Update to Java 21 (#22908)

bernd · thll · web-flow · commit 5dc5cc874085 · 2025-08-18T12:42:27.000+02:00
* Remove maven.compiler.* properties from plugin archetype They are already defined in org.graylog:graylog-parent * Maven: update java compiler version from 17 to 21 * Update java in Github workflows * Fix deprecated usage of URL constructor * Fix deprecated usage of Thread#id * Catch IllegalArgumentException when URLs are not absolute * Remove PMD plugin for lack of java 21 support * Update to Java 21 * Inherig compiler source/target settings from parent * Use Java 21 in test containers * Fix URL deprecation error for Java 21 * Setup Mockito Java Agent for surefire See "Explicitly setting up instrumentation for inline mocking (Java 21+)" at https://javadoc.io/doc/org.mockito/mockito-core/latest/org.mockito/org/mockito/Mockito.html#0.3 * Switch dependency plugin to test phase and fix argLine * Get dependency properties in test-compile phase * Add changelog entry and adjust UPGRADING.md --------- Co-authored-by: Othello Maurer <othello@graylog.com>
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest-4-cores-public
     strategy:
       matrix:
-        java-version: [ 17 ]
+        java-version: [ 21 ]
     steps:
       - uses: actions/checkout@v4
       - name: Set up JDK ${{ matrix.java-version }}
diff --git a/.github/workflows/fix-linter-hints.yml b/.github/workflows/fix-linter-hints.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java-version: [ 17 ]
+        java-version: [ 21 ]
 
     steps:
       - name: Freeing up more disk space
diff --git a/.github/workflows/reviewbot.yml b/.github/workflows/reviewbot.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: temurin
           cache: maven
       - name: Compile with Maven / Install dependencies
diff --git a/UPGRADING.md b/UPGRADING.md
@@ -3,6 +3,13 @@ Upgrading to Graylog 7.0.x
 
 ## Breaking Changes
 
+### Java 21
+
+Graylog now requires Java 21 to run. Earlier versions are no longer supported.
+
+Our operating system packages and container images are shipping with the
+correct Java version.
+
 ### Kafka Inputs
 
 The `kafka-clients` library was updated to 4.x which removes support for Kafka
diff --git a/changelog/unreleased/issue-20015.toml b/changelog/unreleased/issue-20015.toml
@@ -0,0 +1,5 @@
+type = "c"
+message = "Switch to Java 21."
+
+issues = ["20015"]
+pulls = ["graylog2-server#22908", "graylog-plugin-enterprise#11084", "graylog-project-internal#178"]
diff --git a/data-node/pom.xml b/data-node/pom.xml
@@ -41,8 +41,6 @@
     <properties>
         <mainClass>org.graylog.datanode.bootstrap.Main</mainClass>
 
-        <maven.compiler.source>17</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <opensearch.version>2.15.0</opensearch.version>
         <opensearch.mac.jdk.version>21.0.7</opensearch.mac.jdk.version>
diff --git a/data-node/src/test/java/org/graylog/datanode/testinfra/DatanodeDevContainerBuilder.java b/data-node/src/test/java/org/graylog/datanode/testinfra/DatanodeDevContainerBuilder.java
@@ -235,7 +235,7 @@ private static ImageFromDockerfile createImage() {
 
         return image.withDockerfileFromBuilder(builder ->
         {
-            final DockerfileBuilder fileBuilder = builder.from("eclipse-temurin:17-jre-jammy")
+            final DockerfileBuilder fileBuilder = builder.from("eclipse-temurin:21-jre-jammy")
                     .workDir(IMAGE_WORKING_DIR)
                     .run("mkdir -p opensearch/config")
                     .run("mkdir -p opensearch/data")
diff --git a/full-backend-tests/src/test/java/org/graylog/searchbackend/datanode/ClientCertResourceIT.java b/full-backend-tests/src/test/java/org/graylog/searchbackend/datanode/ClientCertResourceIT.java
@@ -54,6 +54,7 @@
 import java.io.IOException;
 import java.io.StringReader;
 import java.net.HttpURLConnection;
+import java.net.URI;
 import java.net.URL;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
@@ -122,7 +123,7 @@ void generateClientCert() throws Exception {
                 createKeystore(privateKey, certificate, caCertificate),
                 createTruststore(caCertificate));
 
-        final URL url = new URL("https://" + this.api.backend().searchServerInstance().getHttpHostAddress());
+        final URL url = new URI("https://" + this.api.backend().searchServerInstance().getHttpHostAddress()).toURL();
 
