWE-409):
  • Enforced canonical destination boundary checks ($destinationPath.StartsWith($fullRoot, [System.StringComparison]::OrdinalIgnoreCase)) with mandatory trailing directory separators (\), NTFS ADS colon (:) rejection, explicit rooted-entry rejection ($entry.FullName -match '^[/\\]'), archive entry count bounds (40,000 maximum entries), cumulative decompressed byte limits (1.75 GB Zip Bomb protection — CWE-409), and Win32 reserved device name / control character rejection (CWE-66) during ZIP archive extraction in :ExecuteSharedDownloader, blocking ../ escapes, sibling prefix collisions (../cand_evil/payload.exe), and decompression exhaustion attacks.
  • Validated top-level extracted directory names ($items[0].Name) in DL_STRIP_ROOT=1 against leading hyphens (-) and unsafe characters (^[a-zA-Z0-9._+-]+$) and switched to Move-Item -LiteralPath (CWE-88), while canonicalizing $fullD and $t via [System.IO.Path]::GetFullPath() with trailing backslash inside the :FetchAndExtract elevated move script (CWE-22).
  • Hardened $allowedRoots validation in Set-JvmVar (install.ps1 and jvm.bat) to enforce trailing directory separators ($normRoot + '\'), preventing sibling directories (C:\Program Files\Java_evil or .jdks_evil) from bypassing storage boundary checks.
• Non-Destructive Directory Junction Unbinding & Profile/Terminal Symlink Guards (Remove-DirectorySafely, Test-HasReparsePointInLineage, :CleanCache, & jvm pin — CWE-59 / CWE-367): Re-architected junction cleanup and profile modification routines across jvm.bat, install.ps1, uninstall.ps1, and packages/msi/build-msi.ps1:
  • Target JDK Deletion Prevention: Resolved a critical directory traversal hazard where standard recursive deletions (Remove-Item -Recurse in Windows PowerShell 5.1) traversed NTFS directory junctions into target directories, inadvertently deleting linked host JDKs. Introduced Remove-DirectorySafely, updated :UninstallCandidate, jvm update --all, and elevated :UninstallJDK in jvm.bat to detach root/nested junctions via [System.IO.Directory]::Delete($_.FullName, $false) prior to Remove-Item -Recurse, verified CURRENT_SYMLINK and :SwitchCandidate against pre-planted non-reparse directories (fsutil reparsepoint query), used Remove-DirectorySafely on %TEMP%\jdk_*_extract* in uninstall.ps1, and hardened :CleanCache (jvm clean / jvm prune) to sort reparse points bottom-up by path length and cleanly unbind junctions before container folders are deleted.
  • $PROFILE, Windows Terminal settings.json, & Start Menu Atomic Staged Writes & Symlink Guards (CWE-59 / CWE-367): Added Test-HasReparsePointInLineage, -LiteralPath, and atomic staged Move-Item -LiteralPath UTF-8 No BOM writes across install.ps1, uninstall.ps1, packages/msi/build-msi.ps1 ($msiInstallHook and $msiUninstallHook), :InstallPowerShellHook, and :RemovePowerShellHook, ensuring profile scripts, Windows Terminal settings.json, and Start Menu .lnk shortcuts are never written or deleted through malicious NTFS symlinks or junctions.
  • Reparse-Safe .java-version Pinning: Hardened jvm pin (:DO_PIN_WRITE) to verify .java-version is not a directory, symlink, or NTFS junction (%FSUTIL_BIN% reparsepoint query) before writing, preventing arbitrary file overwrite via symlink attacks.
  • Broken Junction Auto-Recovery: Hardened jvm.bat and ecosystem switchers to issue direct rmdir calls without if exist guards, resolving silent switch deadlocks where broken or dangling junctions (whose target directories were deleted or moved) failed if exist checks and could not be re-linked.
  • Filesystem Root, Test-TrustedJvmInstallDirectory Marker Gate & Canary Protection (CWE-73 / CWE-78): Added strict safeguards forbidding deletion of system/user roots (C:\, %USERPROFILE%, %SystemRoot%, %ProgramFiles%), introduced Test-TrustedJvmInstallDirectory in uninstall.ps1 to validate Registry InstallLocation, -SourceDir, and $scriptDir against $forbiddenRoots, Test-HasReparsePointInLineage, and JVM installation markers (jvm.bat, uninstall.ps1) before adding them to $jvmLocations for PATH scrubbing, Base64-isolated deferred directory cleanup (Invoke-DeferredDirectoryCleanup) in uninstall.ps1 and build-msi.ps1, and detected active .git development repositories to prevent accidental source code loss.
• Process Elevation Hardening (Base64 UTF-16LE & System32 SpecialFolder Isolation): Overhauled administrative UAC elevation routines (Start-Process powershell -Verb RunAs) across jvm.bat, install.ps1, uninstall.ps1, and build-msi.ps1:
  • In-Memory Encoded Command Execution: Dynamically encodes all elevated command payloads into Base64 UTF-16LE strings passed via -EncodedCommand, completely eliminating argument breakout vulnerabilities, parameter splitting on quotes or spaces, and temporary batch/PowerShell runner scripts in %TEMP% (mitigating TOCTOU race conditions).
  • System32 SpecialFolder Working Directory & Binary Isolation: Pinned all elevated process invocations and working directories to native Win32 [Environment]::GetFolderPath([Environment+SpecialFolder]::System). By querying the Win32 Known Folder API directly rather than resolving $env:SystemRoot or %SystemRoot% from the process environment block, this completely immunizes process elevation boundaries against user-level environment variable saturation/spoofing attacks and eliminates CWE-426 binary search order hijacking.
• User & System PATH REG_EXPAND_SZ Preservation & Boundary Auditing: Hardened environment variable manipulation across install.ps1, uninstall.ps1, build-msi.ps1, and jvm.bat:
  • Dynamic ExpandString Preservation: Audits registry value kinds using Microsoft.Win32.RegistryKey.GetValueKind('Path') and DoNotExpandEnvironmentNames, enforcing [Microsoft.Win32.RegistryValueKind]::ExpandString across both User (HKCU\Environment) and Machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. Guarantees that system variables (%SystemRoot%, %USERPROFILE%, %LOCALAPPDATA%) are preserved and never collapsed into static REG_SZ strings.
  • Combined PATH Boundary Guards (2048 / 8191 Characters): Dynamically calculates the combined length of User PATH and Machine PATH. Aborts modification immediately if combined length exceeds the 8191-character Windows environment block limit to prevent silent environment corruption, and emits an actionable warning if length exceeds 2048 characters to alert users of potential legacy Win32 application truncation.
  • Deduplication & Slashing Hygiene: Automatically strips redundant quotes, trims whitespace, normalizes trailing slashes, and purges legacy phantom Oracle javapath entries.
• Non-Blocking SendMessageTimeout Environment Broadcasts: Overhauled Windows setting change broadcasts (WM_SETTINGCHANGE) using native Win32 P/Invoke SendMessageTimeout (HWND_BROADCAST = 0xFFFF, WM_SETTINGCHANGE = 0x001A, SMTO_ABORTIFHUNG = 0x0002) with a strict 3000ms-5000ms timeout window. Guarantees that environment broadcasts notify running shells without hanging or deadlocking the terminal when third-party applications fail to process messages.
• Package Manager, XML External Entity (CWE-611), XML Attribute Escaping (CWE-74), MSI & CI/CD Supply Chain Hardening:
  • Immutable GitHub Actions SHA Pinning & Least-Privilege Credentials (CWE-250): Pinned all GitHub Actions in .github/workflows/ci.yml and .github/workflows/release.yml (actions/checkout, actions/setup-dotnet, actions/attest-build-provenance, softprops/action-gh-release, actions/upload-artifact) to verified 40-character commit SHAs with persist-credentials: false on checkout steps, validated $ver against strict SemVer across all resolution branches in release.yml, and added Test-JvmSecurity.ps1 -Detailed as a mandatory pre-build CI/release gate.
