Java 25 support (#45872)

Closes #45905 Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-02-18 18:37:54 -05:00 · 2026-02-11 00:35:35 +01:00 · 2026-02-11 00:35:35 +01:00 · d45dfeb44a
commit d45dfeb44a
parent dd7302a3af
17 changed files with 65 additions and 20 deletions
--- a/.github/actions/integration-test-setup/action.yml
+++ b/.github/actions/integration-test-setup/action.yml
@ -9,7 +9,7 @@ inputs:
  jdk-version:
    description: JDK version
    required: false
-    default: "21"
+    default: "25"

 runs:
  using: composite
--- a/.github/actions/java-setup/action.yml
+++ b/.github/actions/java-setup/action.yml
@ -9,14 +9,14 @@ inputs:
  java-version:
    description: The Java version that is going to be set up.
    required: false
-    default: "21"
+    default: "25"

 runs:
  using: composite
  steps:
    - id: setup-java
      name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        distribution: ${{ inputs.distribution }}
        java-version: ${{ inputs.java-version }}
--- a/.github/scripts/ansible/roles/keycloak_remote_installer/README.md
+++ b/.github/scripts/ansible/roles/keycloak_remote_installer/README.md
@ -15,7 +15,7 @@ See `defaults/main.yml` for default values.
 ### Other
 - `update_system_packages`: Whether to update the system packages. Defaults to `no`.
 - `install_java`: Whether to install OpenJDK on the system. Defaults to `yes`.
- `java_version`: Version of OpenJDK to be installed. Defaults to `21`.
+- `java_version`: Version of OpenJDK to be installed. Defaults to `25`.


 ## Example Playbook
--- a/.github/scripts/ansible/roles/keycloak_remote_installer/defaults/main.yml
+++ b/.github/scripts/ansible/roles/keycloak_remote_installer/defaults/main.yml
@ -3,4 +3,4 @@ kc_home: /opt/keycloak
 m2_home: ~/.m2
 update_system_packages: no
 install_java: yes
-java_version: 21
+java_version: 25
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -162,6 +162,8 @@ jobs:
      - id: integration-test-setup
        name: Integration test setup
        uses: ./.github/actions/integration-test-setup
+        with:
+          jdk-version: '21'

      - name: Build adapter distributions
        run: ./mvnw install -DskipTests -f distribution/pom.xml
@ -193,6 +195,8 @@ jobs:
      - id: integration-test-setup
        name: Integration test setup
        uses: ./.github/actions/integration-test-setup
+        with:
+          jdk-version: '21'

      - name: Build adapter distributions
        run: ./mvnw install -DskipTests -f distribution/pom.xml
@ -302,7 +306,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, windows-latest]
        dist: [temurin]
-        version: [17, 25]
+        version: [17, 21]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    steps:
@ -1103,6 +1107,8 @@ jobs:
      - id: integration-test-setup
        name: Integration test setup
        uses: ./.github/actions/integration-test-setup
+        with:
+          jdk-version: 21 # Keycloak 24 is not compatible with Java 25+

      - name: Run Migration Tests
        run: |
--- a/distribution/maven-plugins/pom.xml
+++ b/distribution/maven-plugins/pom.xml
@ -32,7 +32,7 @@
        <dependency>
            <groupId>org.codehaus.groovy</groupId>
            <artifactId>groovy-all</artifactId>
-            <version>3.0.21</version>
+            <version>3.0.25</version>
            <type>pom</type>
        </dependency>
        <dependency>
--- a/docs/documentation/README.md
+++ b/docs/documentation/README.md
@ -46,7 +46,7 @@ To build the REST API documentation and the Javadoc:

 - Export the `JAVA_HOME` variable, for example:
  ```
-  export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
+  export JAVA_HOME=/usr/lib/jvm/java-25-openjdk
  ```
  (without this, you may get the following error: `Unable to find javadoc command: The environment variable JAVA_HOME is not correctly set.`)
 - Run:
--- a/docs/documentation/release_notes/topics/26_6_0.adoc
+++ b/docs/documentation/release_notes/topics/26_6_0.adoc
@ -31,3 +31,7 @@ You can specify these headers via the general parent option `telemetry-header-<h
 Or you can use the `telemetry-logs-header-<header>` for OpenTelemetry Logs, or `telemetry-metrics-header-<header>` for OpenTelemetry Metrics.