         HttpURLConnection connection = (HttpURLConnection) url.openConnection();
         if (connection instanceof HttpsURLConnection) {
@@ -183,7 +184,7 @@ private static PrivateKey decodePrivateKey(String pemEncodedCert, String private
             Object parsed = pemParser.readObject();
             if (parsed instanceof PEMKeyPair keyPair) {
                 return converter.getPrivateKey(keyPair.getPrivateKeyInfo());
-            } else if(parsed instanceof PKCS8EncryptedPrivateKeyInfo keyPair) {
+            } else if (parsed instanceof PKCS8EncryptedPrivateKeyInfo keyPair) {
                 return decryptPrivateKey(privateKeyPassword, keyPair, converter);
             } else {
                 throw new IllegalArgumentException("Couldn't parse private key from provided string, unknown type");
diff --git a/graylog-plugin-archetype/src/main/resources/archetype-resources/pom.xml b/graylog-plugin-archetype/src/main/resources/archetype-resources/pom.xml
@@ -54,8 +54,6 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <maven.compiler.source>17</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
 
         <!-- Plugins will not be deployed by default - set to `false` if you actually want to deploy it -->
         <maven.deploy.skip>true</maven.deploy.skip>
diff --git a/graylog-project-parent/pom.xml b/graylog-project-parent/pom.xml
@@ -549,13 +549,28 @@
             </plugins>
         </pluginManagement>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <phase>test-compile</phase>
+                        <goals>
+                            <!-- Required to get Mockito's JAR path for the surefire argLine. -->
+                            <goal>properties</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <configuration>
                     <forkCount>1</forkCount>
                     <reuseForks>true</reuseForks>
-                    <argLine>-Dio.netty.leakDetectionLevel=paranoid -Djava.awt.headless=true</argLine>
+                    <!-- See: "Explicitly setting up instrumentation for inline mocking (Java 21+)" at
+                         https://javadoc.io/doc/org.mockito/mockito-core/latest/org.mockito/org/mockito/Mockito.html#0.3 -->
+                    <argLine>-javaagent:${org.mockito:mockito-core:jar} -Dio.netty.leakDetectionLevel=paranoid -Djava.awt.headless=true</argLine>
                     <excludes>
                         <exclude>**/*IntegrationTest.java</exclude>
                         <exclude>**/*IT.java</exclude>
diff --git a/graylog2-server/src/main/java/org/graylog/integrations/aws/transports/KinesisTransport.java b/graylog2-server/src/main/java/org/graylog/integrations/aws/transports/KinesisTransport.java
@@ -53,7 +53,7 @@
 import org.slf4j.LoggerFactory;
 import software.amazon.awssdk.regions.Region;
 
-import java.net.URL;
+import java.net.URI;
 import java.util.Locale;
 import java.util.Objects;
 import java.util.concurrent.ExecutorService;
@@ -166,7 +166,7 @@ public void doLaunch(MessageInput input, InputFailureRecorder inputFailureRecord
     static void validateEndpoint(String endpoint, String endpointName) throws MisfireException {
         if (StringUtils.isNotEmpty(endpoint)) {
             try {
-                new URL(endpoint).toURI();
+                var ignored = new URI(endpoint).toURL();
             } catch (Exception e) {
                 // Re-throw the exception to fail the input start attempt
                 throw new MisfireException(String.format(Locale.ROOT, "The specified [%s] Override Endpoint [%s] is invalid.",
diff --git a/graylog2-server/src/main/java/org/graylog/integrations/pagerduty/client/MessageFactory.java b/graylog2-server/src/main/java/org/graylog/integrations/pagerduty/client/MessageFactory.java
@@ -17,6 +17,7 @@
 package org.graylog.integrations.pagerduty.client;
 
 import com.google.common.collect.ImmutableList;
+import jakarta.inject.Inject;
 import org.apache.commons.lang3.StringUtils;
 import org.graylog.events.notifications.EventNotificationContext;
 import org.graylog.events.notifications.EventNotificationModelData;
@@ -30,10 +31,9 @@
 import org.graylog2.plugin.streams.Stream;
 import org.graylog2.streams.StreamService;
 