  • XML External Entity (XXE) & DTD Prohibition (CWE-611) & Attribute Escaping (CWE-74): Enforced DtdProcessing = [System.Xml.DtdProcessing]::Prohibit and XmlResolver = $null via System.Xml.XmlReaderSettings when validating XML schemas (jvm.nuspec and jvm.wxs) across packages/choco/build-choco.ps1, packages/msi/build-msi.ps1, and tests/Test-JvmSecurity.ps1, and XML-escaped attributes via Escape-XmlAttr ([System.Security.SecurityElement]::Escape) in build-msi.ps1.
  • Deterministic MSI ProductCode, System32\msiexec.exe Pinning & Unversioned Script Hashing: Added deterministic RFC 4122 UUID v5 ProductCode generation (Get-DeterministicGuid), -Version SemVer validation, -Arch ValidateSet, and $safeBatPath single-quote escaping (__FALLBACK_BAT__) in packages/msi/build-msi.ps1, pinned msiexec.exe to System32 and validated -MsiPath in packages/msi/test-msi.ps1 (CWE-426), configured dual-purpose per-user/per-machine installation scope (ALLUSERS=2, MSIINSTALLPERUSER=1), and omitted DefaultVersion on .bat/.ps1 <File> elements so WiX v4 populates MsiFileHash entries with zero WIX1103 warnings.
  • Chocolatey Fail-Closed MSI, Domain Allowlist & HTTPS Verification (CWE-319 / CWE-354 / CWE-426 / CWE-918): Migrated Chocolatey package scripts (packages/choco/tools/chocolateyInstall.ps1 and chocolateyUninstall.ps1) to pre-compiled .msi distribution with runtime https:// URI scheme verification (CWE-319), GitHub domain allowlist ($allowedHosts = @('github.com', 'objects.githubusercontent.com') — CWE-918), strict sha256 checksumType64 enforcement (CWE-354), a fail-closed 64-character SHA-256 checksum assertion ($checksum64 -notmatch '^[A-Fa-f0-9]{64}$'), Test-HasReparsePointInLineage and MSI ProductCode GUID regex validation in chocolateyUninstall.ps1 (CWE-426), and automatic hash synchronization in build-choco.ps1 and scripts/bump-version.ps1.
  • Release Pre-Flight Verification, SemVer Validation & Manifest Integrity Assertions (CWE-20 / CWE-354): Added strict -Version and -Build SemVer/traversal validation (CWE-20), Assert-TrustedGitHubUri (CWE-319 / CWE-601), Assert-ValidSha256Hex (CWE-354), Assert-ValidMsiProductCode, and --dry-run verification to scripts/bump-version.ps1 and build-choco.ps1, guaranteeing zero working tree changes during validation runs with UTF-8 No BOM encoding and TLS 1.2/1.3 transport security enforcement.
• 327-Test Automated Security & Adversarial Fuzzing Suite (tests/Test-JvmSecurity.ps1): Engineered an exhaustive, standalone 327-test automated security test suite with -Suite / -Filter targeted filtering, per-test [CWE-XX] badges, a numerically sorted 41-CWE Coverage Summary table (CWE-20, CWE-22, CWE-41, CWE-59, CWE-66, CWE-73, CWE-74, CWE-78, CWE-88, CWE-94, CWE-155, CWE-184, CWE-209, CWE-250, CWE-252, CWE-276, CWE-295, CWE-319, CWE-330, CWE-345, CWE-354, CWE-362, CWE-367, CWE-377, CWE-390, CWE-400, CWE-409, CWE-426, CWE-427, CWE-428, CWE-459, CWE-460, CWE-494, CWE-532, CWE-601, CWE-611, CWE-674, CWE-754, CWE-755, CWE-918), per-suite timing telemetry tables, and automatic GitHub Actions Step Summary ($env:GITHUB_STEP_SUMMARY) Markdown reporting covering 16 defensive suites with a 100% pass rate (327 / 327 PASS):
  1. Adversarial Inputs & Fuzzing Defense (116 tests): Path traversal (.., /, \), single dot (.), current keyword guard, command injection in .java-version/.sdkmanrc, branch traversal in install.ps1, profile hook injection filtering, Win32 trailing dot/space bypasses (current., current ), DOS reserved devices (CON, PRN, AUX, NUL), extended DOS device names (NUL.jdk, CON.txt) and Win32 raw device namespaces (\\.\), poison characters (&, |, <, >, ^, %, !), pre-delayed-expansion :RejectExclamationArg across %~1..%~9, embedded double-quote smuggling in :VSI_CharLoop, URL/PowerShell metacharacter rejection (#, @, ', $, `, (, ), ,, space) in :ValidateStrictIdentifier (CWE-88), --vendor flag poisoning, jvm channel / jvm open allowlisting & comma-delimited explorer.exe argument injection defense (CWE-88), for /f "eol= delims=0123456789" semicolon eol=; bypass (21;Invoke-Expression) & double-double quote elimination (CWE-20), :ShowDynamicMenu set /a arithmetic expression evaluation defense (CWE-94), :ShowDynamicMenu INITIAL_SESSION_JH preservation & %%j validation (CWE-78), :EcoPerformCheck & jvm update --all V_NAME/CAND_NAME validation (CWE-78), interactive CUSTOM_VER & :FetchLatestVersions REL_ADOPTIUM validation (CWE-20), :ShowCurrentStatus & :WhichBinary JAVA_HOME quote sanitization (CWE-78), :DoctorDiagnostics CAND_ID validation (CWE-78), .sdkmanrc & :ProcessEcosystemSession fail-closed validation (CWE-20), :ExecuteSharedDownloader ZIP entry count & cumulative decompression byte limit (1.75 GB Zip Bomb defense — CWE-409), static for /f quote-stripping code audit, ADS streams (:), candidate traversal in which, leading hyphens (--evil-flag), multiple trailing dots/spaces, semicolon chaining, wildcards (*, ?), %SYS32% runtime CWD Trojan binary planting defense (where.exe / findstr.exe), prepended rogue PATH hijacking immunity, jvm which java ($PATH:java) CWD planting defense, jvm doctor metacharacter resilience in PATH and JDK release files, jvm pin metacharacter injection, jvm exec path traversal, argument injection, and empty -- rejection, jvm install candidate version injection, .sdkmanrc backtick/$() neutralization, .java-version inline flag poisoning (--vendor, --legacy, --registry), .java-version UTF-8 BOM/CRLF/jdk- prefix resilience, .sdkmanrc read-only subcommand isolation (--version / list), JVM_CALLER_PID non-numeric/traversal rejection in :EmitSessionEnv, :InstallCandidate / :SwitchCandidate post-latest :ValidateStrictIdentifier enforcement (CWE-20), :ExecuteSharedDownloader DL_STRIP_ROOT leading-hyphen rejection (CWE-88), :FetchAndExtract elevated [System.IO.Path]::GetFullPath canonicalization (CWE-22), archive extraction rejecting Unix symlink entries (CWE-59 / CWE-22), and :SwitchCandidate pipe-free native substring session PATH updates (CWE-78).
  2. Registry & Environment Variable Boundary Tests (6 tests): User PATH REG_EXPAND_SZ preservation, Base64 UTF-16LE elevation payload integrity, elevation path resolution immunity to SystemRoot environment saturation, Oracle javapath de-bloating, extreme PATH lengths (>2048 characters), and NO_COLOR=1 / --no-color strict ANSI escape sequence suppression.
  3. Reparse Point & Directory Junction Lifecycle (18 tests): Non-destructive junction unbinding canary validation, bracket-safe reparse querying with -LiteralPath and $env:QUERY_PATH, active dev repo .git guards, jvm pin refusal to overwrite symlink/junction .java-version targets, jvm clean / jvm prune bottom-up junction unbinding in downloads/temp without deleting external target files, :InstallPowerShellHook / :RemovePowerShellHook ReparsePoint symlink guard & -LiteralPath enforcement on $PROFILE, install.ps1 / uninstall.ps1 Test-HasReparsePointInLineage guards across $PROFILE, settings.json, and Start Menu shortcuts, CURRENT_SYMLINK non-reparse directory rejection plus :UninstallJDK elevated junction detachment (CWE-59), :UninstallCandidate & :InstallCandidate nested junction detachment (CWE-59), jvm link / jvm unlink %LOCALAPPDATA%\DiamTek\JVM\links reparse guard & icacls /inheritance:r (CWE-59), :WriteConfigFile symlink/reparse overwrite prevention on channel.txt and mode.txt (CWE-59), :EmitSessionEnv reparse collision defense on .jvm_session_target (CWE-59), install.ps1 Remove-ReparsePointOrFail on $batPath, $destFile, and $channelFile (CWE-59), CURRENT_SYMLINK and :SwitchCandidate atomic PREV_JUNCTION_TARGET rollback on switch failure with double-fault alert (CWE-460 / CWE-252), and install.ps1 / uninstall.ps1 atomic staged Move-Item -LiteralPath & UTF-8 No BOM writes on $PROFILE and settings.json (CWE-367).
