linghengqian · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026
diff --git a/docs/changes.md b/docs/changes.md
@@ -2,15 +2,15 @@
 
 [中文](zh-CN/changes.md) | [English](changes.md)
 
-What changed in each release, as a user notices it. GitHub's release pages list the pull requests. The newest release at the time of writing is 0.6.4, and `main` is ahead of it by everything under "Unreleased". [install-from-source.md](install-from-source.md) gets you those changes now.
+What changed in each release, as a user notices it. GitHub's release pages list the pull requests.
 
-## Unreleased
+## 0.6.5 (2026-11-03)
 
 - A `.sdkmanrc` takes SDKMAN's identifiers of Oracle GraalVM and GraalVM Community, which write the fifth number of GraalVM's version after the `+`: `java=25.0.5.0+3-graal` selects `25.0.5.0.3-graal`, and `java=25.4.4.1+1-graalce` selects `25.4.4.1.1-graalce`. Release 0.6.4 takes that number for a build of the release 25.0.5 and finds no such name. So it selects `25.0.5-graal` where that is installed next to `25.0.5.0.3-graal`, which is a different download (Oracle ships `25.0.5`, `25.0.5.0.2` and `25.0.5.0.3` as three files), and otherwise the newest installed release of 25: a project pinned to `25.0.5.0+3-graal` moves to a newer GraalVM as soon as one is installed. See [sdkmanrc.md](sdkmanrc.md#sdkmans-spellings) ([#124](https://github.com/version-fox/vfox-java/pull/124)).
 
 ## 0.6.4 (2026-11-03)
 
-- vfox verifies a download against the checksum Foojay lists for it. Release 0.6.3 gives vfox no checksum, so every install ends with `WARNING: Checksum is not provided, skip verify...` and trusts the download, though Foojay lists a checksum for most distributions. Now `vfox install java@25.0.2-graalce` prints `Verifying checksum e0be791c...` instead, and a download that does not match stops with `Checksum error` and installs nothing. Foojay lists none for Dragonwell, Bisheng, Trava, AdoptOpenJDK, OpenLogic, Gluon GraalVM, Corretto after 8 and the older releases of several others, and vfox still warns about those. A checksum file on GitHub goes through `VFOX_JAVA_GITHUB_MIRROR` like the download. Where the plugin cannot use a checksum that Foojay lists, it prints why (`Cannot verify the download: ...`) and installs as before. See [foojay.md](foojay.md#checksums).
+- vfox verifies a download against the checksum Foojay lists for it. Release 0.6.3 gives vfox no checksum, so every install ends with `WARNING: Checksum is not provided, skip verify...` and trusts the download, though Foojay lists a checksum for most distributions. Now `vfox install java@25.0.2-graalce` prints `Verifying checksum e0be791c...` instead, and a download that does not match stops with `Checksum error` and installs nothing. Foojay lists none for Dragonwell, Bisheng, Trava, AdoptOpenJDK, OpenLogic, Gluon GraalVM, Corretto and the older releases of several others, and vfox still warns about those. A checksum file on GitHub goes through `VFOX_JAVA_GITHUB_MIRROR` like the download. Where the plugin cannot use a checksum that Foojay lists, it prints why (`Cannot verify the download: ...`) and installs as before. See [foojay.md](foojay.md#checksums).
 
 ## 0.6.3 (2026-10-20)
 

diff --git a/docs/e2e.md b/docs/e2e.md
@@ -360,7 +360,7 @@ JDK, so `java` can only come from what vfox installs:
 
    The install itself must also have verified the download. Foojay lists a
    checksum for the pinned release of every default distribution on every
-   runner (2026-11-02), and `vfox install` must print `Verifying checksum
+   runner (2026-11-03), and `vfox install` must print `Verifying checksum
    <digest>...` with a digest of a length vfox supports, not `WARNING:
    Checksum is not provided, skip verify...`, which every install ended with
    until the plugin passed Foojay's checksums on. The digests come in four

diff --git a/docs/foojay.md b/docs/foojay.md
@@ -153,7 +153,7 @@ So the plugin asks for every package of these two, as `vfox search` does, and pi
 