-import jakarta.inject.Inject;
-
 import java.net.MalformedURLException;
-import java.net.URL;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
@@ -121,8 +121,8 @@ private Link buildStreamWithUrl(Stream stream, EventNotificationContext ctx, Pag
             }
         }
         try {
-            return new Link(new URL(streamUrl), stream.getTitle());
-        } catch (MalformedURLException e) {
+            return new Link(new URI(streamUrl).toURL(), stream.getTitle());
+        } catch (URISyntaxException | MalformedURLException e) {
             throw new IllegalStateException("Error when building the stream link URL.", e);
         }
     }
diff --git a/graylog2-server/src/main/java/org/graylog2/alarmcallbacks/HTTPAlarmCallback.java b/graylog2-server/src/main/java/org/graylog2/alarmcallbacks/HTTPAlarmCallback.java
@@ -19,6 +19,7 @@
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.common.collect.Maps;
+import jakarta.inject.Inject;
 import okhttp3.HttpUrl;
 import okhttp3.MediaType;
 import okhttp3.OkHttpClient;
@@ -37,11 +38,10 @@
 import org.graylog2.plugin.streams.Stream;
 import org.graylog2.system.urlwhitelist.UrlWhitelistService;
 
-import jakarta.inject.Inject;
-
 import java.io.IOException;
 import java.net.MalformedURLException;
-import java.net.URL;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Map;
 
 import static com.google.common.base.Strings.isNullOrEmpty;
@@ -135,8 +135,8 @@ public void checkConfiguration() throws ConfigurationException {
         }
 
         try {
-            new URL(url);
-        } catch (MalformedURLException e) {
+            var ignored = new URI(url).toURL();
+        } catch (MalformedURLException | URISyntaxException | IllegalArgumentException e) {
             throw new ConfigurationException("Malformed URL '" + url + "'", e);
         }
 
diff --git a/graylog2-server/src/main/java/org/graylog2/inputs/transports/HttpPollTransport.java b/graylog2-server/src/main/java/org/graylog2/inputs/transports/HttpPollTransport.java
@@ -23,6 +23,7 @@
 import com.google.common.eventbus.Subscribe;
 import com.google.inject.assistedinject.Assisted;
 import com.google.inject.assistedinject.AssistedInject;
+import jakarta.inject.Named;
 import okhttp3.Headers;
 import okhttp3.MediaType;
 import okhttp3.OkHttpClient;
@@ -52,11 +53,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import jakarta.inject.Named;
-
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.net.URL;
 import java.util.Collections;
 import java.util.Map;
@@ -161,10 +162,10 @@ public void doLaunch(final MessageInput input, InputFailureRecorder inputFailure
         final InetSocketAddress remoteAddress;
         InetSocketAddress remoteAddress1;
         try {
-            final URL url1 = new URL(url);
+            final URL url1 = new URI(Objects.requireNonNull(url)).toURL();
             final int port = url1.getPort();
             remoteAddress1 = new InetSocketAddress(url1.getHost(), port != -1 ? port : 80);
-        } catch (MalformedURLException e) {
+        } catch (MalformedURLException | URISyntaxException e) {
             remoteAddress1 = null;
         }
         remoteAddress = remoteAddress1;
diff --git a/graylog2-server/src/main/java/org/graylog2/rest/ScrollChunkWriter.java b/graylog2-server/src/main/java/org/graylog2/rest/ScrollChunkWriter.java
@@ -17,18 +17,17 @@
 package org.graylog2.rest;
 
 import au.com.bytecode.opencsv.CSVWriter;
-import org.graylog2.indexer.results.ResultChunk;
-import org.graylog2.indexer.results.ResultMessage;
-import org.graylog2.plugin.Message;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.WebApplicationException;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.ext.MessageBodyWriter;
 import jakarta.ws.rs.ext.Provider;
+import org.graylog2.indexer.results.ResultChunk;
+import org.graylog2.indexer.results.ResultMessage;
+import org.graylog2.plugin.Message;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
 import java.io.OutputStream;
@@ -67,7 +66,7 @@ public void writeTo(ResultChunk scrollChunk,
                         MultivaluedMap<String, Object> httpHeaders,
                         OutputStream entityStream) throws IOException, WebApplicationException {
         if (LOG.isDebugEnabled()) {
-            LOG.debug("[{}] Writing chunk {}", Thread.currentThread().getId(), scrollChunk.chunkNumber());
+            LOG.debug("[{}] Writing chunk {}", Thread.currentThread().threadId(), scrollChunk.chunkNumber());
         }
 