  4. Package Manager Manifest Schema Integrity & Dry-Run Guarantees (65 tests): Cross-package version synchronization across Scoop, Chocolatey, Winget, and jvm.bat; nuspec XML validation and UTF-8 No BOM checks; Chocolatey fail-closed SHA-256 checksum assertion, runtime HTTPS URI scheme validation (CWE-319), GitHub domain allowlist (CWE-918), & sha256 checksumType64 gate (CWE-354); chocolateyUninstall.ps1 Test-HasReparsePointInLineage, MSI ProductCode GUID regex, & System32 binary pinning (CWE-426); packages/msi/test-msi.ps1 System32\msiexec.exe pinning, -MsiPath validation (CWE-426), emergency msiexec /x rollback in outer finally, and Process / COM handle disposal (CWE-459 / CWE-460); packages/msi/build-msi.ps1 -Version SemVer, -Arch ValidateSet, Escape-XmlAttr XML attribute escaping (CWE-74), Push-Location/Pop-Location in try / finally, and WiX exit code verification (CWE-459 / CWE-754); GitHub Actions ci.yml / release.yml persist-credentials: false & SemVer tag validation (CWE-250); bump-version.ps1 & build-choco.ps1 SemVer/traversal validation (CWE-20), clean git working tree enforcement (CWE-184), manifest rollback (CWE-460), TLS 1.2 fallback, and Assert-TrustedGitHubUri / Assert-ValidSha256Hex / Assert-ValidMsiProductCode manifest assertions (CWE-354); XML External Entity (XXE) & DTD prohibition (DtdProcessing::Prohibit / XmlResolver = $null — CWE-611); :ExecuteSharedDownloader SSRF & vendor domain allowlist (Test-TrustedJvmUri — CWE-918); open redirect host verification on ResponseUri across payload, Get-TrustedChecksumText, :ResolveLatestEcosystemCandidate, and :CheckUpdateStatus (CWE-601 / CWE-295); HTTP error status discrimination (429/403/500/502/503 vs network timeout — CWE-209 / CWE-755); :SelfUpdate fail-closed Nightly NO_META_SHA & UPDATER_BAT reparse guard (CWE-494); install.ps1 Invoke-TrustedGitHubDownload 5 MB ceiling, redirect host allowlist, & fail-closed Test-GitBlobSha1 (CWE-494); build-msi.ps1 embedded MSI hooks (Test-HasReparsePointInLineage, single-quote $safeBatPath escaping, and Base64 deferred cleanup — CWE-59); install.ps1 Initialize-SecureDirectory DACL/reparse guards, atomic $batBackup rollback on companion failure, partial download cleanup, COM release in finally, and mandatory staged verification for uninstall.ps1 (CWE-460 / CWE-459 / CWE-494); Scoop manifest schema; Winget multi-manifest coherence; bump-version.ps1 -DryRun working tree immutability; GitHub Actions 40-char SHA pinning & permissions audit; jvm.bat UTF-8 No BOM / 100% CRLF / EOF sentinel verification; build-msi.ps1 RFC 4122 UUID v5 Get-DeterministicGuid collision resistance; $profileCode extraction & WIX1103 script hash verification; TLS 1.2+1.3 protocol enforcement in :ExecuteSharedDownloader & :SelfUpdate; non-HTTPS URI scheme (http://, file://, UNC) rejection; :CheckUpdateStatus & :SelfUpdate version/build downgrade attack rejection; SHA-256 mismatch fail-closed rejection & --skip-checksum warning verification; malformed/spoofed SHA256SUMS.txt manifest rejection; Nightly channel Git Blob SHA-1 cryptographic verification (blob <len>\0), dynamic %ProgramFiles% (%JVM_PF%) locations, and ARM64 resolver guards (CWE-494); and atomic staged .stage.*.tmp configuration file updates with CSPRNG entropy (CWE-362 / CWE-330).
  5. Concurrency & Reparse Point Non-Destructive Resilience (18 tests): Broken/dangling junction auto-recovery without deadlock, rapid sequential junction switching, parallel temp script isolation without startup interference, zero predictable !RANDOM! temp filenames in jvm.bat ([System.IO.Path]::GetRandomFileName enforcement — CWE-330), live ACL verification on %JVM_SECURE_TEMP% (AreAccessRulesProtected, no Everyone/Users), reparse-point junction rejection on %JVM_SECURE_TEMP% (CWE-276), complete failure-path cleanup of $zip.Dispose() handles and partial extraction directories (CWE-459), and live cyclic directory junction loop immunity with bounded recursion depth (CWE-674).
  6. Corrupt Registry Recovery & PATH Resilience (17 tests): REG_SZ vs REG_EXPAND_SZ type enforcement, non-blocking SendMessageTimeout execution bounded to 1000ms, Set-JvmVar storage boundary enforcement, Set-JvmVar CWE-22 sibling prefix collision (.jdks_evil) & strict variable allowlist (COMSPEC rejection), PowerShell AST parser validation of :InstallPowerShellHook emitted profile script, security parity between install.ps1 and jvm.bat, Base64 UTF-16LE -EncodedCommand privilege escalation boundary AST injection immunity (CWE-250), :BackupRegistry fsutil reparse-point query & icacls /inheritance:r DACL isolation on %LOCALAPPDATA%\DiamTek\JVM\backups (CWE-532), :ClearJavaEnvironment pre-scrub registry backup preservation & headless jvm clear -y (CWE-460 / CWE-400), :InstallGlobalCommand canonical %LOCALAPPDATA%\DiamTek\JVM\bin ACL & DoNotExpandEnvironmentNames protection (CWE-427), and PowerShell ConstrainedLanguageMode early fail-closed policy enforcement across install.ps1 and uninstall.ps1 (CWE-755 / CWE-754).
  7. Uninstallation Safety & Marker Verification (17 tests): Remove-DirectorySafely target canary retention, refusal of uninstaller execution on directories lacking JVM markers, system root deletion blocking, strict ZipSlip boundary enforcement on extracted candidate directories, ZipSlip CWE-22 sibling-prefix collision (../cand_evil/payload.exe) & rooted entry (\rooted_escape.exe) rejection, live malicious ZIP archive extraction testing across ../, sibling-prefix, rooted \, and NTFS ADS : entries, install.ps1 quoted System32 UninstallString / QuietUninstallString (-Quiet) & pinned Start Menu shortcut TargetPath (CWE-428), uninstall.ps1 early -SourceDir validation against $forbiddenRoots & JVM markers before PATH scrubbing plus Base64-isolated Invoke-DeferredDirectoryCleanup (CWE-73), uninstall.ps1 Test-TrustedJvmInstallDirectory validation on Registry InstallLocation (CWE-73), uninstall.ps1 Remove-ShortcutSafely on Start Menu, Desktop, and Taskbar shortcuts (CWE-59 / CWE-73), and uninstall.ps1 Remove-DirectorySafely & reparse-skipping during shared %TEMP% cleanup (CWE-59).
  8. Windows Terminal JSONC Configuration Parsing (6 tests): Block comment /* ... */ stripping, single-line // comment stripping, trailing comma elimination, file-lock retry loop with .bak backup creation (CWE-367 / CWE-400), and graceful silent fallback on corrupted configuration files.
  9. Advanced Cache & Content-Addressed Storage: CAS sha256/ layout, deduplication inspection (jvm cache dedupe), export/import archive validation, cache quota telemetry (jvm cache stats).
  10. Multi-Candidate Ecosystem Toolchains: Dynamic ecosystem tool discovery, multi-candidate execution routers (mvn, gradle, kotlinc, scalac, groovy, ant, sbt, jbang, quarkus, spring, micronaut), and toolchain conflict detection.
  11. Transactional Recovery & Journal Logging: Atomic installation rollback (.rollback.journal), interrupted activation pre-state restoration, mid-flight process termination recovery (CWE-460 / CWE-362).
  12. Enterprise Networking & Machine Policy Enforcement (12 tests): NTLM / Kerberos corporate proxy authentication, Root CA Windows certificate store integration, policy file enforcement (%ProgramData%\DiamTek\JVM\policy.toml), and download mirror failover (CWE-295 / CWE-319).
  13. Advanced Lockfile Lifecycle, Freezing & Signatures (10 tests): Version pinning (jvm freeze), version thawing (jvm thaw), HMAC-SHA256 lockfile signature validation (.jvm.lock.sig), SSRF and untrusted domain protection (CWE-354 / CWE-494).
  14. Unified Status, Ergonomics & Multi-Shell Cross-Compatibility (10 tests): Unified multi-tool status dashboard, script-friendly single-value flags (--short, --numeric, --bin), dynamic PowerShell argument completers, and CMD DOSKEY macro integration.
  15. Adversarial Robustness, Fuzzing & Mutation Resilience (10 tests): Deep argument buffer fuzzing (1024+ characters), non-allowlisted vendor token rejection, live cyclic directory junction loop immunity, fault injection resilience, and repository-wide AST zero empty catch enforcement (CWE-390).