 ## Checksums
 
-The record that `links.pkg_info_uri` points to also says how to check the download. `checksum_type` is the algorithm, and the digest is in the record as `checksum`, or in a file of the vendor that `checksum_uri` points to. GraalVM Community 25.0.2 has the file only (2026-11-02):
+The record that `links.pkg_info_uri` points to also says how to check the download. `checksum_type` is the algorithm, and the digest is in the record as `checksum`, or in a file of the vendor that `checksum_uri` points to. GraalVM Community 25.0.2 has the file only (2026-11-03):
 
 ```bash
 curl -s 'https://api.foojay.io/disco/v3.0/packages/jdks?distribution=graalvm_community&version=25.0.2&architecture=amd64&operating_system=linux&lib_c_type=glibc&archive_type=tar.gz&directly_downloadable=true' \
@@ -176,13 +176,13 @@ The digest in Foojay's record goes first. It comes from Foojay and not from the
 
 A file that lists several packages gives the line of the one being installed. One that lists others only gives none: Microsoft's file for its EA build of 11.0.14 for macOS names the GA build, and that digest would fail an install that is fine.
 
-Which packages come with a checksum varies by release, and Foojay holds none for some distributions. For the newest releases (2026-11-02):
+Which packages come with a checksum varies by release, and Foojay holds none for some distributions. For the newest releases (2026-11-03):
 
 | Foojay lists | Short names |
 | --- | --- |
 | the digest in the record | `tem`, `zulu`, `librca`, `nik`, `eliya`, `rdht`, `mandrel` from 25, the newest `graal` and `graalce` |
-| a file of the vendor | `open`, `oracle`, `ms`, `sapmchn`, `sem`, `semcrt`, `jb`, `kona`, `ojdkbld`, `grl8`, `grl11`, `grl16`, `grl17`, `grl19`, the older `graal` and `graalce`, and Corretto 8 (`amzn`) |
-| no checksum | `albba`, `bsg`, `trava`, `adpt`, `adptj9`, `gln`, `opnlgc`, `amzn` other than Corretto 8, and the older releases of several of the others |
+| a file of the vendor | `open`, `oracle`, `ms`, `sapmchn`, `sem`, `semcrt`, `jb`, `kona`, `ojdkbld`, `grl8`, `grl11`, `grl16`, `grl17`, `grl19`, and the older `graal` and `graalce` |
+| no checksum | `albba`, `bsg`, `trava`, `adpt`, `adptj9`, `gln`, `opnlgc`, `amzn`, and the older releases of several of the others |
 
 For a package with none, vfox prints `WARNING: Checksum is not provided, skip verify...` and trusts the download.
 

diff --git a/docs/native-image.md b/docs/native-image.md
@@ -27,8 +27,8 @@ Other systems need other packages. GraalVM's [prerequisites](https://www.graalvm
 
 ## GraalVM CE 8 to 19
 
-GraalVM CE 8 to 19 (`grl8`, `grl11`, `grl16`, `grl17`, `grl19`) come without `native-image`. Their `bin` directory holds `gu`, the GraalVM Updater, and `native-image` is `command not found` until `gu install native-image` has added it from GitHub. That worked for `22.3.3-grl11`, `21.2-grl16`, `22.3.3-grl17` and `22.3.1-grl19` on 2026-11-02, and the packages above are needed after it as before. It failed for `21.3.1-grl8` with `Internal error occurred: A JSONObject text must begin with '{'`, because the release index that this `gu` downloads, `https://oca.opensource.oracle.com/gds/meta-data.json`, is a web page now. For that release, download `native-image-installable-svm-java8-linux-amd64-21.3.1.jar` from the [`vm-21.3.1` release](https://github.com/graalvm/graalvm-ce-builds/releases/tag/vm-21.3.1) and run `gu -L install` on the file.
+GraalVM CE 8 to 19 (`grl8`, `grl11`, `grl16`, `grl17`, `grl19`) come without `native-image`. Their `bin` directory holds `gu`, the GraalVM Updater, and `native-image` is `command not found` until `gu install native-image` has added it from GitHub. That worked for `22.3.3-grl11`, `21.2-grl16`, `22.3.3-grl17` and `22.3.1-grl19` on 2026-11-03, and the packages above are needed after it as before. It failed for `21.3.1-grl8` with `Internal error occurred: A JSONObject text must begin with '{'`, because the release index that this `gu` downloads, `https://oca.opensource.oracle.com/gds/meta-data.json`, is a web page now. For that release, download `native-image-installable-svm-java8-linux-amd64-21.3.1.jar` from the [`vm-21.3.1` release](https://github.com/graalvm/graalvm-ce-builds/releases/tag/vm-21.3.1) and run `gu -L install` on the file.
 
