Skip to content

Upgrade to Java 21 #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Upgrade to Java 21 #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f02b67b
Build: target Java 21 toolchain and pin/bump Maven plugins
devin-ai-integration[bot] Jun 17, 2026
2e40954
Bump container base images to Java 21 (eclipse-temurin)
devin-ai-integration[bot] Jun 17, 2026
5892f17
Merge Task A: Java 21 build configuration (pom.xml) into migration br…
devin-ai-integration[bot] Jun 17, 2026
afd7300
Merge Task B: Dockerfiles to Java 21 base images into migration branch
devin-ai-integration[bot] Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM openjdk:8-jre-alpine
FROM eclipse-temurin:21-jre-alpine

WORKDIR /swagger-petstore

Expand Down
2 changes: 1 addition & 1 deletion Dockerfile-telemetry
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM openjdk:11-jre-slim
FROM eclipse-temurin:21-jre

WORKDIR /swagger-petstore

Expand Down
15 changes: 10 additions & 5 deletions pom.xml
View file
Open in desktop

@devin-ai-integration devin-ai-integration Bot Jun 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚩 swagger-inflector 2.0.11 depends on javax.servlet which may conflict with Java 21

The swagger-inflector at version 2.0.11 (pom.xml:255) is built on the javax.servlet API. While the servlet API is bundled by Jetty/the WAR container (not the JDK), a future upgrade of Jetty to 11+ or 12 would require migrating to jakarta.servlet, which would in turn require a newer swagger-inflector or a different framework. This dependency chain makes the Jetty upgrade (needed for Java 21 compat) non-trivial.

(Refers to line 255)

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Jun 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed on the analysis, and this is exactly why the PR intentionally stays on javax. swagger-inflector 2.0.11 is javax.servlet/javax.ws.rs-only with no jakarta release, so the whole servlet stack (inflector + Jersey + Jetty) has to move together — which would mean replacing the core framework, not just bumping a dependency. That's a separate migration, out of scope for a Java-version upgrade.

For Java 21 specifically it isn't required: the javax servlet stack on Jetty 9.4.53 builds and runs on JDK 21 (verified — see the runtime test in the sibling thread). The Java-EE modules that were actually removed from the JDK (JAXB) are already provided as explicit javax.xml.bind / com.sun.xml.bind deps, so nothing is missing at runtime. Leaving this as a documented known follow-up rather than expanding this PR's scope.

Original file line number Diff line number Diff line change
Expand Up @@ -39,18 +39,22 @@
<directory>target</directory>
<finalName>${project.artifactId}-${project.version}</finalName>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-war-plugin</artifactId>
<version>3.4.0</version>
</plugin>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.11.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>build-helper-maven-plugin</artifactId>
<version>1.12</version>
<version>3.6.0</version>
<executions>
<execution>
<id>add-source</id>
Expand Down Expand Up @@ -92,7 +96,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>2.6</version>
<version>3.4.1</version>
<configuration>
<excludes>
<exclude>**/logback.xml</exclude>
Expand Down Expand Up @@ -149,7 +153,7 @@
</plugin>
<plugin>
<artifactId>maven-resources-plugin</artifactId>
<version>2.4.3</version>
<version>3.3.1</version>
<executions>
<execution>
<id>copy-resources</id>
Expand Down Expand Up @@ -244,6 +248,7 @@
</dependencies>
<properties>
<maven-plugin-version>1.0.0</maven-plugin-version>
<maven.compiler.release>21</maven.compiler.release>
<swagger-parser-version>2.1.21</swagger-parser-version>
<swagger-core-version>2.2.17</swagger-core-version>
<jackson-version>2.16.1</jackson-version>
Comment on lines +251 to 254

@devin-ai-integration devin-ai-integration Bot Jun 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Jetty 9.4 is not supported on Java 21, risking runtime failures from strong module encapsulation

The PR upgrades the JDK from 8/11 to 21 in both Dockerfiles (Dockerfile:1, Dockerfile-telemetry:1) and the Maven compiler (pom.xml:51), but leaves Jetty at version 9.4.53 (pom.xml:256). Jetty 9.4.x officially supports only Java 8–11 (with limited compatibility up to 17). Java 21 enforces strong encapsulation of internal JDK APIs by default, and Jetty 9.4 is known to access internal APIs (e.g. sun.misc.Unsafe, sun.net.www.*) via reflection. Without --add-opens JVM flags, this will cause InaccessibleObjectException at runtime. The Jetty project recommends Jetty 10/11 for Java 11–17 and Jetty 12 for Java 17+. The jetty-runner used in both Dockerfiles (pom.xml:87-88) will be affected.

(Refers to lines 251-256)

Prompt for agents 
The jetty-version property at pom.xml:256 is still 9.4.53.v20231009, which is not compatible with Java 21. Jetty 9.4 relies on internal JDK APIs that are strongly encapsulated in Java 21, leading to InaccessibleObjectException at runtime.

To fix this, upgrade Jetty to a version that officially supports Java 21:
- Jetty 12.x is the recommended line for Java 17+ (uses Jakarta Servlet 6.0)
- Jetty 11.x supports Java 11-17 (uses Jakarta Servlet 5.0)
- Jetty 10.x supports Java 11-17 (uses javax.servlet 4.0)

Note that upgrading from Jetty 9 to Jetty 10+ also involves a servlet API migration (javax.servlet to jakarta.servlet for Jetty 11/12). The jetty-runner artifact name may also change. The swagger-inflector dependency (2.0.11) also uses javax.servlet, so the entire servlet stack needs to be considered together.

Alternatively, as a short-term workaround, you could add --add-opens JVM flags in the Dockerfile CMD lines (e.g. --add-opens java.base/sun.misc=ALL-UNNAMED), but this is fragile and not a long-term solution.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Jun 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks — I investigated this concrete runtime claim empirically on JDK 21 before merging, and Jetty 9.4.53 runs cleanly here.

Test (OpenJDK 21.0.11, jetty-runner on the produced WAR), exercising the full request lifecycle including the reflection-heavy JAXB/XML path:

  • GET /api/v3/pet/1 (JSON) → 200
  • GET /api/v3/pet/1 with Accept: application/xml → 200, correct JAXB-serialized <Pet>…</Pet>
  • GET /api/v3/pet/findByStatus?status=available → 200
  • POST /api/v3/pet (JSON body) → 200
  • GET /api/v3/store/inventory → 200

Server log contained no InaccessibleObjectException, no "illegal/ reflective access" warnings, and no sun.misc.Unsafe complaints — only the benign SLF4J no-op-binder notice and the jetty-runner is deprecated message. No --add-opens flags were needed.

On the upgrade path: Jetty can't be bumped here without replacing the framework. The app is built on swagger-inflector 2.0.11, which is javax.servlet-only. Jetty 11/12 use jakarta.servlet (incompatible with inflector 2.0.11 — there is no jakarta release of it), and Jetty 10 is the last javax.servlet line but is EOL and officially targets Java 11–17. So Jetty 9.4 (javax) is actually the best-supported option that keeps the current framework working on Java 21, and it's verified to do so. A Jetty 12 / jakarta move would be a separate framework-replacement effort, out of scope for this Java-version bump. If a future code path ever does trip encapsulation, the documented mitigation is --add-opens in the Dockerfile CMD, but it isn't required today.

Expand Down