Merge pull request #2279 from OWASP/copilot/upgrade-java-to-25

commjoen · web-flow · commit ad556f8a18bd · 2025-10-07T06:03:38.000+02:00
Upgrade to Java 25
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -65,10 +65,10 @@ jobs:
       #- run: |
       #   make bootstrap
       #   make release
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
       - name: run mvn clean package
         run: ./mvnw clean package -Ddependency-check.skip=true -Dmaven.test.skip=true
diff --git a/.github/workflows/container_test.yml b/.github/workflows/container_test.yml
@@ -19,10 +19,10 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v5
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
       - name: Navigate to test script and run
diff --git a/.github/workflows/dast-zap-test.yml b/.github/workflows/dast-zap-test.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
       - name: Clean install
         run: ./mvnw --no-transfer-progress clean install -DskipTests -Ddependency-check.skip -Dcyclonedx.skip=true -Dexec.skip
diff --git a/.github/workflows/desktop-container-publish.yml b/.github/workflows/desktop-container-publish.yml
@@ -26,10 +26,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
diff --git a/.github/workflows/github-pages-preview.yml b/.github/workflows/github-pages-preview.yml
@@ -33,10 +33,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
diff --git a/.github/workflows/java_swagger_doc.yml b/.github/workflows/java_swagger_doc.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
       - name: Clean install
         run: ./mvnw --no-transfer-progress clean install -DskipTests -Ddependency-check.skip -Dcyclonedx.skip=true -Dexec.skip
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
       - name: checkstyle with Maven
@@ -39,10 +39,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
       - name: spotbugs with Maven
@@ -55,10 +55,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v5
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
       - name: Test with Maven
diff --git a/.github/workflows/master-container-publish.yml b/.github/workflows/master-container-publish.yml
@@ -17,10 +17,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
@@ -25,10 +25,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
@@ -245,10 +245,10 @@ jobs:
           ref: master
           path: main-code
 
-      - name: Set up JDK 23 for PR build
+      - name: Set up JDK 25 for PR build
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
@@ -274,10 +274,10 @@ jobs:
           docker build --build-arg argBasedVersion="${{ steps.extract-pr-version.outputs.docker_version }}" -t wrongsecrets-pr .
           echo "PR Docker image built successfully"
 
-      - name: Set up JDK 23 for main
+      - name: Set up JDK 25 for main
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
-          java-version: "23"
+          java-version: "25"
       - name: Install npm dependencies
         run: npm install
       - uses: actions/cache@v4
diff --git a/.github/workflows/version-sync-check.yml b/.github/workflows/version-sync-check.yml
@@ -16,10 +16,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up JDK 23
+      - name: Set up JDK 25
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
diff --git a/.github/workflows/visual-diff.yml b/.github/workflows/visual-diff.yml
@@ -21,10 +21,10 @@ jobs:
           ref: master
           path: main-code
 
-      - name: Set up JDK 23 for PR build
+      - name: Set up JDK 25 for PR build
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
@@ -49,10 +49,10 @@ jobs:
           docker build --build-arg argBasedVersion="${{ steps.extract-pr-version.outputs.docker_version }}" -t wrongsecrets-pr .
           echo "PR Docker image built successfully"
 
-      - name: Set up JDK 23 for main build
+      - name: Set up JDK 25 for main build
         uses: actions/setup-java@v5
         with:
-          java-version: "23"
+          java-version: "25"
           distribution: "temurin"
           cache: "maven"
 
diff --git a/.lycheeignore b/.lycheeignore
@@ -24,3 +24,9 @@ https://github.com/OWASP/www-project-wrongsecrets*
 https://developer.hashicorp.com/*
 https://learn.hashicorp.com/*
 https://www.vaultproject.io/*
+
+# Oracle Java downloads page may not have Java 25 anchor yet
+https://www.oracle.com/java/technologies/downloads/#java25
+
+# jdk.java.net may be rate-limited and cause 429 errors
+https://jdk.java.net/25/
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -233,8 +233,8 @@ Please be sure to take a careful look at our [Code of Conduct](https://github.co
 2. **Node.Js 24**
    [_Node.Js_](https://nodejs.org/en/) is an open-source library and a cross-platform JavaScript **runtime environment** specifically for running web applications outside one's browser.
 
-3. **JDK-23**
-   [_JDK_](https://www.oracle.com/java/technologies/downloads/#java23) is a tool used in development and testing programs written in the Java programming language.
+3. **JDK-25**
+   [_JDK_](https://www.oracle.com/java/technologies/downloads/#java25) is a tool used in development and testing programs written in the Java programming language.
 
