Lift minimum JDK version to 21 and remove SecurityManager by holgerfriedrich · Pull Request #2214 · apache/karaf

holgerfriedrich · 2025-12-30T12:25:55Z

This is a first step to prepare the 4.5 branch for running with Java 25.
Starting Karaf in Java 25 does not yet work, as a few functions related to the SecurityManager have been deprecated long time ago and cannot be activated any longer via command line switches.
As a new API has been added in Java 18, I for new lift the minimum required version to Java 21 (LTS).

Maybe this is not the way to go - as there has been some discussions if we could introduce an abstraction layer to allow Java 17 as well.

Lift minimum JDK version to 21
Remove occurrences of SecurityManager, as getSecurityManager returns
null since JDK 18
~~Disable JavaSecurityTest, Rework JavaSecurityTest #2082~~
Enable verbose deprecation warnings
Replace getSubject and doAs calls
** getSubject can no longer be activated via JRE command line as
SecurityManager has been removed in JDK 25.
A replacement is available since Java 21.
** doAs was deprecated and is replaced by callAll.

For Java 25, another set of modifications is still needed and will be submitted as another PR.
Locally, I got Karaf compiling, passing the tests, and starting with Java 25. 🥳

jbonofre · 2026-01-01T06:07:35Z

                    <libraries>
                    </libraries>
-                    <javase>17</javase>
+                    <javase>21</javase>


That's require change on the karaf-maven-plugin and dependencies. I will create another PR (as planned) to tackle that.

jbonofre · 2026-01-01T06:08:20Z

 import static org.ops4j.pax.exam.CoreOptions.maven;
 import static org.ops4j.pax.exam.karaf.options.KarafDistributionOption.*;

+@Ignore("Disabled due to removal of SecurityManager. ref Apache Karaf GitHub issue #2082")


I would rather remove the test (to avoid confusion) or refactor it instead of ignoring it.

Ok, if I just remove the SecurityManager assertion, the test completes.
I am not sure if I get completely what this test was intended for (it checks that all bundles come up after applying a specific config - but how this was related to SecurityManager, I still don't get).

I pushed the change to ignore that no SecurityManager is there.

holgerfriedrich · 2026-01-09T16:02:25Z

@jbonofre is there anying else open I should address?

jbonofre · 2026-01-09T16:06:10Z

@holgerfriedrich I think this PR is pretty good, it just needs dependent PRs. I will tackle that.

jbonofre · 2026-02-10T09:30:46Z

@holgerfriedrich do you mind to share your email address with me ? I just realize that you didn't subscribe on the dev mailing list, and you are not on The ASF slack Karaf channel. Thanks !

arusevm · 2026-03-12T13:34:38Z

Hi @holgerfriedrich @jbonofre,

I've got here some ugly patches that seem to make the Subject-related stuff work on java 25.

Basically, there's an issue with that in 25, Subject.callAs() and current() use a ScopedValue and its binding "gets lost" across "thread-boundaries", of which there are a bunch :) It gets ugly, because every time you do something like ExecutorService.submit() you have to also "pass" the current Subject. Gets even worse, because Gogo needs a similar treatment...

Anyway, wondering if it might help if I share what we've got here with you... or if you already have something like it? Or if I might help in some other way? :)

jbonofre · 2026-03-12T13:41:53Z

@arusevm I'm finalizing camel-karaf release. I will be back on Karaf just after, tackling this.

Sorry for the delay.

jbonofre · 2026-03-14T09:50:12Z

Thanks @holgerfriedrich for the update ! I will do a new pass because I have a bunch of changes on the way.

holgerfriedrich · 2026-04-16T09:05:36Z

@jbonofre may I ask you to have a look at this again?

I rebased it in the last days and got the CI green.

It is a major step towards Java 25 compatibility.
Compilation with JDK 25 already works; one test needs a class downgrade and a few itests fail.
I'd like to keep that in a separate PR on top of this one.