         final List<String> fields = scrollChunk.fields();
diff --git a/graylog2-server/src/test/java/org/graylog/integrations/aws/transports/KinesisTransportTest.java b/graylog2-server/src/test/java/org/graylog/integrations/aws/transports/KinesisTransportTest.java
@@ -38,5 +38,10 @@ public void testValidateEndpoint() throws MisfireException {
                 .isExactlyInstanceOf(MisfireException.class)
                 .hasMessageContaining("Override Endpoint")
                 .hasMessageContaining("is invalid");
+
+        assertThatThrownBy(() -> KinesisTransport.validateEndpoint("unknown-scheme://graylog.org", "Graylog"))
+                .isExactlyInstanceOf(MisfireException.class)
+                .hasMessageContaining("Override Endpoint")
+                .hasMessageContaining("is invalid");
     }
-}
+}
diff --git a/graylog2-server/src/test/java/org/graylog2/shared/plugins/ChainingClassLoaderTest.java b/graylog2-server/src/test/java/org/graylog2/shared/plugins/ChainingClassLoaderTest.java
@@ -20,6 +20,7 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
+import java.net.URI;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.nio.charset.StandardCharsets;
@@ -104,7 +105,7 @@ public void getResourceReturnsNullIfResourceDoesNotExist() throws Exception {
     public void getResourceReturnsURLFromChildClassLoader() throws Exception {
         final ClassLoader parent = getClass().getClassLoader();
         final ClassLoader child = mock(ClassLoader.class);
-        final URL url = new URL("file://test");
+        final URL url = URI.create("file://test").toURL();
         when(child.getResource("name")).thenReturn(url);
 
         final ChainingClassLoader chainingClassLoader = new ChainingClassLoader(parent);
@@ -126,14 +127,14 @@ public void getResourcesReturnsEmptyEnumerationIfResourceDoesNotExist() throws E
     public void getResourcesReturnsEnumerationFromChildClassLoader() throws Exception {
         final ClassLoader parent = getClass().getClassLoader();
         final ClassLoader child = mock(ClassLoader.class);
-        final Enumeration<URL> urls = Collections.enumeration(Collections.singleton(new URL("file://test")));
+        final Enumeration<URL> urls = Collections.enumeration(Collections.singleton(URI.create("file://test").toURL()));
         when(child.getResources("name")).thenReturn(urls);
 
         final ChainingClassLoader chainingClassLoader = new ChainingClassLoader(parent);
         chainingClassLoader.addClassLoader(child);
 
         final Enumeration<URL> resources = chainingClassLoader.getResources("name");
-        assertThat(Collections.list(resources)).containsExactly(new URL("file://test"));
+        assertThat(Collections.list(resources)).containsExactly(URI.create("file://test").toURL());
     }
 
     @Test
@@ -166,4 +167,4 @@ public void addClassLoaderAddsClassLoaderToList() throws Exception {
 
     public static final class Dummy {
     }
-}
+}
diff --git a/graylog2-server/src/test/resources/org/graylog/testing/graylognode/Dockerfile b/graylog2-server/src/test/resources/org/graylog/testing/graylognode/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17-jre-jammy
+FROM eclipse-temurin:21-jre-jammy
 
 ARG GRAYLOG_VERSION
 ARG BUILD_DATE
diff --git a/pom.xml b/pom.xml
@@ -81,9 +81,9 @@
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-        <maven.compiler.release>17</maven.compiler.release>
-        <maven.compiler.source>17</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
+        <maven.compiler.release>21</maven.compiler.release>
+        <maven.compiler.source>21</maven.compiler.source>
+        <maven.compiler.target>21</maven.compiler.target>
         <maven.compiler.useIncrementalCompilation>false</maven.compiler.useIncrementalCompilation>
 
         <!-- This property will be overridden during the release to collect all artifacts in a central location. -->
@@ -794,7 +794,7 @@
                                     <version>[3.9.6,3.99.99]</version>
                                 </requireMavenVersion>
                                 <requireJavaVersion>
-                                    <version>[17.0,17.99]</version>
+                                    <version>[21.0,21.99]</version>
                                 </requireJavaVersion>
                                 <requireOS>
                                     <family>unix</family>
@@ -1000,7 +1000,6 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
-                    <release>17</release>
                     <showWarnings>true</showWarnings>
                     <showDeprecation>true</showDeprecation>
                     <forceJavacCompilerUse>true</forceJavacCompilerUse>

Original file line number	Diff line number	Diff line change
`@@ -235,7 +235,7 @@ private static ImageFromDockerfile createImage() {`
`235`	`235`
`236`	`236`	`return image.withDockerfileFromBuilder(builder ->`
`237`	`237`	`{`
`238`		`- final DockerfileBuilder fileBuilder = builder.from("eclipse-temurin:17-jre-jammy")`
	`238`	`+ final DockerfileBuilder fileBuilder = builder.from("eclipse-temurin:21-jre-jammy")`
`239`	`239`	`.workDir(IMAGE_WORKING_DIR)`
`240`	`240`	`.run("mkdir -p opensearch/config")`
`241`	`241`	`.run("mkdir -p opensearch/data")`