 For more details, see the  link:{telemetryguide_link}[{telemetryguide_name}] guide.
+
+= Java 25 support
+
+{project_name} now supports running with JRE 25.
--- a/docs/guides/getting-started/getting-started-zip.adoc
+++ b/docs/guides/getting-started/getting-started-zip.adoc
@ -13,7 +13,7 @@ summary="Get started with {project_name} on a physical or virtual server.">

 include::templates/hw-requirements.adoc[]

-Make sure you have https://openjdk.java.net/[OpenJDK 21] installed.
+Make sure you have https://openjdk.java.net/[OpenJDK 25] installed.

 == Download {project_name}

--- a/docs/guides/observability/partials/jgrp_metrics.adoc
+++ b/docs/guides/observability/partials/jgrp_metrics.adoc
@ -85,7 +85,7 @@ A retransmission mechanism ensures a reliable communication with an increase of

 TIP: In a healthy cluster, the thread pool should never be closer to its maximum size (by default, `200` threads).

-NOTE: Thread pool metrics are not available with virtual threads. Virtual threads are enabled by default when running with OpenJDK 21.
+NOTE: Thread pool metrics are not available with virtual threads. Virtual threads are enabled by default when running with OpenJDK 21 and later.

 IMPORTANT: The metric name depends on the JGroups transport protocol in use. The default transport protocol is TCP.

--- a/operator/pom.xml
+++ b/operator/pom.xml
@ -271,6 +271,17 @@
                </executions>
            </plugin>

+
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <compilerArgs>
+                        <arg>-proc:full</arg> <!-- adding sundrio to annotationProcessorPaths doesn't play well with Fabric8 -->
+                    </compilerArgs>
+                </configuration>
+            </plugin>
+
            <plugin>
                <artifactId>maven-surefire-plugin</artifactId>
                <executions>
--- a/quarkus/dist/src/main/content/bin/kc.bat
+++ b/quarkus/dist/src/main/content/bin/kc.bat
@ -129,10 +129,12 @@ if not "x%JAVA_OPTS%" == "x" (
 )

@REM See also https://github.com/wildfly/wildfly-core/blob/7e5624cf92ebe4b64a4793a8c0b2a340c0d6d363/core-feature-pack/common/src/main/resources/content/bin/common.sh#L57-L60
+@REM java.base/java.lang=ALL-UNNAMED is required for JBoss Threads, see e.g. https://github.com/quarkusio/quarkus/pull/47637 and relevant https://github.com/quarkusio/quarkus/discussions/51041
+@REM --enable-native-access=ALL-UNNAMED is required for Infinispan: https://github.com/infinispan/infinispan/issues/15765#issuecomment-3839985807
 if not "x%JAVA_ADD_OPENS%" == "x" (
    echo "JAVA_ADD_OPENS already set in environment; overriding default settings"
 ) else (
-    set "JAVA_ADD_OPENS=--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED"
+    set "JAVA_ADD_OPENS=--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --enable-native-access=ALL-UNNAMED"
 )
 set "JAVA_OPTS=%JAVA_OPTS% %JAVA_ADD_OPENS%"

--- a/quarkus/dist/src/main/content/bin/kc.sh
+++ b/quarkus/dist/src/main/content/bin/kc.sh
@ -112,8 +112,10 @@ else
 fi

 # See also https://github.com/wildfly/wildfly-core/blob/7e5624cf92ebe4b64a4793a8c0b2a340c0d6d363/core-feature-pack/common/src/main/resources/content/bin/common.sh#L57-L60
+# java.base/java.lang=ALL-UNNAMED is required for JBoss Threads, see e.g. https://github.com/quarkusio/quarkus/pull/47637 and relevant https://github.com/quarkusio/quarkus/discussions/51041
+# --enable-native-access=ALL-UNNAMED is required for Infinispan: https://github.com/infinispan/infinispan/issues/15765#issuecomment-3839985807
 if [ -z "$JAVA_ADD_OPENS" ]; then
-   JAVA_ADD_OPENS="--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED"
+   JAVA_ADD_OPENS="--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --enable-native-access=ALL-UNNAMED"
 else
   echo "JAVA_ADD_OPENS already set in environment; overriding default settings"
 fi
--- a/testsuite/integration-arquillian/pom.xml
+++ b/testsuite/integration-arquillian/pom.xml
@ -56,7 +56,6 @@
        <version.org.wildfly.extras.creaper>2.0.3</version.org.wildfly.extras.creaper>
        <jakarta.persistence-legacy.version>2.2.3</jakarta.persistence-legacy.version>
        <commons.validator.version>1.8.0</commons.validator.version>
-        <byte-buddy.version>1.14.13</byte-buddy.version>