❯ ./bin/karaf
WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
WARNING: sun.misc.Unsafe::staticFieldOffset has been called by org.apache.felix.framework.util.SecureAction (file:/C:/Users/holgerf/src/karaf/assemblies/apache-karaf/target/assembly/system/org/apache/felix/org.apache.felix.framework/7.0.5/org.apache.felix.framework-7.0.5.jar)
WARNING: Please consider reporting this to the maintainers of class org.apache.felix.framework.util.SecureAction
WARNING: sun.misc.Unsafe::staticFieldOffset will be removed in a future release
        __ __                  ____
       / //_/____ __________ _/ __/
      / ,<  / __ `/ ___/ __ `/ /_
     / /| |/ /_/ / /  / /_/ / __/
    /_/ |_|\__,_/_/   \__,_/_/

  Apache Karaf (4.5.0-SNAPSHOT)

Hit '<tab>' for a list of available commands
and '[cmd] --help' for help on a specific command.
Hit '<ctrl-d>' or type 'system:shutdown' or 'logout' to shutdown Karaf.

@root()> shell:info
shell:info
Karaf
  Karaf version               4.5.0-SNAPSHOT
  Karaf home                  C:\Users\holgerf\src\karaf\assemblies\apache-karaf\target\assembly
  Karaf base                  C:\Users\holgerf\src\karaf\assemblies\apache-karaf\target\assembly
  OSGi Framework              org.apache.felix.framework-7.0.5

JVM
  Java Virtual Machine        OpenJDK 64-Bit Server VM version 25+36-3489
  Version                     25

jbonofre · 2026-05-06T05:56:57Z

@holgerfriedrich I removed the specs bundles. Can you please rebase?

What's your take about JDK 17 / JDK 21?
Personaly, I think it's completely ok to bump directly to JDK 21 for Karaf 4.5.x (JDK 17 is supported at runtime by Karaf 4.4.x).

holgerfriedrich · 2026-05-06T07:06:38Z

@jbonofre if we do not consider writing a compat layer on our own, we need then new API available from JDK18. So 21 LTS is the natural choice.
I have rebased now (mainly due to the deleted files in the spec folder), but did not have time to give it a try in JDK25.

jbonofre · 2026-05-06T07:34:21Z

@holgerfriedrich I agree. I'm advocating for JDK 21 for Karaf 4.5.x. I propose to go that way (including updating our CI).

holgerfriedrich · 2026-05-30T05:56:02Z

@jbonofre how shall we proceed with this one?
Is something missing, or do you have another approach in mind?

kamilkrzywanski · 2026-06-02T07:26:48Z

@holgerfriedrich there is needed wersion of aries proxy compatible with jdk 25, it seems that their repo is already compatible with jdk 25 but no new release yet.

org.apache.aries.proxy
org.apache.aries.proxy
1.1.14

jbonofre · 2026-06-02T13:15:13Z

@holgerfriedrich @kamilkrzywanski I think we can move forward with this PR and tackle more required updates in follow up PRs (I'm working on Aries releases).

jbonofre · 2026-07-20T05:21:24Z

@holgerfriedrich I will be back on this one with you to finalize it.

scootermorris · 2026-09-02T16:34:43Z

Any progress on this? The Cytoscape project is trying to upgrade to Java 25 and right now, this PR seems to be what we need to start moving in that direction. Once this is committed, we should be able to use the nightly builds to start our testing and (if necessary) make the required changes to our REST infrastructure.

jbonofre · 2026-09-02T23:48:45Z

@scootermorris I'm back on this one for Karaf 4.5.0. I will push some improvements/fixes and we will good to go. Let's say mid next week.

scootermorris · 2026-09-03T16:00:26Z

@jbonofre Great to hear! Looking forward to it.

github-actions · 2026-09-03T17:56:31Z

Test Results

726 files ±0 726 suites ±0 1h 19m 34s ⏱️ -46s
985 tests ±0 937 ✅ ±0 48 💤 ±0 0 ❌ ±0
2 955 runs ±0 2 811 ✅ ±0 144 💤 ±0 0 ❌ ±0

Results for commit a9b9add. ± Comparison against base commit 54c6fb1.

