Update target JDK to 11 and move to JakartaEE 9

.github/workflows/build.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        java: [ '8', '11', '17', '21', '25' ]
+        java: [ '11', '17', '21', '25' ]
         os: [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ]
       fail-fast: false
     steps:
@@ -42,17 +42,18 @@ jobs:
           openig-war/target/*.war
           openig-docker/target/Dockerfile*
   build-docker:
+    needs: build-maven
     runs-on: 'ubuntu-latest'
     services:
       registry:
         image: registry:2
         ports:
           - 5000:5000
     steps:
-      - uses: actions/checkout@v4
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
         with:
-          fetch-depth: 0
-          submodules: recursive
+          name: ubuntu-latest-11
       - name: Get latest release version
         shell: bash
         run:   |
@@ -73,12 +74,15 @@ jobs:
         uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
+      - name: Prepare Dockerfile
+        shell: bash
+        run: sed -i -E '/^#COPY openig-war\//s/^#//' ./openig-docker/target/Dockerfile
       - name: Build image
         uses: docker/build-push-action@v5
         continue-on-error: true
         with:
-          context: ./openig-docker
-          file: ./openig-docker/Dockerfile
+          context: .
+          file: ./openig-docker/target/Dockerfile
           build-args: |
             VERSION=${{ env.release_version }}
           platforms: linux/amd64, linux/arm64, linux/ppc64le, linux/s390x
@@ -90,52 +94,3 @@ jobs:
         run: |
           docker run --rm -it -d --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
           timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'
-  build-docker-alpine:
-    runs-on: 'ubuntu-latest'
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: recursive
-      - name: Get latest release version
-        shell: bash
-        run:   |
-          export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenIG/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
-          echo "release_version=$git_version_last" >> $GITHUB_ENV
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            localhost:5000/${{ github.repository }}
-          tags: |
-            type=raw,value=alpine
-            type=raw,value=${{ env.release_version }}-alpine
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
-      - name: Build image
-        uses: docker/build-push-action@v5
-        continue-on-error: true
-        with:
-          context: ./openig-docker
-          file: ./openig-docker/Dockerfile-alpine
-          build-args: |
-            VERSION=${{ env.release_version }}
-          platforms: linux/amd64,linux/arm64/8, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6, linux/ppc64le
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-      - name: Docker test
-        shell: bash
-        run: |
-          docker run --rm -it -d --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}-alpine
-          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'

.github/workflows/deploy.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Java for publishing to Maven Central Repository OSS
         uses: actions/setup-java@v4
         with:
-          java-version: ${{ github.event.workflow_run.head_branch == 'release/6.0.0-SNAPSHOT' && '11' || '8'}}
+          java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/5.4.x' && '8' || '11'}}
           distribution: 'temurin'
           server-id: ossrh
           server-username: MAVEN_USERNAME

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Java for publishing to Maven Central Repository OSS
         uses: actions/setup-java@v4
         with:
-          java-version: '8'
+          java-version: '11'
           distribution: 'temurin'
           server-id: ossrh
           server-username: MAVEN_USERNAME
@@ -155,50 +155,4 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-  release-docker-alpine:
-    runs-on: 'ubuntu-latest'
-    needs:
-      - release-maven
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.releaseVersion }}
-          fetch-depth: 1
-          submodules: recursive
-      - name: Docker meta (alpine)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ github.repository }}
-            ghcr.io/${{ github.repository }}/${{ github.event.repository.name }}
-          tags: |
-            type=raw,value=alpine
-            type=raw,value=${{ github.event.inputs.releaseVersion }}-alpine
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push image
-        continue-on-error: true
-        uses: docker/build-push-action@v5
-        with:
-          context: ./openig-docker
-          file: ./openig-docker/Dockerfile-alpine
-          build-args: |
-            VERSION=${{ github.event.inputs.releaseVersion }}
-          platforms: linux/amd64,linux/arm64/8, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6, linux/ppc64le
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+

README.md

@@ -40,7 +40,7 @@ This project is licensed under the [Common Development and Distribution License
 * [OpenIG WAR](https://github.com/OpenIdentityPlatform/OpenIG/releases) (All OS)
 * [OpenIG Docker](https://hub.docker.com/r/openidentityplatform/openig/) (All OS)
 
-Java 1.8+ required
+Java 11 or later required
 
 ## How-to build
 For windows use:

SECURITY.md

@@ -5,15 +5,12 @@
 Use this section to tell people about which versions of your project are
 currently being supported with security updates.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
+| Version | Java Versions Support | EE         | Supported                                                                                                                                  |
+|---------|-----------------------|------------|--------------------------------------------------------------------------------------------------------------------------------------------|
+| 6.x     | 11 and later          | Jakarta EE | :white_check_mark: Community support, [approved vendor support](https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List) |
+| 5.1.x   | 8 and later           | Java EE    | :white_check_mark: [Approved vendor support](https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List)                    |
+| 5.0.x   | 8 and later           | Java EE    | :x:                                                                                                                                        |
 