[1.0.1] - 2026-09-16

This release delivers critical stability and reliability enhancements for the installer pipeline, CLI channel switching, uninstallation handoff, and multi-architecture Winget package distribution.

Packaging & Distribution

• Multi-File Winget Manifests (Dual-Architecture): Migrated Windows Package Manager (Winget) manifests into the standard multi-file format (DiamTek.JVM.yaml, DiamTek.JVM.installer.yaml, DiamTek.JVM.locale.en-US.yaml) introducing full native arm64 architecture alongside x64.
• Manifest Synchronization: Synchronized release versioning and installer endpoints across Scoop (packages/scoop/jvm.json), Chocolatey (packages/choco/jvm.nuspec), and Winget manifests.

CLI & Update Channels

• CLI Channel Overrides (UPDATE_CHANNEL_OVERRIDE): Engineered the channel override engine to preserve command-line flags (--channel, -c, --nightly, --stable) across subshell transitions and menu rescan loops without being overwritten by persistent channel.txt.
• Positional Channel Syntax: Added support for positional update channel arguments during self-update (e.g., jvm self-update nightly, jvm self-update stable).
• Command Aliases: Added jvm update self alias routing directly to the self-update engine.
• Nightly Hash Display Guard: Guarded SHA-256 substring formatting against empty string references when evaluating unreleased development builds.

Core Engine & PowerShell 7 Resilience

• Pure .NET Cryptographic Fallback (Get-FileSha256): Introduced native fallback to [System.Security.Cryptography.SHA256] in install.ps1 and jvm.bat, resolving CommandNotFoundException when Get-FileHash is missing in minimal, locked-down, or constrained PowerShell 5.1 environments.
• PowerShell 7 Byte-Stream Decoding: Resolved a critical issue in PowerShell 7 where Invoke-RestMethod and Invoke-WebRequest return raw byte arrays instead of strings, ensuring reliable UTF-8 decoding and preventing checksum validation failures.
• Strict Windows CRLF Normalization: Enforced explicit Windows CRLF (\r\n) line ending normalization during batch file downloads, preventing cmd.exe label offset drift and syntax errors ('f' is not recognized, 'cho' is not recognized).
• In-Memory Script Execution Guard: Hardened install.ps1 against $null path evaluations when executed directly in-memory via irm ... | iex.

Bug Fixes & System Stability

• Uninstaller Temp File Retention: Excluded active uninstaller runner scripts (*uninstall*) from %TEMP% cleanup in uninstall.ps1, preventing premature deletion of the running script during uninstallation.
• Atomic Uninstaller Handoff & Clean Process Termination: Eliminated intermediate batch runner files and obsolete subroutine stack popping in jvm.bat. Routed uninstallation execution through an atomic, in-memory compound command with direct process exit (& exit), completely eliminating post-uninstallation The batch file cannot be found. errors and The system cannot find the path specified. directory rescan attempts on deleted installations.
• MSI PATH Precedence & Sanitization: Hardened MSI installer environment routines to accurately detect, sanitize, and prepend JVM directory paths without duplicating existing PATH entries.

[1.0.0] - 2026-09-16

This milestone 1.0.0 release marks the official general availability of the DiamTek Java Version Manager for Windows. It features a massive architectural overhaul of the entire engine, adding comprehensive ecosystem support, native automation integrations, full package manager distribution, and solving multiple Windows-specific system limitations.