 4. **IntelliJ IDEA**
    [_IntelliJ IDEA_](https://www.jetbrains.com/idea/download) is an integrated development environment basically an **IDE** written in Java for developing software written in Java, Kotlin, Groovy etc.
@@ -300,9 +300,9 @@ Select **_google-java-format Settings_** and click enable.
 
 Open **_File > Project structure _**.
 
-In the tab `Project` make sure that an SDK of version `23` is selected (e.g. `openjdk-23`, `oraclejdk-23` or just `23` depending on which Java JDK variant you installed).
+In the tab `Project` make sure that an SDK of version `25` is selected (e.g. `openjdk-25`, `oraclejdk-25` or just `25` depending on which Java JDK variant you installed).
 
-In the tab `SDKs` make sure that an SDK of version `23` is selected.
+In the tab `SDKs` make sure that an SDK of version `25` is selected.
 
 
 ### Step 6: Reload the project
diff --git a/Dockerfile b/Dockerfile
@@ -1,12 +1,12 @@
-FROM bellsoft/liberica-openjre-debian:23.0.2-9-cds AS builder
+FROM bellsoft/liberica-openjre-debian:25-cds AS builder
 WORKDIR /builder
 
 ARG argBasedVersion="1.12.8"
 
 COPY --chown=wrongsecrets target/wrongsecrets-${argBasedVersion}-SNAPSHOT.jar application.jar
 RUN java -Djarmode=tools -jar application.jar extract --layers --destination extracted
 
-FROM eclipse-temurin:23.0.2_7-jre-alpine-3.21
+FROM eclipse-temurin:25-jre-alpine
 WORKDIR /application
 
 ARG argBasedPassword="default"
diff --git a/README.md b/README.md
@@ -638,11 +638,11 @@ See [Dependency-Check Maven Plugin Documentation](https://jeremylong.github.io/D
 
 ### Get the project started in IntelliJ IDEA
 
-Requirements: make sure you have the following tools installed: [Docker](https://www.docker.com/products/docker-desktop/), [Java23 JDK](https://jdk.java.net/23/), [NodeJS 24](https://nodejs.org/en/download/current) and [IntelliJ IDEA](https://www.jetbrains.com/idea/download).
+Requirements: make sure you have the following tools installed: [Docker](https://www.docker.com/products/docker-desktop/), [Java25 JDK](https://jdk.java.net/25/), [NodeJS 24](https://nodejs.org/en/download/current) and [IntelliJ IDEA](https://www.jetbrains.com/idea/download).
 
 1. Fork and clone the project as described in the [documentation](https://github.com/OWASP/wrongsecrets/blob/master/CONTRIBUTING.md).
 2. Import the project in IntelliJ (e.g. import as mvn project / local sources)
-3. Go to the project settings and make sure it uses Java23 (And that the JDK can be found)
+3. Go to the project settings and make sure it uses Java25 (And that the JDK can be found)
 4. Go to the IDE settings>Language & Frameworks > Lombok and make sure Lombok processing is enabled
 5. Open the Maven Tab in your IDEA and run "Reload All Maven Projects" to make the system sync and download everything. Next, in that same tab use the "install" option as part of the OWASP WrongSecrets Lifecycle to genereate the asciidoc and such.
 6. Now run the `main` method in `org.owasp.wrongsecrets.WrongSecretsApplication.java`. This should fail with a stack trace.
@@ -774,7 +774,7 @@ If you want to run WrongSecrets but without certain challenges you don't want to
 *_NOTE_* Please note that we do not deliver any support to your fork when you follow the process below. Please understand that license and copyright of the original application remain intact for your Fork.
 
 Requirements:
-- Have the JDK of Java 22 installed;
+- Have the JDK of Java 25 installed;
 - Have an account at a registry to which you can push your variant of the WrongSecrets container;
 
 Here are the steps you have to follow to create your own release of WrongSecrets with certain challenges disabled:
diff --git a/pom.xml b/pom.xml
@@ -57,13 +57,13 @@
     <gcp.sdk.version>7.3.2</gcp.sdk.version>
     <github.button.version>2.14.1</github.button.version>
     <io.netty.version>4.1.118.Final</io.netty.version>
-    <java.version>23</java.version>
+    <java.version>25</java.version>
     <jquery.version>3.7.1</jquery.version>
     <jruby.version>10.0.2.0</jruby.version>
     <lombok.version>1.18.42</lombok.version>
     <maven-compiler-plugin.version>3.14.1</maven-compiler-plugin.version>
     <maven.compiler.proc>full</maven.compiler.proc>
-    <maven.compiler.target>23</maven.compiler.target>
+    <maven.compiler.target>25</maven.compiler.target>
     <spring.cloud-version>2025.0.0</spring.cloud-version>
     <spring.security.version>6.2.3</spring.security.version>
     <system-stubs-jupiter.version>2.1.8</system-stubs-jupiter.version>