♻️ This comment has been updated with latest results.

holgerfriedrich · 2026-09-11T17:23:16Z

@jbonofre Should I rebase again to check?

holgerfriedrich · 2026-09-11T21:21:52Z

@jbonofre I had to rework, since the files added in the meantime need changes as well.
Adding j25/ubuntu preview/mvn4 build, I stumbled upon an incompatibility: aries proxy package is to java21 byte code. A possible fix seems already been added, but never published:
https://github.com/apache/aries/blame/6f3c176af5449c7ff38445c5b4c5a16a0bdbf27a/proxy/proxy-impl/src/main/java/org/apache/aries/proxy/impl/ProxyUtils.java#L42
Anything we could do about that?

jbonofre · 2026-09-12T03:44:06Z

@holgerfriedrich thanks for that! I'm working with Domonik for a new Aries Proxy release including the change.

* Lift minimum JDK version to 21 * Remove occurrences of SecurityManager, as getSecurityManager returns null since JDK 18 * Enable verbose deprecation warnings * Replace getSubject and doAs calls, getSubject can no longer be activated via JRE command line as SecurityManager has been removed in JDK 25. A replacement is available since Java 21. doAs was deprecated and is replaced by callAll. * Remove SecurityManager form JavaSecurityTest

Subject.current()/callAs() use a plain ScopedValue on JDK 25 (no SecurityManager fallback like on JDK 21), which doesn't survive a new Thread or an ExecutorService hop. Since Felix Gogo runs each command on its own executor thread, this broke current-user lookup and RBAC checks (bundle:list/bundle:info losing bundle visibility). - JaasHelper.doAs/runAs now use Subject.callAs() instead of the old AccessControlContext/SubjectDomainCombiner plumbing; drop the now dead OsgiSubjectDomainCombiner/DelegatingProtectionDomain classes. - SecuredCommand.execute() re-binds the subject from the session on whatever thread runs the command, since Session is always passed explicitly there regardless of the executing thread. - LocalConsoleManager, ShellFactoryImpl and SuCommand store the subject on the session so SecuredCommand can read it back.

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

fabgio · 2026-09-19T10:03:51Z

@jbonofre any news about Aries update?
@holgerfriedrich OpenHab contributor here!
Thank you both!

jbonofre · 2026-09-19T11:20:30Z

@fabgio I'm on Aries stuff and related. I will get back to that later today or tomorrow: I'm busy with Karaf 4.4.12 release prep right now.

jbonofre · 2026-09-19T11:21:00Z

@fabgio Karaf 4.5.0 (including this PR) will be my top priority as soon as Karaf 4.4.12 is out.

holgerfriedrich · 2026-09-19T20:02:43Z

I did some testing in the past with the (already committed but not yet published) aries.proxy-1.1.15-SNAPSHOT. Apache aries needs to be cloned, then proxy installed. I did this with Java 21:

mvn install -N -f parent/pom.xml
mvn install -Daries.skip.version.check=true -f proxy/pom.xml

From here you can continue with Java 25 default:

Then it needs a small patch to bring in the new version and additional dependencies:

diff --git a/assemblies/features/standard/src/main/feature/feature.xml b/assemblies/features/standard/src/main/feature/feature.xml
index 06bb632a51..62a86fa849 100644
--- a/assemblies/features/standard/src/main/feature/feature.xml
+++ b/assemblies/features/standard/src/main/feature/feature.xml
@@ -37,6 +37,8 @@
         <bundle dependency="false" start-level="20">mvn:org.ow2.asm/asm-tree/${asm.version}</bundle>
         <bundle dependency="false" start-level="20">mvn:org.ow2.asm/asm-analysis/${asm.version}</bundle>
         <bundle dependency="false" start-level="20">mvn:org.ow2.asm/asm-commons/${asm.version}</bundle>
+        <!-- aries proxy >= 1.1.15 needs objenesis although its import is optional -->
+        <bundle dependency="false" start-level="20">mvn:org.objenesis/objenesis/${objenesis.version}</bundle>
         <bundle start-level="20">mvn:org.apache.aries.proxy/org.apache.aries.proxy/${aries.proxy.version}</bundle>
     </feature>
 
diff --git a/bom/pom.xml b/bom/pom.xml
index 225a9ed2e1..38ea526eac 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -478,6 +478,11 @@
                 <artifactId>asm-commons</artifactId>
                 <version>${asm.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.objenesis</groupId>
+                <artifactId>objenesis</artifactId>
+                <version>${objenesis.version}</version>
+            </dependency>
 
