8000 Update jdk-25 to 25.0.5 by bryan-minimal · Pull Request #1138 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update jdk-25 to 25.0.5 - #1138

Merged
bryan-minimal merged 1 commit into
mainfrom
bryan/jdk-25-oct-cpu
Oct 28, 2026
Merged

Update jdk-25 to 25.0.5#1138
bryan-minimal merged 1 commit into
mainfrom
bryan/jdk-25-oct-cpu

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Oct 27, 2026
Copy link
Copy Markdown
Member

SECURITY: Eclipse Temurin 25.0.5+8 (released 2026-10-22), the October 2026 Critical Patch Update for the 25 line. Today's jdk-25 is 25.0.4.1.

Why: Oracle's October CPU (https://www.oracle.com/security-alerts/cpuoct2026.html) lists 25.0.4.1 by exact version as affected. Our vuln DB holds 38 "Oracle Java SE" CVE records from the Oracle CNA that say so. NVD still has every one at Awaiting Analysis with no CPE, so the scanner reports jdk-25 as clean. The pkgmgr nightly found 25.0.5 but didn't open a PR; the reason is in the pkgmgr report.

Change: version, build_num and both sha256 values in packages/jdk-25/build.ncl. The tag jdk-25.0.5+8, the asset names and the top directory jdk-25.0.5+8/ all follow the existing template, so build.sh is unchanged.

arch asset sha256
amd64 OpenJDK25U-jdk_x64_linux_hotspot_25.0.5_8.tar.gz 68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb
arm64 OpenJDK25U-jdk_aarch64_linux_hotspot_25.0.5_8.tar.gz bb5b2ded252f21c6090cf780b0a408ad0d83bbb557e702955643557f13231880

Each sum matches three sources: api.adoptium.net/v3/assets/latest/25/hotspot, the release's .sha256.txt, and shasum of a fresh download.

CVE-2026-111943 (pkgs#949): still applied, with no change. I extracted the new x64 image and checked it. Its stock lib/security/blocked.certs has 38 entries and none of our 48 eMudhra fingerprints, so the check pre phase still sees the fixtures validate and the step still appends all 48. release reports IMPLEMENTOR_VERSION="Temurin-25.0.5+8" and JAVA_VERSION_DATE="2026-10-20".

Tests: java_version, javac_compile and cve_2026_111943 are unchanged and run on the build-bot. Nothing was built locally.

Overlaps draft #913 (jdk-21/25/27 from source), which pins 25.0.4.1. That draft needs a rebase onto this change, or its own bump to the jdk25u jdk-25.0.5-ga tag.

🤖 Generated with Claude Code

@bryan-minimal @claude
Update jdk-25 to 25.0.5 (Temurin 25.0.5+8, October 2026 CPU)
38b6f73 
Eclipse Temurin 25.0.5+8 (2026-10-22), the October 2026 Critical Patch
Update for the current LTS. Oracle's CPU names 25.0.4.1 (what we ship) as
affected by ~38 CVEs. sha256 sums are Adoptium's published ones for both
arches (API, release .sha256.txt and a local download all agree).

The CVE-2026-111943 step is unchanged: the new image's stock
blocked.certs holds none of the 48 eMudhra fingerprints, so the `pre`
check still validates and the step still appends all 48.

`jdk` (the meta-package) follows jdk-25, so its consumers (maven,
gradle, kotlin, ...) rebuild.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner October 27, 2026 23:58
@coderabbitai
coderabbitai Bot commented Oct 27, 2026
Copy link
Copy Markdown
Contributor

Warning

Review limit reached

  • Run on-demand review

This review includes 1 billable file and costs up to $0.25.

  • Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 23 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

Run configuration
Commits

Reviewing files that changed from the base of the PR and between f6d23bb and 38b6f73.

Files selected for processing: 1
  • packages/jdk-25/build.ncl
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

mitodrummer
mitodrummer approved these changes Oct 28, 2026
View reviewed 8000 changes
@mitodrummer mitodrummer left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked both sha256s against the asset digests on adoptium/temurin25-binaries jdk-25.0.5+8 (x64 and aarch64 linux hotspot tarballs); they match. The URL pattern, the java_version test and the CVE-2026-111943 step are unchanged, and minimal build passed with jdk-25 and its 30 rebuilt dependents testing green on both arches.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 28, 2026
Merged via the queue into main with commit b0acb06 Oct 28, 2026
12 checks passed
@bryan-minimal
bryan-minimal deleted the bryan/jdk-25-oct-cpu branch October 28, 2026 20:06
bryan-minimal added a commit that referenced this pull request Oct 29, 2026
@bryan-minimal @claude
jdk-21 21.0.13, jdk-25 25.0.5: the October CPU, from the jdk21u/jdk25…
445288a 
…u ga tags

Merges main's Temurin bumps (#1137, #1138) into the from-source recipes: same versions
and build numbers, sources mirrored to staging-archives.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@norrietaylor norrietaylor mentioned this pull request Nov 4, 2026
Merged
@msample msample mentioned this pull request Nov 5, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mitodrummer mitodrummer mitodrummer approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bryan-minimal @mitodrummer
0