Skip to content

Add Java 21 compile time support #1275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
madurangasiriwardena merged 13 commits into from
Feb 5, 2026
Merged

Add Java 21 compile time support #1275

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
0a00dc5
Add changes to compile the product in Java17
madurangasiriwardena Mar 20, 2024
a16e822
Add tiles jsp
madurangasiriwardena Jun 25, 2024
70538db
Add Java 21 compile time support
madurangasiriwardena Nov 13, 2025
efe09b5
Add a new oltu version
madurangasiriwardena Dec 8, 2025
49dc772
Fix tomcat-jsp-api bundle
madurangasiriwardena Dec 11, 2025
78dd5d4
Add new opensaml bundle
madurangasiriwardena Dec 11, 2025
5df8155
Add new waffle bundle
madurangasiriwardena Dec 16, 2025
a6d4f93
Add new openid4java bundle
madurangasiriwardena Dec 17, 2025
231d3a4
Add bcpg and bctls 1.83 bundles
madurangasiriwardena Dec 22, 2025
71d68b0
Update the artifact id with jdk21
madurangasiriwardena Feb 5, 2026
a5f388e
Remove already merged bundles
madurangasiriwardena Feb 5, 2026
c6adad3
Update license headers
madurangasiriwardena Feb 5, 2026
b631d7a
Fix issues in csrf guard bundle
madurangasiriwardena Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions abdera-jdk21/1.0.0.wso2v1/META-INF/services/org.apache.abdera.factory.ExtensionFactory
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
org.wso2.carbon.registry.app.PropertyExtensionFactory
120 changes: 120 additions & 0 deletions abdera-jdk21/1.0.0.wso2v1/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,120 @@
<!--
~ Copyright (c) 2005-2010, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
~
~ WSO2 Inc. licenses this file to you under the Apache License,
~ Version 2.0 (the "License"); you may not use this file except
~ in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
~ KIND, either express or implied. See the License for the
~ specific language governing permissions and limitations
~ under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>
<groupId>org.apache.abdera.wso2</groupId>
<artifactId>abdera-jdk21</artifactId>
<packaging>bundle</packaging>
<name>abdera.wso2</name>
<version>1.0.0.wso2v1</version>
<description>
org.wso2.carbon.abdera. This bundle will represent abdera
</description>
<url>http://wso2.org</url>

<dependencies>
<dependency>
<groupId>org.apache.abdera</groupId>
<artifactId>abdera-client</artifactId>
<version>${version.abdera}</version>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.apache.abdera</groupId>
<artifactId>abdera-core</artifactId>
<version>${version.abdera}</version>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.apache.abdera</groupId>
<artifactId>abdera-parser</artifactId>
<version>${version.abdera}</version>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.apache.abdera</groupId>
<artifactId>abdera-server</artifactId>
<version>${version.abdera}</version>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.apache.abdera</groupId>
<artifactId>abdera-i18n</artifactId>
<version>${version.abdera}</version>
<optional>true</optional>
</dependency>
</dependencies>

<build>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<version>${maven.bundle.plugin.version}</version>
<extensions>true</extensions>
<configuration>
<instructions>
<Bundle-Name>${project.artifactId}</Bundle-Name>
<Bundle-Vendor>WSO2 Inc</Bundle-Vendor>
<Bundle-Description>${project.description}</Bundle-Description>
<Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
<Export-Package>
org.apache.abdera.*;version="${project.version}"
</Export-Package>
<Import-Package>
!org.apache.abdera.*,
javax.xml.stream.*; version="1.0.1",
javax.activation.*; version="[0.0.0,2.0.0)",
*;resolution:=optional
</Import-Package>
<Include-Resource>
META-INF/services/org.apache.abdera.factory.ExtensionFactory=META-INF/services/org.apache.abdera.factory.ExtensionFactory,
@abdera-core-${version.abdera}.jar!/META-INF/services/org.apache.abdera.factory.ExtensionFactory.example,
@abdera-core-${version.abdera}.jar!/abderamessages.properties,
@abdera-parser-${version.abdera}.jar!/META-INF/services/org.apache.abdera.writer.NamedWriter
</Include-Resource>
<DynamicImport-Package>*</DynamicImport-Package>
<Embed-Dependency>
abdera-client|abdera-core|abdera-parser|abdera-server|abdera-i18n;scope=compile|runtime;inline=true
</Embed-Dependency>
</instructions>
</configuration>
</plugin>
</plugins>
</build>
<properties>
<version.abdera>1.0-wso2v2</version.abdera>
<maven.bundle.plugin.version>5.1.9</maven.bundle.plugin.version>
</properties>