Distribution & Packaging

• Windows Terminal Profile Integration: Automatically registers a dedicated “Java Version Manager” profile in Windows Terminal settings.json (Release, Preview, and Unpackaged) pointing to high-res icon.png, with closeOnExit: always and cmd.exe /c execution lifecycle so terminal tabs close cleanly upon exiting the JVM menu.
• Start Menu & Taskbar Launchers: Generates Start Menu application shortcuts and dynamically synchronizes existing pinned taskbar shortcuts to launch the registered Windows Terminal profile when available, with a graceful cmd.exe /c fallback for classic console hosts.
• Dynamic File Size Estimation: Dynamically calculates recursive disk footprint across %LOCALAPPDATA%\DiamTek\JVM and %USERPROFILE%\.jvm, enforcing a 1,024 KB floor in EstimatedSize registry key so Windows 11 Installed Apps displays accurate application sizes (1.00 MB+) instead of suppressing file size.
• Comprehensive Lifecycle Uninstallation: Deepened uninstall.ps1 to scrub Windows Terminal profiles, reset defaultProfile if targeted, remove pinned taskbar shortcuts, and eliminate temporary .jvm_session_target and jvm_* artifacts.
• Official Branding Suite: Integrated high-resolution 768x768 ARGB source branding (assets/icon.png) and multi-resolution ICO (assets/icon.ico) with vertical baseline anchoring and 89% optical fill across installers, registry entries, and package manifests.
• Package Manager Ecosystem: Full manifest support for Scoop (jvm.json), Chocolatey (jvm.nuspec, chocolateyInstall.ps1, chocolateyUninstall.ps1), Winget (DiamTek.JVM.yaml), and an automated WiX Toolset v4 MSI build pipeline (build-msi.ps1).
• Automated Chocolatey Packaging (build-choco.ps1): Introduced packages/choco/build-choco.ps1 to automatically synchronize jvm.nuspec metadata and versioning directly from jvm.bat, validate XML schema and UTF-8 encoding, and pack Chocolatey distribution packages (.nupkg) in CI/CD.
• Flat Release Staging Architecture & SLSA Attestation: Engineered a flat staging pipeline (dist/) in .github/workflows/release.yml preventing nested subfolder artifacts in release zips, generating unified dist/SHA256SUMS.txt digests, and generating cryptographically verifiable Sigstore SLSA build provenance attestations across all release assets (dist/*) via actions/attest-build-provenance@v2.
• Standalone WiX v4 Dual-Architecture MSI Pipeline: Engineered an automated standalone WiX Toolset v4 build pipeline (packages/msi/build-msi.ps1) compiling self-contained, single-file Windows Installers for both x64 and arm64 ($Arch = "all" by default). Utilizes <MediaTemplate EmbedCab="yes" /> for embedded cabinet #cab1.cab packaging (~900 KB) with <MajorUpgrade> downgrade prevention.
• Autonomous Standalone MSI Compiler: Hardened packages/msi/build-msi.ps1 with multi-tier candidate path resolution, autonomous GitHub source bootstrapping into %TEMP% when executed outside the repository (e.g., from Downloads), automatic export of DOTNET_ROOT / DOTNET_ROOT_X64 so WiX CLI apphosts resolve the .NET runtime across all environments, XML-escaped absolute asset injection into jvm.wxs, and explicit COM database handle release to prevent file-lock conflicts.
• Automated 21-Point MSI Verification Suite: Developed an end-to-end automated verification script (packages/msi/test-msi.ps1) checking quiet installation (msiexec /qn), binary layout, CLI bin/ directory hygiene (hook isolation), Start Menu application and uninstaller shortcuts indexed in Windows Search, registry integrity, PATH persistence, PowerShell profile integration and tab-completer channel flags, update channel initialization (channel.txt), Windows Terminal profile injection, CLI sanity subshell execution, quiet uninstallation, and zero-residual filesystem hygiene with exit codes tailored for CI/CD pipelines and GitHub Actions build provenance attestations (actions/attest-build-provenance).
• Deep UAC Uninstaller Engine: Introduced uninstall.ps1 with automatic UAC administrator privilege escalation to completely scrub JVM, PATH entries, environment variables, AppData Ecosystem caches, and installed JDKs.
• Uninstaller Directory Lock Staging: Uninstaller stages its script to %TEMP% and pivots CMD working directory to %TEMP% before execution, releasing file and directory handles so the parent JVM directory can be fully wiped without file locks.
• Uninstaller External Handoff Runner & Zero-Frame Decoupling: Engineered an external uninstaller handoff runner (%TEMP%\jvm_uninstall_<rand>.bat) with a dedicated parameter-expansion subroutine (:ChainUninstallerRunner) and direct goto transitions. By eliminating compound loop blocks and unrolling all active cmd.exe subroutine call frames before invoking the external runner, jvm.bat is completely decoupled from disk before the uninstallation wipe executes, eliminating post-deletion file seek errors (The system cannot find the path specified.) and guaranteeing clean exit codes back to the host shell prompt.
• Conditional JDK Directory Wipe Prompt: Uninstaller only prompts to delete C:\Program Files\Java if the directory actually exists on the filesystem, remaining completely silent when no JDK directory is present.
• Single-Destination Target Architecture: Synchronized TargetDir handling so updating standalone or custom installations writes directly to the target location without creating duplicate parallel %LOCALAPPDATA% installations.
• Resilient Companion Asset Retrieval: Hardened LICENSE, README.md, and uninstall.ps1 fetching with per-file exception boundaries, automatic HEAD CDN fallback, and safe path comparisons, eliminating false-positive warnings and Resolve-Path exceptions.
• Windows Integration: Automatically registers JVM into Windows Settings / Installed apps (HKCU:\...\Uninstall\DiamTek.JVM) with native uninstallation support and creates a Start Menu uninstaller shortcut.
• Terminal & CLI Uninstaller: Added a full system wipe option in the interactive Settings menu and CLI support via jvm self-uninstall.

Architecture & Core Engines

• Enterprise Storage Migration: Migrated the entire storage architecture from the user profile (%USERPROFILE%\.jvm) to %LOCALAPPDATA%\DiamTek\JVM for strict enterprise-grade path compliance.
• Directory Junction Architecture: Completely migrated the core routing architecture to use native Windows Directory Junctions (%LOCALAPPDATA%\DiamTek\JVM\current). This enables 100% UAC-free, instantaneous version switching that dynamically syncs across all open terminal windows.
• Dual-Architecture Engine: Built a Dual-Architecture toggle allowing users to seamlessly swap between the new “Symlink Mode” and the legacy “Registry Mode” directly from the Settings Menu.
• PowerShell Registry Wrappers: Re-engineered the legacy Registry Mode to utilize background PowerShell wrappers. This fixes a major historical bug where switching versions would fail silently for non-Admin standard users.
• Universal Candidate Engine: Built a universal payload engine capable of downloading, extracting, and symlinking binaries natively, powering both JDK installations and ecosystem tools.
• Smart Caching: Improved script navigation and execution speed via a smart caching NEEDS_RESCAN architecture that prevents redundant local directory polling.
• ARM64 Native Support: Added ARM64/AArch64 hardware auto-detection, dynamically routing all vendor API queries to architecture-specific download endpoints.