             <dependency>
                 <groupId>org.apache.felix</groupId>
diff --git a/itests/test/src/test/filtered-resources/etc/feature.xml b/itests/test/src/test/filtered-resources/etc/feature.xml
index b4c139af3d..7a0c9d69ab 100644
--- a/itests/test/src/test/filtered-resources/etc/feature.xml
+++ b/itests/test/src/test/filtered-resources/etc/feature.xml
@@ -37,6 +37,7 @@
         <bundle dependency="false" start-level="20">mvn:org.ow2.asm/asm-tree/${asm.version}</bundle>
         <bundle dependency="false" start-level="20">mvn:org.ow2.asm/asm-analysis/${asm.version}</bundle>
         <bundle dependency="false" start-level="20">mvn:org.ow2.asm/asm-commons/${asm.version}</bundle>
+        <bundle dependency="false" start-level="20">mvn:org.objenesis/objenesis/${objenesis.version}</bundle>
         <bundle start-level="20">mvn:org.apache.aries.proxy/org.apache.aries.proxy/${aries.proxy.version}</bundle>
     </feature>
 
diff --git a/pom.xml b/pom.xml
index 763c497567..ece6f5933d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -263,7 +263,7 @@
         <aries.jndi.api.version>1.1.0</aries.jndi.api.version>
         <aries.jndi.core.version>1.0.2</aries.jndi.core.version>
         <aries.jndi.url.version>1.1.0</aries.jndi.url.version>
-        <aries.proxy.version>1.1.14</aries.proxy.version>
+        <aries.proxy.version>1.1.15-SNAPSHOT</aries.proxy.version>
         <aries.proxy.api.version>1.1.1</aries.proxy.api.version>
         <aries.spifly.version>1.3.7</aries.spifly.version>
         <aries.subsystem.api.version>2.0.10</aries.subsystem.api.version>
@@ -292,6 +292,7 @@
         <maven.wagon.version>3.5.3</maven.wagon.version>
         <maven-plugin-annotations.version>3.16.0</maven-plugin-annotations.version>
         <maven.resolver.version>2.0.23</maven.resolver.version>
+        <objenesis.version>3.6</objenesis.version>
 
         <osgi.version>8.0.0</osgi.version>
         <org.osgi.annotation.bundle.version>2.0.0</org.osgi.annotation.bundle.version>

This makes all our tests work on a Java 25.
Note that we still lock the code generation to Java 21 in Karaf.

For newer Java versions, aries needs another patch, apache/aries#912. I tried this and got it working with Java 27.
It matters on which JDK aries proxy runs - not the class file version which is generated.

jbonofre self-requested a review December 31, 2025 05:20

jbonofre reviewed Jan 1, 2026

View reviewed changes

holgerfriedrich force-pushed the pr-secmgr-removal branch from 023bbe9 to 8ed17ca Compare January 11, 2026 10:44

holgerfriedrich force-pushed the pr-secmgr-removal branch from 8ed17ca to d2e0bc8 Compare March 1, 2026 21:20

holgerfriedrich force-pushed the pr-secmgr-removal branch from 7a69588 to 264b04b Compare March 14, 2026 08:25

holgerfriedrich force-pushed the pr-secmgr-removal branch 6 times, most recently from 7e6e4fd to 05bbfa0 Compare April 14, 2026 22:30

holgerfriedrich requested a review from jbonofre April 16, 2026 08:54

holgerfriedrich force-pushed the pr-secmgr-removal branch from c54ec28 to 7a3001e Compare April 17, 2026 10:16

holgerfriedrich force-pushed the pr-secmgr-removal branch from 7a3001e to 050898c Compare April 28, 2026 13:17