 ## What was checked
 
-Checked on 2026-11-02 with vfox 1.0.13 in Ubuntu 26.04 container images (x64) that had no compiler. GraalVM Community 25.0.2 and 25.4.4.1.1, Oracle GraalVM 25.0.5, Mandrel 25.0.5, Liberica NIK 25.0.4.1 and Gluon GraalVM 22.1.0.1 stopped as described without the packages, and with them built a hello world that ran. So did `22.3.3-grl17` after `gu install native-image`, and GraalVM Community 25.0.2 in a Fedora 44 image.
+Checked on 2026-11-03 with vfox 1.0.13 in Ubuntu 26.04 container images (x64) that had no compiler. GraalVM Community 25.0.2 and 25.4.4.1.1, Oracle GraalVM 25.0.5, Mandrel 25.0.5, Liberica NIK 25.0.4.1 and Gluon GraalVM 22.1.0.1 stopped as described without the packages, and with them built a hello world that ran. So did `22.3.3-grl11`, `21.2-grl16`, `22.3.3-grl17` and `22.3.1-grl19` after `gu install native-image`, `21.3.1-grl8` after `gu -L install` of the downloaded file, and GraalVM Community 25.0.2 in a Fedora 44 image.
diff --git a/docs/sdkmanrc.md b/docs/sdkmanrc.md
@@ -67,9 +67,11 @@ The last three rows are SDKMAN's identifiers for distributions it no longer list
 
 SDKMAN writes the JDK into some versions of Mandrel and Liberica NIK as well, which the plugin names after the GraalVM version alone, see [distributions.md](distributions.md#behavior-of-mandrel-and-liberica-nik). Of a release that comes for two JDKs, the plugin installs only the build for the newer one, so an identifier with the older one selects nothing: `22.1.r11-mandrel`, `23.0.1.r17-nik`. The older JDK is 11 from 21.3 to 22.3.5 and 17 from 23 to 23.0.1.2. `25.r25-mandrel` has only the major and selects the newest installed Mandrel 25, as `java=25-mandrel` does, while SDKMAN installs 25.0.1.0 for it.
 
+SDKMAN also lists CRaC builds of Liberica and Zulu (`21.0.13.0-crac+12-librca`, `25.0.4.1-crac+1-zulu`) and downloads them from the vendors. Foojay lists no CRaC build, so the plugin has none to install, and an identifier with `crac` selects nothing.
+
 The number after `+` in SDKMAN's newer identifiers is a build number, the vendor's (`25.0.5.0+8-tem` is Temurin's build 8, installed as `25.0.5+8-tem`) or SDKMAN's own count of its rebuilds (`21.0.8+1.1-tem`). The plugin looks for an installed build of that number first and otherwise takes the release. Foojay, and so the installed name, has no zero padding, which is why `27.0.0` means the release `27`. A `.0` padding in `sdk list java` is common (`25.0.1.0+8-open`, `21.0.9.0+116386-jbr`), and the plugin reads it as well.
 
-Oracle GraalVM and GraalVM Community are the exception. Their versions have five numbers (`25.0.5.0.3`) where SDKMAN's identifiers have four before the `+`, so SDKMAN writes the fifth after it: `25.0.5.0+3-graal` is GraalVM 25.0.5.0.3, and `25.4.4.1+1-graalce` is the feature release 25.4.4.1.1. That number belongs to the release. Oracle ships `25.0.5`, `25.0.5.0.2` and `25.0.5.0.3` as three different files. The plugin looks for the installed name with the dot first, and failing that goes on with steps 2 and 3 as for any release that is not installed. `vfox install` takes the dotted name only (`java@25.0.5.0.3-graal`), not the identifier. Unreleased: release 0.6.4 takes the number for a build of the release `25.0.5`. So it selects `25.0.5-graal` when that is installed next to `25.0.5.0.3-graal`, and a newer release of 25 when that is installed instead.
+Oracle GraalVM and GraalVM Community are the exception. Their versions have five numbers (`25.0.5.0.3`) where SDKMAN's identifiers have four before the `+`, so SDKMAN writes the fifth after it: `25.0.5.0+3-graal` is GraalVM 25.0.5.0.3, and `25.4.4.1+1-graalce` is the feature release 25.4.4.1.1. That number belongs to the release. Oracle ships `25.0.5`, `25.0.5.0.2` and `25.0.5.0.3` as three different files. The plugin looks for the installed name with the dot first, and failing that goes on with steps 2 and 3 as for any release that is not installed. `vfox install` takes the dotted name only (`java@25.0.5.0.3-graal`), not the identifier.
 