Ecosystem & Third-Party Integrations

• BellSoft Liberica JDK: Full native downstream integration for BellSoft Liberica across Java 8, 11, 17, 21, and latest STS releases on both x64 and ARM64. Features automated release discovery via the official BellSoft API (https://api.bell-sw.com/v1/liberica/releases) and SHA1 cryptographic checksum validation.
• IBM Semeru Runtime (OpenJ9): Integrated IBM Semeru certified OpenJDK binaries powered by Eclipse OpenJ9 across Java 8, 11, 17, and 21 for Windows x64. Features GitHub API asset resolution and SHA256 integrity verification, offering substantial cloud memory footprint reductions and rapid JIT startup optimizations.
• JVM Ecosystem Parity: Natively support the broader JVM Ecosystem (Maven, Gradle, Kotlin, Scala, Groovy) with dynamic APIs for downloading, extracting, and routing toolchains. Version arguments default to latest on install (e.g., jvm install scala), uninstallation supports smart auto-detection (auto-removing single installed versions or providing an interactive numbered menu if multiple exist), and GitHub-backed candidate resolvers (Maven, Kotlin, Scala) feature automatic zero-quota HTTP 302 redirect fallback when API rate limits are encountered.
• Interactive Ecosystem Auto-Updater: Engineered a vendor-selection menu that checks individual tools (or all at once) against GitHub/Apache APIs to resolve the absolute latest releases, and seamlessly prompts to upgrade out-of-date binaries.
• .java-version Auto-Switching: Added directory-based auto-switching using .java-version files. Defaults to True Session Isolation (only changes the current terminal) with an explicit --global CLI override flag. Support added for passing full CLI flags directly inside the .java-version file.
• .sdkmanrc Hijack Protocol: Built a native .sdkmanrc parser to dynamically hijack cross-platform SDKMAN workflows, providing seamless cross-compatibility for Windows developers working on Linux-first teams. Expanded translations to dynamically parse SDKMAN vendor identifiers for Liberica (librca, nik, liberica) and Semeru (sem, semeru).

Security, Validation & Integrity

• Zip-Slip Archive Traversal Containment: Hardened :ExecuteSharedDownloader against directory traversal vulnerabilities by verifying that every extracted entry resolves strictly within the designated target root directory, blocking malicious or malformed archives before any files can be written to disk.
• BellSoft Liberica Cryptographic Verification: Formally documented BellSoft’s upstream distribution policy of publishing SHA1 checksums and ensured cryptographic parity through native .NET verification.
• .NET Cryptography SHA Validation: Implemented enterprise-grade SHA256 checksum verification for all JDK downloads using native .NET Cryptography APIs to protect against corrupted payloads. Added dynamic SHA256/SHA512 validation with automatic SHA1 fallback for older legacy endpoints (like Maven).
• One-Liner Installation Script: Introduced a bulletproof one-liner installation script (install.ps1) for frictionless setup and automatic code sanitization across environments.
• Self-Updater Sentinel Guard: Added a rem END OF SCRIPT sentinel integrity check to the self-updater to automatically reject truncated or corrupted payload downloads.
• 1024-Character PATH Fix: Fixed the notorious Windows setx 1024-character PATH truncation bug by completely replacing all environment variable updates with infinite-length .NET API calls.
• Redundant Registry Backups: The jvm clear and uninstallation commands now automatically backup both HKCU and HKLM environment registry keys to %LOCALAPPDATA%\DiamTek\JVM\backups\ before executing destructive scrubs.
• Offline-Aware Error Handling: Added structured error handling across all network operations with clean [ ERROR ] / [ DETAIL ] outputs instead of raw exception dumps.

CLI Automation & Parsing

• Dual Update Channel Engine (Stable vs Nightly): Introduced update channel management via jvm channel [stable|nightly], flag overrides (--channel, --nightly, --stable), and an interactive toggle in the Settings Menu. The Stable channel queries official tagged releases (releases/latest) marked green [Stable], while the Nightly channel delivers cutting-edge builds from main marked purple [Nightly]. Features enterprise-grade cryptographic SHA-256 integrity verification against release SHA256SUMS.txt digests, ahead-of-remote safety checks that prevent downgrading unreleased local builds on either channel, full comparison of both Semantic Version and Build Number (v!JVM_VERSION! (Build !JVM_BUILD!)), and automatic rate-limit safe fallback architecture (via Fastly raw endpoints and GitHub web redirects) to ensure update queries never fail with HTTP 403.
• PowerShell Profile Hook Activation Hint: Added an immediate contextual hint (Run '. $PROFILE' or restart your terminal) upon configuring the profile hook to activate dynamic completions immediately.
• Multi-Invocation PowerShell Tab Completion: Expanded argument completer registration from jvm alone to @('jvm', 'jvm.bat', '.\jvm.bat'), enabling seamless tab completion whether invoking globally via PATH or locally via ./jvm.bat. Complete support added for channel, stable, nightly, and channel flags.
• CLI Ergonomics & Developer Aliases: Added industry-standard CLI aliases across all command surfaces: jvm ls (mapped to jvm list), jvm info and jvm whoami (mapped to jvm current), jvm check (mapped to jvm doctor), and jvm prune (mapped to jvm clean).
• NO_COLOR Standard Compliance: Full compliance with the NO_COLOR specification (NO_COLOR=1 or NO_COLOR=true) and added an explicit --no-color CLI flag across all subcommands to suppress ANSI color escape sequences in CI/CD pipelines and automated log aggregators.
• Native CLI Help Engine: Built-in formatted help screen (jvm help, jvm --help, jvm -h, jvm /?) displaying the full command suite, arguments, ecosystem switches, maintenance utilities, flag overrides, and an expanded 8-vendor support matrix.
• Deep Uninstaller Command: Added jvm self-uninstall to invoke the UAC-elevated deep uninstallation pipeline directly from any terminal.
• Semantic CLI Routing & Interactive LTS Selection: Added robust semantic routing commands (jvm latest, jvm lts) and powerful flag overrides (--symlink, --legacy, --vendor, --latest, -y). Running jvm install lts presents an interactive version selection menu offering supported LTS versions (17, 21, 25), with the --latest flag automatically locking onto the newest LTS release, and enforces an upstream Java 17 distribution floor.
• Semantic Self-Updater Engine: Built a seamless self-updater engine (jvm version, jvm self-update) that securely compares build numbers using the native .NET [version] class before automatically downloading and atomic-swaps the core script.
• External Process Handoff Engine: Self-update now decouples from jvm.bat by chaining execution into an external runner (%TEMP%\jvm_updater_*.bat) without call. This allows cmd.exe to close jvm.bat’s file handle immediately, eliminating mid-stream byte-offset corruption, 'file' is not recognized syntax errors, and duplicate installer invocation loops.
• Dynamic GitHub CDN Cache Bypass: Resolves the exact commit SHA of main via the GitHub API to bypass the 5-minute Fastly/Varnish edge caching on raw.githubusercontent.com, ensuring newly published releases are immediately discovered and fetched without propagation delays.
• Dynamic Feature Resolvers: Built a dynamic FetchLatestVersions resolver that queries the Adoptium API at runtime to establish the true latest feature release and LTS version numbers, eliminating hardcoded version constants.
• Self-Contained Update Checkers: Re-engineered the UpdateChecker as a fully self-contained inline PowerShell script generated at runtime for all six vendors, removing all external .ps1 file dependencies.
• Status & Diagnostic Dashboard (jvm current / jvm status / jvm env): Built a real-time diagnostic dashboard querying active Java vendor, version, JAVA_HOME, java.exe binary path, architecture switching mode ([Symlink Mode] in green vs [Registry Mode] in red), directory junction target highlighted in green, active update channel badge ([Stable] in green vs [Nightly] in purple), and active JVM ecosystem candidates (maven, gradle, kotlin, etc.).
• Raw Binary Path Resolution (jvm which / jvm path): Added a high-speed CLI binary resolver printing the clean absolute filesystem path of java.exe or ecosystem candidate binaries directly to stdout (with exit code 0 on success and exit code 1 with error details on stderr), tailored for automation scripts, IDE configurations, and CI/CD pipelines.
• Automated System Health Diagnostics (jvm doctor): Introduced an automated 7-point deep health check evaluating storage root access and permissions, architecture switching mode, directory junction pointer and bin\java.exe target reachability, User vs Machine JAVA_HOME synchronization, where.exe java PATH precedence and rogue Oracle shadowing, and PowerShell $PROFILE hook status.
• Ephemeral One-Off Subshell Runner (jvm exec / jvm run): Engineered an ephemeral subshell runner that executes commands against any installed JDK in an isolated process context with local %JAVA_HOME% and %PATH% without altering the active Directory Junction, system environment, or Windows Registry, preserving and propagating the exact exit code back to the caller.
• Project Version Pinning (jvm pin / jvm local): Added automated creation and inspection of .java-version files directly from the CLI, supporting inline vendor and architecture flags (jvm pin 21 --vendor adoptium).
• File Explorer Directory Jump (jvm open / jvm home): Added instant Windows File Explorer navigation targeting active JDKs, candidate ecosystem tools (maven, gradle, kotlin), specific version folders, or the %LOCALAPPDATA%\DiamTek\JVM storage root.
• SDKMAN! & NVM Transparent Aliases (jvm use / jvm default): Added 1:1 transparent compatible aliases (jvm use, jvm default) to accommodate developers migrating from Unix-based version managers.
• Safe Cache Maintenance (jvm clean): Added a dedicated disk cache pruner that safely sweeps installer archives (%TEMP%\jdk_*_download.*), extraction trees (%TEMP%\jdk_*_extract), temporary downloaders (%TEMP%\jvm_dl_*.ps1), AppData downloads (%LOCALAPPDATA%\DiamTek\JVM\downloads\*), and orphaned candidate temp folders (temp_*), reporting freed megabytes and file counts without touching installed runtimes or registry configurations.
• PowerShell Profile Hook Management (jvm hook): Added dedicated CLI commands (jvm hook, jvm hook status, jvm hook remove) and decoupled the PowerShell profile auto-sync hook from the global User PATH configuration in the Settings Menu with chcp 65001 UTF-8 code page enforcement to eliminate diacritic path distortion in user profiles, providing separate [INSTALLED] / [NOT INSTALLED] indicators for both.