        <!--migration properties-->
        <migration.70.version>1.9.8.Final</migration.70.version>
--- a/testsuite/integration-arquillian/tests/base/pom.xml
+++ b/testsuite/integration-arquillian/tests/base/pom.xml
@ -755,7 +755,6 @@
                <dependency>
                    <groupId>net.bytebuddy</groupId>
                    <artifactId>byte-buddy</artifactId>
-                    <version>${byte-buddy.version}</version>
                </dependency>
            </dependencies>
        </profile>
--- a/testsuite/integration-arquillian/tests/pom.xml
+++ b/testsuite/integration-arquillian/tests/pom.xml
@ -1493,7 +1493,6 @@
                <dependency>
                    <groupId>net.bytebuddy</groupId>
                    <artifactId>byte-buddy</artifactId>
-                    <version>${byte-buddy.version}</version>
                </dependency>

                <dependency>
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/infinispan/CacheExpirationTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/infinispan/CacheExpirationTest.java
@ -17,9 +17,10 @@
 package org.keycloak.testsuite.model.infinispan;

 import java.io.BufferedReader;
-import java.io.IOException;
 import java.io.InputStreamReader;
 import java.lang.management.ManagementFactory;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.time.Instant;
 import java.util.Collections;
 import java.util.Objects;
@ -143,12 +144,26 @@ public class CacheExpirationTest extends KeycloakModelTest {
    // This is synchronized as it doesn't make sense to run this in parallel with multiple threads
    // as each invocation will run a garbage collection anyway.
    public synchronized Integer getNumberOfInstancesOfClass(Class<?> c, String pid) {
-        Process proc;
+        log.debug("PID: " + pid);
+
+        Path tempFile = null;
        try {
            // running jmap command will also trigger a garbage collection on the VM, but that might be VM specific
            // a test run with adding "-verbose:gc" showed the message "GC(23) Pause Full (Heap Inspection Initiated GC)" that
            // indicates a full GC run
-            proc = Runtime.getRuntime().exec("jmap -histo:live " + pid);
+
+            tempFile = Files.createTempFile("jmap-output", ".txt"); // not consuming the output directly to avoid potential deadlock
+
+            Process proc = new ProcessBuilder("jmap", "-histo:live", pid)
+                    .redirectOutput(tempFile.toFile())
+                    .redirectError(ProcessBuilder.Redirect.INHERIT)
+                    .start();
+
+            boolean finished = proc.waitFor(30, TimeUnit.SECONDS);
+            if (!finished) {
+                proc.destroyForcibly();
+                throw new RuntimeException("jmap timed out!");
+            }

            try (BufferedReader stdInput = new BufferedReader(new InputStreamReader(proc.getInputStream()))) {
                AtomicInteger matchingLines = new AtomicInteger();
@ -165,10 +180,18 @@ public class CacheExpirationTest extends KeycloakModelTest {
                  .map(m -> Integer.valueOf(m.group(1)))
                    .orElseGet(() -> matchingLines.get() == 0 ? null : 0);
            }
-        } catch (IOException ex) {
+        } catch (Exception ex) {
            log.debug(ex);
-            Assume.assumeTrue("jmap not found or unsupported", false);
+            Assume.assumeTrue("jmap not found, unsupported or failed", false);
            return null;
+        } finally {
+            if (tempFile != null) {
+                try {
+                    Files.deleteIfExists(tempFile);
+                } catch (Exception ex) {
+                    log.debug(ex);
+                }
+            }
        }
    }
 }