8000 jdk: current LTS (meta over jdk-25); add jdk-25 (Temurin 25) and jdk-21 (Temurin 21) by bryan-minimal · Pull Request #897 · gominimal/pkgs · GitHub
[go: up one dir, main page]

Skip to content

jdk: current LTS (meta over jdk-25); add jdk-25 (Temurin 25) and jdk-21 (Temurin 21) - #897

Merged
bryan-minimal merged 4 commits into
mainfrom
jdk-25-temurin
Oct 16, 2026
Merged

bryan-minimal merged 4 commits into
mainfrom
jdk-25-temurin

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Oct 16, 2026 •
Copy link
Copy Markdown
Member

Why

A user asked for a current JDK: jdk was Eclipse Temurin 21, the previous LTS. This makes jdk the current LTS (25) and adds explicit versioned lines, so projects can pin.

Layout after this PR

package what notes
jdk-25 Temurin 25.0.4.1+1 (current LTS) new; copied from the Temurin 21 recipe with every 21-specific value changed (repo, assets, version/build, per-arch sha256 from Adoptium's .sha256.txt, the version test)
jdk-21 Temurin 21.0.12.1+1 (previous LTS) today's jdk recipe, renamed and otherwise unchanged
jdk meta-package → jdk-25 same shape as toolchain (build_deps = [], runtime_deps = [jdk-25], outputs = {}), so it always means the current LTS with no second copy of the binaries

jdk-26 is deliberately absent: OpenJDK 26 reached end of life when 27 shipped in September, so it gets no more updates. The current feature line, jdk-27 (Temurin jdk-27+35), would come as a follow-up.

Impact: jdk's dependents move from Java 21 to 25

dependent version in pkgs Java 25
gradle 9.7.0 supported since 9.1
ghidra 12.1.4 needs 21+
jdtls 1.60.0 needs 21+
maven 3.9.16 (3.10.0 in #896) ✓
tlaplus 1.7.4 ✓
android-sdk cmdline-tools 11076708 ✓

Only android-sdk uses jdk as a build dependency. The toolchain-style meta-package covers it, since toolchain is a build dependency across the fleet. The buildbot rebuilds all six; any that dislikes 25 can depend on jdk-21 explicitly.

Version tracking and CVEs

  • jdk-25 and jdk-21 keep Temurin provenance (adoptium/temurin{25,21}-binaries). pkgmgr reads Temurin's jdk-X+N tags (sc#502) and rewrites build_num alongside version.
  • The jdk meta-package has no version of its own; its updates arrive through jdk-25.
  • CVE identity: oracle:jdk / oracle:jre for jdk-25 and jdk-21, added in minimal-supply-chain#513. Measured on prod: 24 advisories each name 25.x. The existing jdk entry stays until this merges, so there's no coverage gap in either merge order.

🤖 Generated with Claude Code

… 21)

A user asked for a current JDK: `jdk` is Temurin 21, the previous LTS.
Add Temurin 25.0.4.1+1 (adoptium/temurin25-binaries, 2026-08-19) as its
own package so projects choose a line explicitly and `jdk` doesn't move
under anyone. Copied from packages/jdk with every 21-specific value
changed (repo, asset prefix, version/build, per-arch sha256 from
Adoptium's published .sha256.txt, the java -version test).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner October 16, 2026 19:48
@coderabbitai
coderabbitai Bot commented Oct 16, 2026 •
Copy link
Copy Markdown
Contributor

Review in Change Stack →

Warning

Review limit reached

  • Run on-demand review

This review includes 7 billable files and costs up to $1.75.

  • Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 8 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 57 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: 892a2c5e-f38c-4269-afd2-de3366d1ca1f
📥 Commits

Reviewing files that changed from the base of the PR and between 57625a5 and a1e0560.

📒 Files selected for processing: 7
  • packages/jdk-21/build.ncl
  • packages/jdk-21/build.sh
  • packages/jdk-25/build.ncl
  • packages/jdk-25/build.sh
  • packages/jdk/build.ncl
  • stacks/gradle/stack.ncl
  • stacks/maven/stack.ncl
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

…dk-21

`jdk` becomes a meta-package over jdk-25, the same shape as `toolchain`
(build_deps = [], runtime_deps = [jdk-25], outputs = {}), so it always
names the current Java LTS without a second copy of the binaries. The
Temurin 21 recipe moves, unchanged apart from its name, to jdk-21 for
projects pinned to 21.