holgerfriedrich force-pushed the pr-secmgr-removal branch from 050898c to 6e02242 Compare May 6, 2026 07:04

jbonofre mentioned this pull request May 8, 2026

WIP: [#8005] Update minimum release/source/target to JDK 21 #1992

Closed

holgerfriedrich force-pushed the pr-secmgr-removal branch from 6e02242 to 1bd0efa Compare May 29, 2026 21:35

holgerfriedrich force-pushed the pr-secmgr-removal branch from 051e1a7 to 34c40e9 Compare September 3, 2026 16:58

holgerfriedrich force-pushed the pr-secmgr-removal branch from 34c40e9 to 2f4d98e Compare September 11, 2026 19:39

holgerfriedrich force-pushed the pr-secmgr-removal branch from 6784b86 to 50f8c79 Compare September 12, 2026 07:43

manusa mentioned this pull request Sep 14, 2026

chore(ci): add Java 25 LTS to CI build matrix fabric8io/kubernetes-client#8015

Merged

CptBartender mentioned this pull request Sep 15, 2026

Fixed various IntelliJ warnings in BaseActivator #2911

Open

holgerfriedrich and others added 11 commits September 16, 2026 18:17

disable org.osgi.framework.security in JavaSecurityTest

55e243a

Updated how Java 21 is set in various places

8fb45d2

Change thread creation for itests

6fc6a7f

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

Fix typo in ci workflow desc

72b358f

Replace doAs in newly added KarafMBeanServerGuardTest

18f4672

Replace java 17 in karaf-light pom

eb39674

Add Java25 on Ubuntu to build matrix

8ff9e96

ubuntu 26.04 public preview for j25

a8863ec

mvn-4.0.0-rc-6 for j25

a9b9add

holgerfriedrich force-pushed the pr-secmgr-removal branch from 50f8c79 to a9b9add Compare September 16, 2026 16:18

holgerfriedrich mentioned this pull request Sep 19, 2026

Make the objenesis import mandatory in proxy-impl apache/aries#913

Open

Conversation

holgerfriedrich commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jbonofre Jan 1, 2026

Choose a reason for hiding this comment

Uh oh!

jbonofre Jan 1, 2026

Choose a reason for hiding this comment

Uh oh!

holgerfriedrich Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

holgerfriedrich commented Jan 9, 2026

Uh oh!

jbonofre commented Jan 9, 2026

Uh oh!

jbonofre commented Feb 10, 2026

Uh oh!

arusevm commented Mar 12, 2026

Uh oh!

jbonofre commented Mar 12, 2026

Uh oh!

jbonofre commented Mar 14, 2026

Uh oh!

holgerfriedrich commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jbonofre commented May 6, 2026

Uh oh!

holgerfriedrich commented May 6, 2026

Uh oh!

jbonofre commented May 6, 2026

Uh oh!

holgerfriedrich commented May 30, 2026

Uh oh!

kamilkrzywanski commented Jun 2, 2026

Uh oh!

jbonofre commented Jun 2, 2026

Uh oh!

jbonofre commented Jul 20, 2026

Uh oh!

scootermorris commented Sep 2, 2026

Uh oh!

jbonofre commented Sep 2, 2026

Uh oh!

scootermorris commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

holgerfriedrich commented Sep 11, 2026

Uh oh!

holgerfriedrich commented Sep 11, 2026

Uh oh!

jbonofre commented Sep 12, 2026

Uh oh!

fabgio commented Sep 19, 2026

Uh oh!

jbonofre commented Sep 19, 2026

Uh oh!

jbonofre commented Sep 19, 2026

Uh oh!

holgerfriedrich commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

holgerfriedrich commented Dec 30, 2025 •

edited

Loading

holgerfriedrich Jan 1, 2026 •

edited

Loading

holgerfriedrich commented Apr 16, 2026 •

edited

Loading

github-actions Bot commented Sep 3, 2026 •

edited

Loading

holgerfriedrich commented Sep 19, 2026 •

edited

Loading