 ## Reporting a Vulnerability
 
-Use this section to tell people how to report a vulnerability.
-
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+Please draft [security advisory](https://github.com/OpenIdentityPlatform/OpenIG/security/advisories/new)

contrib-http-framework/pom.xml

@@ -19,7 +19,7 @@
   <parent>
     <artifactId>openig-project</artifactId>
     <groupId>org.openidentityplatform.openig</groupId>
-    <version>5.4.1-SNAPSHOT</version>
+    <version>6.0.0-SNAPSHOT</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 

openig-core/pom.xml

@@ -14,13 +14,14 @@
 
   Copyright 2010-2011 ApexIdentity Inc.
   Portions Copyright 2011-2016 ForgeRock AS.
+  Portions copyright 2025 3A Systems LLC.
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
   <parent>
     <groupId>org.openidentityplatform.openig</groupId>
     <artifactId>openig-project</artifactId>
-    <version>5.4.1-SNAPSHOT</version>
+    <version>6.0.0-SNAPSHOT</version>
   </parent>
   <artifactId>openig-core</artifactId>
   <name>OpenIG Core library</name>
@@ -120,15 +121,20 @@
 <!-- 	    <version>2.0.1</version> -->
 <!-- 	</dependency> -->
     <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
+      <groupId>jakarta.servlet</groupId>
+      <artifactId>jakarta.servlet-api</artifactId>
       <scope>provided</scope>
     </dependency>
 	<dependency>
-	    <groupId>javax.websocket</groupId>
-	    <artifactId>javax.websocket-api</artifactId>
+	    <groupId>jakarta.websocket</groupId>
+	    <artifactId>jakarta.websocket-api</artifactId>
 	    <scope>provided</scope>
 	</dependency>
+    <dependency>
+      <groupId>jakarta.websocket</groupId>
+      <artifactId>jakarta.websocket-client-api</artifactId>
+      <scope>provided</scope>
+    </dependency>
 	<dependency>
 		<groupId>org.openidentityplatform.commons.http-framework</groupId>
   		<artifactId>servlet</artifactId>

openig-core/src/main/java/org/forgerock/openig/decoration/capture/MessageCapture.java

@@ -166,8 +166,8 @@ private static void captureContextAsJson(final PrintWriter writer, final Context
         if (context.containsContext(AttributesContext.class)) {
             AttributesContext attributesContext = context.asContext(AttributesContext.class);
             Map<String, Object> map = new LinkedHashMap<>(attributesContext.getAttributes());
-            map.remove("javax.servlet.http.HttpServletRequest");
-            map.remove("javax.servlet.http.HttpServletResponse");
+            map.remove("jakarta.servlet.http.HttpServletRequest");
+            map.remove("jakarta.servlet.http.HttpServletResponse");
             writer.println(prettyPrint(toJson(map)));
         }
     }

openig-core/src/main/java/org/openidentityplatform/openig/websocket/Configurator.java

@@ -1,11 +1,27 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2022-2025 3A Systems LLC.
+ */
+
 package org.openidentityplatform.openig.websocket;
 
 import java.util.List;
 
-import javax.websocket.Extension;
-import javax.websocket.HandshakeResponse;
-import javax.websocket.server.HandshakeRequest;
-import javax.websocket.server.ServerEndpointConfig;
+import jakarta.websocket.Extension;
+import jakarta.websocket.HandshakeResponse;
+import jakarta.websocket.server.HandshakeRequest;
+import jakarta.websocket.server.ServerEndpointConfig;
 
 public class Configurator extends ServerEndpointConfig.Configurator {
 

openig-core/src/main/java/org/openidentityplatform/openig/websocket/Filter.java

@@ -1,19 +1,35 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2022-2025 3A Systems LLC.
+ */
+
 package org.openidentityplatform.openig.websocket;
 
 
 import java.io.IOException;
 import java.security.Principal;
 import java.util.Enumeration;
 
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletRequestWrapper;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.forgerock.http.protocol.Request;
 import org.forgerock.http.protocol.Status;
@@ -28,7 +44,7 @@
 import org.slf4j.LoggerFactory;
 
 @WebFilter(urlPatterns = "/*")
-public class Filter implements javax.servlet.Filter {
+public class Filter implements jakarta.servlet.Filter {
 	private static final Logger logger = LoggerFactory.getLogger(Filter.class);
 
 	@Override