UI & Developer Experience

• Unified Sub-Hubs: Consolidated the Main Menu into two unified “JDK Management” and “Ecosystem Management” sub-hubs, each mirroring the identical “Switch Active” / “Version Management” layout.
• Consistent Layouts: Enforced consistent, unified UI layouts (--- Manage by Vendor/Tool --- and --- Actions ---) across all JDK and Ecosystem menus.
• In-Memory Bubble Sort: Built an optimized, strictly in-memory Bubble Sort algorithm to organize JDKs visually by newest version in the UI.
• Vendor Grouping: Introduced dynamic Vendor grouping across all 8 supported upstream distributions (Oracle, Adoptium, GraalVM, Corretto, Zulu, Microsoft, Liberica, Semeru) across all interactive menus.
• Code Page Preservation: Added native terminal code page preservation and restoration to seamlessly handle UTF-8 rendering (like the © symbol) without permanently corrupting the user’s host environment.
• Animated ANSI Progress Bar: Added a real-time, 30-character animated ANSI progress bar to install.ps1 with percentage indicators tracking environment initialization, release resolution, core engine fetch, encoding sanitization, companion assets, user PATH configuration, profile hook registration, and shortcut integration.
• Zero-Flicker Background Requests: Configured $ProgressPreference = 'SilentlyContinue' across all PowerShell hooks, inline web requests, and candidate resolvers, completely suppressing the top blue/cyan progress bar that previously flashed during silent background network queries.
• Progress Bar Enhancements: Overhauled the Self-Updater to utilize the Universal Candidate Downloader engine to grant it native ANSI progress bars. Restored native extraction progress bars and forced a final 100% frame to fix a rounding edge case.
• UI Tag Formatting: Aligned all UI tags to a strict 10-character padded format ([ OK ], [ ACTIVE ], etc.) for perfect visual alignment.

Documentation & Enterprise Knowledge Base

• Enterprise Documentation Portal: Authored a complete suite of six dedicated technical guides (INSTALLATION.md, USAGE.md, ARCHITECTURE.md, FAQ.md, SDKMAN-Comparison.md, and CHANGELOG.md) providing exhaustive coverage of all engine features, CLI commands, and system integration points.
• Architectural Diagrams: Designed three comprehensive Mermaid visual flowcharts illustrating Directory Junction resolution, Dual-Architecture switching internals, and the automated WiX Toolset v4 multi-stage CI/CD compilation pipeline.
• IDE & Build System Integration: Documented full configuration workflows for IntelliJ IDEA, Visual Studio Code (Language Server runtime), Gradle (gradle.properties), and Apache Maven (toolchains.xml), leveraging the stable %LOCALAPPDATA%\DiamTek\JVM\current junction to bypass IDE project re-indexing upon version switches.
• Enterprise IT & Deployment Automation: Added enterprise endpoint management specifications for Microsoft Intune, MECM (SCCM), and Active Directory Group Policy (GPO), including silent parameters (/qn), detection rules (ProductCode, Registry, File system), and process exit codes (0, 1, 1602, 1603, 3010).
• Enterprise Readiness & Zero-Admin Corporate Strategy: Documented the four pillars of corporate adoption in README.md, docs/INSTALLATION.md, and docs/FAQ.md: standard-user zero-admin installation for locked-down corporate laptops (0 UAC prompts, 0 IT tickets), mixed-OS cross-platform engineering team onboarding via .sdkmanrc, silent Intune/MECM fleet rollout, and SecOps/EDR compliance hygiene.
• Comprehensive Troubleshooting & Diagnostics: Documented PATH precedence shadowing diagnosis (where.exe java), rogue legacy path cleanup via jvm clear, corporate proxy/VPN configurations, Windows Root CA trust, Windows Defender SmartScreen guidance, and Zone.Identifier PowerShell script unblocking (Unblock-File).
• Connected Navigation Architecture: Integrated uniform breadcrumb navigation headers, contextual Quick Jump table of contents, and bidirectional cross-links across all documentation pages.
• GitHub Pages Optimization: Tailored Jekyll Cayman theme configuration (_config.yml), ensuring responsive layouts, cross-domain link rewriting, and asset packaging across both GitHub web and GitHub Pages portals.
• Open-Source Governance Suite: Published standard community health files, including CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, SUPPORT.md, structured issue templates, and a pull request template.