<repositories>
<repository>
<id>wso2-nexus</id>
<name>WSO2 internal Repository</name>
<url>https://maven.wso2.org/nexus/content/groups/wso2-public/</url>
<releases>
<enabled>true</enabled>
<updatePolicy>daily</updatePolicy>
<checksumPolicy>ignore</checksumPolicy>
</releases>
Comment on lines +114 to +117

@coderabbitai coderabbitai Bot Feb 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Security concern: checksumPolicy set to ignore.

Setting checksumPolicy to ignore bypasses checksum verification for downloaded artifacts, which could allow corrupted or tampered artifacts to be used. Consider using warn or fail instead to maintain artifact integrity verification.

Proposed fix 
             <releases>
                 <enabled>true</enabled>
                 <updatePolicy>daily</updatePolicy>
-                <checksumPolicy>ignore</checksumPolicy>
+                <checksumPolicy>warn</checksumPolicy>
             </releases>
🤖 Prompt for AI Agents 
In `@abdera-jdk21/1.0.0.wso2v1/pom.xml` around lines 114 - 117, The POM currently
sets the Maven repository <checksumPolicy> to "ignore" inside the <releases>
block; change the <checksumPolicy> value from "ignore" to a stricter option
(e.g., "warn" or "fail") to re-enable checksum verification for downloaded
artifacts, updating the <checksumPolicy> element in the same <releases> section
accordingly so artifact integrity is enforced.

</repository>
</repositories>
</project>
92 changes: 92 additions & 0 deletions bcpg/1.83.0.wso2v1/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
~ Copyright (c) 2025, WSO2 LLC. (http://www.wso2.com).
~
~ WSO2 LLC. licenses this file to you under the Apache License,
~ Version 2.0 (the "License"); you may not use this file except
~ in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
~ KIND, either express or implied. See the License for the
~ specific language governing permissions and limitations
~ under the License.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>
<groupId>org.wso2.orbit.org.bouncycastle</groupId>
<artifactId>bcpg-jdk18on</artifactId>
<packaging>bundle</packaging>
<name>bcpg</name>
<version>1.83.0.wso2v1</version>
<description>
This bundle will represent bouncycastle 1.83
</description>
<url>http://wso2.org</url>

<distributionManagement>
<repository>
<id>wso2.releases</id>
<name>WSO2 internal Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/releases/</url>
</repository>

<snapshotRepository>
<id>wso2.snapshots</id>
<name>Apache Snapshot Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url>
</snapshotRepository>
</distributionManagement>

<dependencies>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpg-jdk18on</artifactId>
<version>${version.bcpg}</version>
<!-- By setting optional false, dependent projects of this orbit bundle will be able to see bcpg-jdk18on
library as a transitive dependency. This is required because we are embedding bcpg-jdk18on library inside
this orbit bundle without extracting the content, because bcpg-jdk18on library is signed. If you embed a
dependency and set optional to true, then dependent projects will not be able to compile their source with
this orbit bundle.-->
<optional>false</optional>
</dependency>
</dependencies>

<build>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<version>3.5.0</version>
<extensions>true</extensions>
Comment on lines +65 to +69

@coderabbitai coderabbitai Bot Feb 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

maven-bundle-plugin 3.5.0 Java 21 compatibility

💡 Result:

org.apache.felix:maven-bundle-plugin:3.5.0 is very unlikely to be Java 21–compatible for bytecode analysis.