 ## Not finding it
 

diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
@@ -74,7 +74,7 @@ While `proxy.enable` is `false`, the usual `HTTP_PROXY`, `HTTPS_PROXY` and `NO_P
 ## Things that look wrong and are not
 
 - **A release you expect is missing from `vfox search`.** vfox keeps the result for 12 hours. `vfox config cache.availableHookDuration 0` turns the cache off. Foojay itself may not have the release yet either.
-- **`WARNING: Checksum is not provided, skip verify...` when a JDK installs.** Foojay lists no checksum for that package (Dragonwell, Bisheng, Trava, AdoptOpenJDK, OpenLogic, Gluon GraalVM, Corretto after 8, and older releases of several others), so vfox has nothing to verify the download against and trusts it. Where Foojay lists one, vfox prints `Verifying checksum <digest>...` instead, see [foojay.md](foojay.md#checksums).
+- **`WARNING: Checksum is not provided, skip verify...` when a JDK installs.** Foojay lists no checksum for that package (Dragonwell, Bisheng, Trava, AdoptOpenJDK, OpenLogic, Gluon GraalVM, Corretto, and older releases of several others), so vfox has nothing to verify the download against and trusts it. Where Foojay lists one, vfox prints `Verifying checksum <digest>...` instead, see [foojay.md](foojay.md#checksums).
 - **The installed name has a build number you did not type.** `java@21.0.8-tem` installs `21.0.8+9-tem`. The build is part of the name, see [versions.md](versions.md#installed-names).
 - **`vfox install java@21-tem` and `vfox install java tem` do different things.** The second one is two SDKs, `java` and `tem`.
 - **A `GRAALVM_HOME` you set is left alone.** The plugin sets `JAVA_HOME` and `PATH` only.

diff --git a/docs/zh-CN/changes.md b/docs/zh-CN/changes.md
@@ -2,15 +2,15 @@
 
 [中文](changes.md) | [English](../changes.md)
 
-按发布版本列出用户能感受到的变化。GitHub 的 Release 页面列出了对应的 PR。写这篇文档时最新的发布版是 0.6.4，`main` 比它多出“未发布”下面的所有内容。想现在就用上这些变化，见 [install-from-source.md](install-from-source.md)。
+按发布版本列出用户能感受到的变化。GitHub 的 Release 页面列出了对应的 PR。
 
-## 未发布
+## 0.6.5（2026-11-03）
 
 - `.sdkmanrc` 里写 SDKMAN 给 Oracle GraalVM 和 GraalVM 社区版的标识符时，会选中它指明的版本。SDKMAN 把这两个发行版版本号的第五位写在 `+` 后面：`java=25.0.5.0+3-graal` 选中 `25.0.5.0.3-graal`，`java=25.4.4.1+1-graalce` 选中 `25.4.4.1.1-graalce`。0.6.4 把这个数字当作 25.0.5 的构建号，找不到这样的名字，于是 `25.0.5-graal` 和 `25.0.5.0.3-graal` 都装着时选中前者，而它们是不同的下载（Oracle 把 `25.0.5`、`25.0.5.0.2` 和 `25.0.5.0.3` 发布成了三个文件）；没装 `25.0.5-graal` 时则选 25 里已安装的最新版本：钉在 `25.0.5.0+3-graal` 上的项目，一装了更新的 GraalVM 就会换过去。见 [sdkmanrc.md](sdkmanrc.md#sdkman-的写法)（[#124](https://github.com/version-fox/vfox-java/pull/124)）。
 
 ## 0.6.4（2026-11-03）
 
-- vfox 会按 Foojay 给出的校验和校验下载的文件。0.6.3 不给 vfox 任何校验和，所以每次安装最后都有 `WARNING: Checksum is not provided, skip verify...`，下载的内容照单全收，尽管 Foojay 给大多数发行版都列了校验和。现在 `vfox install java@25.0.2-graalce` 会打印 `Verifying checksum e0be791c...`，下载的文件对不上校验和时以 `Checksum error` 终止，什么也不会装上。Dragonwell、Bisheng、Trava、AdoptOpenJDK、OpenLogic、Gluon GraalVM、8 以后的 Corretto，以及其余发行版里较旧的版本，Foojay 没有校验和，vfox 对这些仍然会警告。GitHub 上的校验和文件和下载一样经过 `VFOX_JAVA_GITHUB_MIRROR`。Foojay 给了校验和而插件用不上时，插件会打印原因（`Cannot verify the download: ...`），安装照旧。见 [foojay.md](foojay.md#校验和)。
+- vfox 会按 Foojay 给出的校验和校验下载的文件。0.6.3 不给 vfox 任何校验和，所以每次安装最后都有 `WARNING: Checksum is not provided, skip verify...`，下载的内容照单全收，尽管 Foojay 给大多数发行版都列了校验和。现在 `vfox install java@25.0.2-graalce` 会打印 `Verifying checksum e0be791c...`，下载的文件对不上校验和时以 `Checksum error` 终止，什么也不会装上。Dragonwell、Bisheng、Trava、AdoptOpenJDK、OpenLogic、Gluon GraalVM、Corretto，以及其余发行版里较旧的版本，Foojay 没有校验和，vfox 对这些仍然会警告。GitHub 上的校验和文件和下载一样经过 `VFOX_JAVA_GITHUB_MIRROR`。Foojay 给了校验和而插件用不上时，插件会打印原因（`Cannot verify the download: ...`），安装照旧。见 [foojay.md](foojay.md#校验和)。
 
 ## 0.6.3（2026-10-20）