werkregie/doc/adrs/0001-2026-10-11.temurin-25.md

Temurin 25 as JDK and Runtime of All werk Repositories

Status:

• proposed: 2026-10-11
• accepted: 2026-10-11
• rejected: -
• superseded: -
• revised: 2026-10-11, see "Revision of 2026-10-11"

Decision [accepted]: All werk repositories build with Temurin 25, and each service runs on a runtime jlinked from it; Werkator's build environment provides Temurin 25, so no build downloads a JDK.

Context and Problem Statement

Each werk repository chose its JDK and its runtime on its own (state on 2026-10-11):

Repository	JDK	Vendor	Download	Gradle	Kotlin	Runtime on the host
werkator	21	Temurin	Foojay 0.8.0	8.14.5	2.2.0	jlinked, mih09
werkregie	21	Temurin	Foojay 1.0.0	9.8.1	2.4.21	jlinked
werkrevisor, statistics	21	Temurin	Foojay 0.8.0	8.14.5	2.2.0	jar on mih09
werkcrappit	21	any	-	9.8.0	-	none, a Gradle plugin
werkbaum, backend	21	any	-	9.1.0	2.2.20	full Temurin JDK 21 in the home, mih00
werkprobe	any, bytecode 17	any	-	9.6.0	-	Java 17 of the managed webspaces

mi wants one choice for all of them.

Technical Background

• jlink compiles nothing; it copies the vendor's binaries, so the vendor's build platform sets the glibc floor of a runtime (Werkator ADR 0006, Werkator PR#62).
• Measured over all shared libraries: Temurin 21 needs GLIBC_2.15, Temurin 25 GLIBC_2.17, a distribution's OpenJDK the glibc of its distribution, e.g. GLIBC_2.38 for Ubuntu 24.04's OpenJDK 21.
• mih09 and mih00 run Debian 12 with glibc 2.36.
• Werkator's build environment has Debian's OpenJDK 21; a repository that pins Temurin downloads it with Foojay in each build.

Considered Options

• Temurin 25 everywhere
• Temurin 21 everywhere
• Any JDK for compiling, Temurin only where a runtime is jlinked

Temurin 25 Everywhere

Java 25 is the current LTS release. A test build on 2026-10-11, of a copy of each main with the toolchain set to 25, showed:

• werkregie, werkcrappit and werkprobe build unchanged; the jlinked runtimes report Temurin 25.0.4.
• werkator, werkbaum and the statistics service of werkrevisor need Kotlin 2.4.21: Kotlin 2.2.0 and 2.2.20 have no JVM 25 target. With Kotlin 2.4.21 they build, and werkator's runtime bundle reports Temurin 25.0.4.
• PIT 1.30, JaCoCo 0.8.13 and 0.8.15, Spring Boot 4.0, Trixnity, sqlite-jdbc and H2 work with 25.
• Only tests that need a git checkout or werkdock's sandbox failed, and they fail with JDK 21 as well.

Advantages

• One JDK and one runtime for all repositories, with the longest support of an LTS release.
• A runtime jlinked from Temurin 25 starts on every Hostsharing host with glibc 2.17 or newer.

Disadvantages

• Three repositories must raise Kotlin to 2.4.21 first.
• Gradle 8.14 does not run on JDK 25; werkator and werkrevisor need Gradle 9 and Foojay 1.0.0, as werkregie.
• werkprobe stays on Java 17 bytecode: the managed webspaces bring their own Java 17.

Temurin 21 Everywhere

Advantages

• No Kotlin and no Gradle upgrade.

Disadvantages

• A move to 25 is still due later, with the same work.

Any JDK for Compiling, Temurin Only Where a Runtime Is jlinked

The state of 2026-10-11.

Advantages

• No change.

Disadvantages

• What the CI tests is not what runs on the hosts.
• Two Foojay versions and downloads in each build stay.

Decision Outcome

Temurin 25 everywhere, decided by mi on 2026-10-11:

• Each repository builds with the toolchain JavaLanguageVersion.of(25) and the vendor JvmVendorSpec.ADOPTIUM. werkprobe keeps options.release = 17 for the webspaces.
• Werkator's build environment provides Temurin 25; Foojay stays only as a fallback.
• Each service runs on a runtime jlinked from Temurin 25, werkbaum included; the full JDK in its home goes.

The rollout, in this order:

1. werkator: its build environment gets Temurin 25 beside OpenJDK 21, so no build breaks.
2. One PR per repository switches it to 25, with Kotlin 2.4.21 and Gradle 9 where needed.
3. OpenJDK 21 leaves the build environment.

Consequences

• A new repository builds with Temurin 25 from the start.
• The module list of each jlinked runtime is checked again with jdeps when its dependencies change.
• The next LTS release gets a decision of its own.

Revision of 2026-10-11

The build environment does not get Temurin 25; Foojay provides it, decided by mi on 2026-10-11 (werkregie PR#22).

• The reason above, "so that no build downloads a JDK", is wrong. The builds on mih09 share one Gradle home, and Foojay downloads a JDK into it only once; Temurin 21 lies there since 2026-09-17.
• Werkator PR#62 had already rejected a Temurin baked into the rootfs: each Java update would mean a new archive of about 425 MB, uploaded by hand.

What changes:

• Each repository pins Temurin 25 with JvmVendorSpec.ADOPTIUM and loads it with Foojay 1.0.0.
• Werkator's build environment stays as it is; its OpenJDK 21 runs Gradle.
• The rollout is one PR per repository, with Kotlin 2.4.21 and Gradle 9 where needed; steps 1 and 3 above are dropped.