  • Version 3.5.0 was published 2018-01-06 and its dependency set includes biz.aQute.bnd:biz.aQute.bndlib:3.5.0 (the library that parses/analyzes class files to generate OSGi metadata). [1][2]
  • Java 21 produces class file major version 65. Tools/libraries that don’t understand that classfile version typically fail with “Unsupported class file major version 65”. [3]

Recommendation: Upgrade the Felix Maven Bundle Plugin to a much newer line (Central shows versions up to 6.0.0, published 2024-11-25) to pick up a newer bndlib with support for modern Java classfile versions. [4]

Sources

  1. Apache Felix bundle-plugin 3.5.0 “Plugin Documentation” (last published 2018-01-06) – https://felix.apache.org/documentation/_attachments/components/bundle-plugin-archives/bundle-plugin-3.5.0/plugin-info.html
  2. Apache Felix bundle-plugin 3.5.0 “Project Dependencies” (shows biz.aQute.bndlib:3.5.0) – https://felix.apache.org/documentation/_attachments/components/bundle-plugin-archives/bundle-plugin-3.5.0/dependencies.html
  3. Classfile major version table (65 = Java 21) – https://mkyong.com/java/java-unsupported-class-file-major-version-65/
  4. Maven Central directory for maven-bundle-plugin (shows 6.0.0 and publish timestamp) – https://repo.maven.apache.org/maven2/org/apache/felix/maven-bundle-plugin/

🌐 Web query:

org.apache.felix maven-bundle-plugin Java 21 support minimum version

💡 Result:

Minimum org.apache.felix:maven-bundle-plugin version to use for Java 21 projects: 6.0.0 (released 2024-11-25). It upgrades the embedded bndlib from 6.3.1 → 7.0.0 [2] and the plugin itself requires JDK 17+ to run (so it runs fine on JDK 21) [1]. bnd 7.0.0 is the major line that moved to Java 17+ and added/expanded modern-JDK handling (for example multi-release JAR support) [3].

Sources:
[1] Apache Felix Maven Bundle Plugin docs (system requirements) (felix.apache.org)
[2] Maven Bundle Plugin 6.0.0 dependency change showing bndlib 7.0.0 (mvnrepository.com)
[3] bnd “Changes in 7.0.0” (Java 17 baseline; multi-release JAR support) (github.com)

Citations:

🌐 Web query:

maven-bundle-plugin release notes changelog Java 21

💡 Result:

Maven Bundle Plugin (org.apache.felix:maven-bundle-plugin) — release notes / changelog + Java 21 angle

Where to read the upstream changelog (release notes):

  • The project maintains a changelog.txt in the Felix dev repo (linked from ASF JIRA): tools/maven-bundle-plugin/changelog.txt. [1]

Key recent release relevant to Java 21 builds/runs:

  • maven-bundle-plugin 6.0.0 (released 2024-11-25) upgrades its embedded bndlib from 6.3.1 → 7.0.0. [2]
  • The Apache Felix plugin site also documents 6.0.0 as the current plugin version in its generated goal docs. [3]

Why that matters for Java 21:

  • bnd 7.0.0 is a breaking release because it moved to Java 17, and it states it is updated to require Java 17 or later. [4]
    So, running the Maven Bundle Plugin line that embeds bnd 7.x (e.g., maven-bundle-plugin 6.0.0) implies you must run Maven with Java ≥ 17—which includes Java 21.