`jdk`'s six dependents (android-sdk, ghidra, gradle, jdtls, maven,
tlaplus) move from Java 21 to 25; each version in pkgs supports 25
(gradle 9.7, ghidra 12.1, jdtls 1.60, maven 3.9.16, tlaplus 1.7.4,
android cmdline-tools). Only android-sdk uses jdk as a build dep, which
the toolchain-style meta closure covers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal bryan-minimal changed the title jdk-25: Eclipse Temurin 25 (current Java LTS), alongside jdk (Temurin 21) jdk: current LTS (meta over jdk-25); add jdk-25 (Temurin 25) and jdk-21 (Temurin 21) Oct 16, 2026
@bryan-minimal
Copy link
Copy Markdown
Member Author

/build

@bryan-minimal
Copy link
Copy Markdown
Member Author

How this attaches to #775 (the from-source JVM ladder).

#897 restructures the JDK names so the ladder can slot in later without touching dependents:

  • jdk becomes a meta-package over jdk-25, the same shape as toolchain. Dependents (maven, gradle, jdtls, ghidra, tlaplus, android-sdk) name jdk or a versioned line, never an implementation.
  • jdk-21 and jdk-25 are Temurin binaries today. When jvm: bootstrap OpenJDK from source (jikes/jamvm/classpath root, icedtea, openjdk-9..25) #775 lands, jdk-25 (and jdk-21) can switch to the ladder's openjdk-25 / openjdk-21 rungs behind the same names. That swap is one recipe each, and the meta-package and dependents don't change.

What the swap needs from #775 first:

  1. Current updates on 8000 the user-facing rungs. The rungs build GA tarballs (openjdk-21 = 21.0.2, openjdk-25 = 25.0.2), which is fine for booting the next rung. Temurin ships 21.0.12.1 and 25.0.4.1, so a user-facing from-source JDK needs either an update rung on top of each GA rung or the rung moved to the current jdkNNu tag. Otherwise the swap is a security regression.
  2. CA certificates. Temurin bundles lib/security/cacerts; a from-source build needs it generated from our ca-certificates.
  3. Version check and CVE identity. Provenance would become openjdk/jdk25u tags (jdk-25.0.4+N) instead of adoptium/temurin25-binaries; the oracle:jdk / oracle:jre CPE identity (minimal-supply-chain#513) carries over unchanged.
  4. A rung for 27, for jdk-27. The template generator makes it mechanical: booted from 25 or 26, per OpenJDK's boot-JDK rule (N-1 or N).

🤖 Generated with Claude Code

jdb, jcmd, jfr, jstack, jmap, javap, jdeps, javadoc and the rest lived
only under /usr/lib/jvm/bin. Link everything in the JDK's bin/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
Copy link
Copy Markdown
Member Author

/build

- maven and gradle stacks name `jdk-25` instead of the `jdk` meta, so a
  project's Java doesn't move when `jdk` next rolls to a new LTS.
  jdk-25 installs to /usr/lib/jvm, so JAVA_HOME is unchanged.
- gradle also matches build.gradle.kts / settings.gradle.kts (the
  `gradle init` default since Gradle 8.2); Kotlin-DSL projects got no
  Java stack at all before.

Both evaluate against the stdlib Stack contract (nickel export).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal

Copy link
Copy Markdown
Member Author

/build

bryan-minimal added a commit that referenced this pull request Oct 16, 2026
All three Java stacks now name jdk-25 (pkgs#897) rather than the `jdk`
meta, so a project's Java doesn't move when `jdk` rolls to the next LTS.
The header's `$JAVA_HOME/bin/jdb` is plain `jdb` now that #897/#898 link
every JDK tool into /usr/bin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 16, 2026
Merged via the queue into main with commit 1881d17 Oct 16, 2026
11 checks passed
@bryan-minimal
bryan-minimal deleted the jdk-25-temurin branch October 16, 2026 21:38
evanspearman pushed a commit to evanspearman/pkgs that referenced this pull request Oct 20, 2026
* Add jdk-27 (Eclipse Temurin 27)

Temurin 27 GA (jdk-27+35, 2026-09-21), the current Java feature release,
as its own package alongside `jdk`. Same shape as jdk-25 in gominimal#897.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* jdk-27: link every JDK tool into /usr/bin, not just eight

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

0