Bug Fixes & System Stability

• Zero-File UAC Elevation (LPE / TOCTOU Hardening): Replaced all temporary .bat and .ps1 elevation payloads in %TEMP% (ADMIN_BAT and ELEVATE_SCRIPT) with direct, in-memory parameterized process execution (Start-Process powershell -Verb RunAs ...), completely eliminating Time-of-Check to Time-of-Use race conditions and Local Privilege Escalation vectors.
• Strict Integrity Verification Decoupling: Separated prompt confirmation (-y / --yes) from integrity verification; introduced --skip-checksum (alias --no-verify) so automated CI/CD scripts never silently proceed without checksum verification when hash endpoints are unavailable.
• Repository Configuration Sanitization: Hardened .java-version and .sdkmanrc parsing with strict metacharacter filtering (| findstr /v "[&|<>]"), neutralizing shell command injection vectors from untrusted repositories.
• Inline PowerShell Delimiter Escaping: Hardened all path interpolations in inline elevated PowerShell scripts with single-quote escaping (:'=''), eliminating syntax errors and command breaks on paths containing apostrophes or single quotes.
• MSI Tooling Autonomous 4-Tier Resolution & .NET Bootstrapping: Enhanced test-msi.ps1 and build-msi.ps1 with automatic Zone.Identifier unblocking (Unblock-File), process-scoped ExecutionPolicy bypass (Set-ExecutionPolicy -Scope Process Bypass), robust path resolution ($PSScriptRoot / $PSCommandPath), user-space .NET SDK bootstrapping (dotnet-install.ps1), GitHub release downloading, and remote source extraction. This enables test-msi.ps1 to run autonomously on any clean machine—even with no prior repository, build scripts, or .NET tools installed.
• WixQuietExec Path Resolution: Hardcoded [WindowsFolder]System32\WindowsPowerShell\v1.0\powershell.exe in WiX custom actions to resolve WixQuietExec error 0x80070002 (“file not found”) occurring because Windows Installer service deferred execution does not inherit the standard shell PATH.
• MSI CustomAction Shortcut Race Condition: Rescheduled MSI install hook execution sequence to After="CreateShortcuts" (sequence 4501) rather than After="InstallFiles" (sequence 4002), guaranteeing the Start Menu .lnk file is present on disk before PowerShell attempts to polish it with Windows Terminal integration.
• MSI Uninstaller File Lock Race: Eliminated asynchronous background directory deletion routines (cmd.exe /c timeout ... rmdir) from MSI uninstallation hooks, delegating filesystem removal exclusively to standard Windows Installer actions and preventing Windows Installer Error 2318 (File does not exist: icon.png).
• Keystroke Interception on Updater Handoff: Resolved a bug where the first user keystroke in jvm.bat was ignored after returning from a self-update. This was caused by a background start /b timeout deletion thread competing for the console input buffer. Completely eliminated the background thread, allowing the interactive menu to respond instantaneously on the first keystroke while handling cleanup safely at batch startup.
• Direct Target Directory Updates: Removed repository directory redirection heuristics ($isDevRepo) in install.ps1, ensuring custom locations, standalone copies, and cloned workspaces update their running jvm.bat directly instead of silently redirecting into %LOCALAPPDATA%.
• Commit SHA Handoff Forwarding: Forwarded the dynamically resolved GitHub commit SHA (-Branch "!REMOTE_REF!") from jvm.bat to install.ps1 to eliminate duplicate API calls, bypass Fastly CDN edge caching on HEAD/main, and guarantee newly installed scripts immediately reflect the latest build version.
• Live Terminal Memory Collapse: Resolved a critical bug where running the uninstallation or switch commands could completely destroy all native Windows commands (findstr, choice) in the active session. This occurred because the previous path-scrubber relied on batch string substitution (!PATH:string=!), which suffered catastrophic quote-collisions when evaluating complex paths containing double quotes or undefined variables. Completely replaced all batch substitution with safe, native PowerShell -not array evaluations.
• UTF-8 BOM Interpretation: Fixed critical Windows cmd.exe UTF-8 BOM interpretation bugs and UNIX (LF) line-ending crashes (the cho bug) by enforcing explicit CRLF encoding during downloads.
• Double-Quote PATH Encapsulation: Hardened all for /f variable export loops with double-quote encapsulation to prevent cmd.exe from misinterpreting PATH strings containing embedded quotes as file lists.
• Exclamation Mark Corruption: Fixed delayed expansion parsing bugs that corrupted custom paths containing exclamation marks (!).
• Oracle Update Crash: Fixed Oracle update checks crashing with '$' is not recognized by switching the PowerShell payload to pipe-safe string concatenation.
• Forward Compatibility: Replaced deprecated wmic environment queries with direct reg query calls for guaranteed forward compatibility with Windows 11.
• Variable Slicing Errors: Hardened the Global Command installer and resolved subshell variable slicing errors.
• Cross-Architecture Registry Conflicts: Fixed conflicts between User and Machine environment variables causing ghost path artifacts.
• UAC Deadlocks: Fixed edge-case UAC elevation deadlocks during global registry writes.
• Directory Protection: Added a conditional rmdir guard to prevent extracted files from being destroyed if a junction move failure occurs.
• Navigation State Leaks: Patched a variable state-leak during cross-menu navigation and stabilized the back-navigation structural loop across all interactive UI hubs.

[0.5.0] - 2026-08-20

Added

• Global Command Installer: Built a new Global Command Installer to dynamically inject the JVM directory into the Windows User PATH.
• CLI Quick-Switching: Introduced CLI Quick-Switching (jvm <version>) for silent, background Java swapping directly from the terminal.
• Visual Countdown: Replaced standard script pauses with an interruptible visual auto-close countdown loop.

Changed

• UAC Elevation Refactor: Refactored the UAC elevation block to hardcode powershell.exe absolute paths, preventing crashes from corrupted environment variables.
• UI Polish: Polished UI aesthetics with strict ANSI color hierarchy and muted absolute file paths.

[0.4.0] - 2026-08-19

Added

• Dynamic Scanner: Re-engineered the JDK discovery engine to dynamically scan developer toolkits (Scoop, Gradle, IntelliJ).
• Fast Parsing: Replaced hardcoded loops with fast release file parsing for instantaneous version resolution.
• Sub-menu Architecture: Completely overhauled the UI architecture with robust sub-menu navigation and input validation.

Changed

• ANSI Enhancements: Polished ANSI padding, visual alignments, and nested log formatting across all menus.

Fixed

• Variable Scope Crashes: Fixed critical variable scope bugs that caused silent crashes during path switching.

[0.3.0] - 2026-08-19

Changed

• Relicensed to AGPL-3.0: Relicensed the project from the MIT License to the GNU Affero General Public License v3.0 (AGPL-3.0).
• Documentation Updates: Added standard LICENSE file containing the full AGPL-3.0 text and updated README.md and jvm.bat file headers to reflect the new licensing and copyright.

[0.2.0] - 2026-06-01

Added

• Update Checker: Added Update Checker that compares local metadata against Oracle servers.
• Bulk Updates: Added Update All capability to bulk-scan and patch all installed JDKs.
• Automated Hot-swapping: Automated hot-swapping handles downloading, folder swapping, and JAVA_HOME patching.
• Safe Versioning: Added safe versioning logic to prevent accidental downgrades.

[0.1.1] - 2026-05-17

Changed

• UI Adjustment: Rename “Exit without changes” menu item to “Exit”.

Fixed

• PATH Corruption Bug: Fix PATH corruption causing silent crashes after version switch.
• Expansion Buffer: Add local delayed-expansion buffer to safely rebuild session PATH.
• System Variable Drops: Prevent choice command failure from dropped system variables.

[0.1.0] - 2026-05-17

Added

• Initial Release: First stable release of the Java Version Manager for Windows.

---

← Back to Documentation Overview