Related note (release notes completeness):

  • There was an ASF issue filed/resolved noting the maven-bundle-plugin 6.0.0 release notes didn’t mention the Java 17 requirement. [1]

Practical takeaway for “Java 21”

  • If your goal is “works when Maven is run on Java 21”: use maven-bundle-plugin 6.0.0+ (since it embeds bnd 7.x, which requires Java 17+). [2][4]

Sources:
[1] ASF JIRA FELIX-6739 (points to changelog + Java requirement note) https://issues.apache.org/jira/browse/FELIX-6739
[2] mvnrepository “6.0.0 changes” (release date + bndlib 7.0.0) https://mvnrepository.com/artifact/org.apache.felix/maven-bundle-plugin/6.0.0/changes
[3] Apache Felix plugin docs (shows 6.0.0) https://felix.apache.org/components/bundle-plugin/bundle-mojo.html
[4] bnd wiki “Changes in 7.0.0” (Java 17 requirement) https://github.com/bndtools/bnd/wiki/Changes-in-7.0.0

Upgrade maven-bundle-plugin 3.5.0 — does not support Java 21 classfiles.

The bundled bndlib 3.5.0 cannot parse Java 21's class file major version 65. Upgrade to 6.0.0 or later, which embeds bndlib 7.0.0 with proper Java 21 bytecode support.

🤖 Prompt for AI Agents 
In `@bcpg/1.83.0.wso2v1/pom.xml` around lines 65 - 69, The maven-bundle-plugin
version 3.5.0 in the plugin declaration (org.apache.felix:maven-bundle-plugin)
uses a bndlib that cannot parse Java 21 classfiles; update the <version> element
for the maven-bundle-plugin to 6.0.0 or later (which embeds bndlib 7.x) in the
plugin block so the build can handle Java 21 bytecode, then run a quick build to
verify compatibility with the rest of the POM.

<configuration>
<instructions>
<Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
<Bundle-Name>${project.artifactId}</Bundle-Name>
<Import-Package>
!org.bouncycastle.*
</Import-Package>
<Export-Package>
org.bouncycastle.*;version="${exp.pkg.version.bcpg}"
</Export-Package>
<Embed-Dependency>bcpg-jdk18on;scope=compile|runtime;inline=false</Embed-Dependency>
<DynamicImport-Package>*</DynamicImport-Package>
</instructions>
</configuration>
</plugin>
</plugins>
</build>

<properties>
<exp.pkg.version.bcpg>1.83.0</exp.pkg.version.bcpg>
<version.bcpg>1.83</version.bcpg>
</properties>
</project>
129 changes: 129 additions & 0 deletions bctls/1.83.0.wso2v1/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
~ Copyright (c) 2025, WSO2 LLC. (http://www.wso2.com).
~
~ WSO2 LLC. licenses this file to you under the Apache License,
~ Version 2.0 (the "License"); you may not use this file except
~ in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
~ KIND, either express or implied. See the License for the
~ specific language governing permissions and limitations
~ under the License.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>
<groupId>org.wso2.orbit.org.bouncycastle</groupId>
<artifactId>bctls-jdk18on</artifactId>
<packaging>bundle</packaging>
<name>bctls</name>
<version>1.83.0.wso2v1</version>
<description>
This bundle will represent bouncycastle TLS 1.80
</description>
Comment on lines +30 to +32

@coderabbitai coderabbitai Bot Feb 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix incorrect version in description.

The description states "TLS 1.80" but the bundle version is 1.83.0. This appears to be a copy-paste error from a previous version.

📝 Proposed fix 
     <description>
-        This bundle will represent bouncycastle TLS 1.80
+        This bundle will represent bouncycastle TLS 1.83
     </description>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<description>
This bundle will represent bouncycastle TLS 1.80
</description>
<description>
This bundle will represent bouncycastle TLS 1.83
</description>
🤖 Prompt for AI Agents 
In `@bctls/1.83.0.wso2v1/pom.xml` around lines 30 - 32, Update the <description>
element in the pom.xml to reflect the correct bundle version (1.83.0) instead of
the incorrect "TLS 1.80"; locate the <description> tag that currently reads
"This bundle will represent bouncycastle TLS 1.80" and change the text to
mention TLS 1.83 (e.g., "This bundle will represent bouncycastle TLS 1.83.0") so
the description matches the pom version.

<url>http://wso2.org</url>

<distributionManagement>
<repository>
<id>wso2.releases</id>
<name>WSO2 internal Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/releases/</url>
</repository>

<snapshotRepository>
<id>wso2.snapshots</id>
<name>Apache Snapshot Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url>
</snapshotRepository>
</distributionManagement>

<dependencies>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bctls-jdk18on</artifactId>
<version>${version.bc}</version>
<!-- By setting optional false, dependent projects of this orbit bundle will be able to see bcutil-jdk18on
library as a transitive dependency. This is required because we are embedding bcutil-jdk18on library inside
this orbit bundle without extracting the content, because bcutil-jdk18on library is signed. If you embed a
dependency and set optional to true, then dependent projects will not be able to compile their source with
this orbit bundle.-->
<optional>false</optional>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcutil-jdk18on</artifactId>
<version>${version.bc}</version>
<!-- By setting optional false, dependent projects of this orbit bundle will be able to see bcutil-jdk18on
library as a transitive dependency. This is required because we are embedding bcutil-jdk18on library inside
this orbit bundle without extracting the content, because bcutil-jdk18on library is signed. If you embed a
dependency and set optional to true, then dependent projects will not be able to compile their source
with this orbit bundle.-->
<optional>false</optional>
</dependency>
</dependencies>

<build>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<version>3.5.0</version>
<extensions>true</extensions>
<configuration>
<instructions>
<Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
<Bundle-Name>${project.artifactId}</Bundle-Name>
<Import-Package>
org.bouncycastle.util*;version="${imp.pkg.version.range}",
org.bouncycastle.pqc.*;version="${imp.pkg.version.range}",
org.bouncycastle.math.*;version="${imp.pkg.version.range}",
org.bouncycastle.jce.*;version="${imp.pkg.version.range}",
org.bouncycastle.jcajce.*;version="${imp.pkg.version.range}",
org.bouncycastle.asn1.*;version="${imp.pkg.version.range}",
org.bouncycastle.crypto.*;version="${imp.pkg.version.range}",
*;resolution:=optional
</Import-Package>
<Export-Package>
org.bouncycastle.jsse;version="${exp.pkg.version.bctls}",
org.bouncycastle.jsse.java.security;version="${exp.pkg.version.bctls}",
org.bouncycastle.jsse.provider;version="${exp.pkg.version.bctls}",
org.bouncycastle.jsse.util;version="${exp.pkg.version.bctls}",
org.bouncycastle.tls;version="${exp.pkg.version.bctls}",
org.bouncycastle.tls.crypto;version="${exp.pkg.version.bctls}",
org.bouncycastle.tls.crypto.impl;version="${exp.pkg.version.bctls}",
org.bouncycastle.tls.crypto.impl.bc;version="${exp.pkg.version.bctls}",
org.bouncycastle.tls.crypto.impl.jcajce;version="${exp.pkg.version.bctls}",
org.bouncycastle.tls.crypto.impl.jcajce.srp;version="${exp.pkg.version.bctls}",
!org.bouncycastle.util,
!org.bouncycastle.pqc,
!org.bouncycastle.math,
!org.bouncycastle.jce,
!org.bouncycastle.jcajce,
!org.bouncycastle.crypto,
!org.bouncycastle.asn1
</Export-Package>
<Embed-Dependency>
bctls-jdk18on;scope=compile|runtime;inline=false,
bcutil-jdk18on;scope=compile|runtime;inline=false
</Embed-Dependency>
</instructions>
</configuration>
</plugin>
</plugins>
</build>

<properties>
<exp.pkg.version.bctls>1.83.0</exp.pkg.version.bctls>
<imp.pkg.version.range>[1.83.0, 2.0.0)</imp.pkg.version.range>
<version.bc>1.83</version.bc>
</properties>
</project>
Loading