chore(ci): run GraalVM native tests on GraalVM 25 and upgrade native-maven-plugin to 1.1.14

[phipag]

Summary

Changes

This PR moves the GraalVM native tests from GraalVM 21.0.8 to GraalVM 25 and upgrades native-maven-plugin from 0.11.5 to 1.1.14. It supersedes the Dependabot PR aws-powertools/powertools-lambda-java#2661, which cannot pass on GraalVM 21.

• native-maven-plugin 1.1.14: Upgrades the root pom.xml, the 5 sam-graalvm example poms and powertools-e2e-tests/handlers/pom.xml. Plugin 1.x requires the 1.0 reachability metadata repository, which uses the unified reachability-metadata.json format for GraalVM 25. GraalVM 21 rejects this format.
• Removes the native-junit6-jdk21 profile: The initialize-at-buildtime list in junit-platform-native 1.1.14 contains MethodSegmentResolver and DiscoveryIssueReportingDiscoveryListener. The 0.11.5 list does not (graalvm/native-build-tools#794). GraalVM 21 is no longer the tested toolchain for the native tests.
• CI on a pinned GraalVM 25 innovation release: The graalvm-build job uses graalvm/setup-graalvm v1.6.7 with java-version: "25" and version: "25.4.4.1.1". setup-graalvm matches this value against the version metadata of the Oracle GraalVM artifacts. Move back to the LTS release once oracle/graal#12723 is fixed there.
• Examples: The sam-graalvm Dockerfiles use sam/build-java25 and GraalVM for JDK 25 LTS (download.oracle.com/graalvm/25/latest, currently 25.0.4). They only build native images of the examples and do not run the tracing-agent native tests. This PR also removes a stray curl argument from their download step.
• Docs: GraalVM.md and docs/FAQs.md describe GraalVM 25, the CI GraalVM version, the example toolchain and the known issue below.
• Skips JaCoCo in the native profile: Plugin 0.11.5 replaced the surefire argLine with the tracing agent. Plugin 1.x appends the agent to the existing argLine, so JaCoCo now instruments net.bytebuddy.utility.Invoker$Dispatcher before the tracing agent records it as a predefined class. The native image then rejects the uninstrumented class because its hash does not match.
• Adds -H:+ClassForNameRespectsClassLoader to the native test build: Byte Buddy loads each Mockito mock class with Class.forName(name, false, loader) on its own class loader. GraalVM 25.0 fell back to ClassLoader#loadClass when the image contained predefined classes. GraalVM 25.1 and later ignore the class loader by default, so every Mockito mock failed with ClassNotFoundException. The option restores the delegation. GraalVM 25.1 added the equivalent --future-defaults=class-for-name-respects-class-loader, but GraalVM 25.0 rejects it.
• ClassPreLoader continues after a LinkageError: With the class loader delegation, Class.forName initializes com.sun.management.internal.PlatformMBeanProviderImpl from the tracing classesloaded.txt. Its static initializer throws UnsatisfiedLinkError in a native image, which escaped the CRaC beforeCheckpoint hook. ClassPreLoader now logs the error at debug level and loads the next class. A new unit test covers this.

Why CI uses the innovation release and not 25.0 LTS: GraalVM 25.0.x bundles ASM 9.7.1, which reads class files up to major version 68. On JDK 25, Byte Buddy (used by Mockito) generates classes with major version 69. The tracing agent records these classes as predefined classes, and the native test image build fails in ClassPredefinitionFeature with Unsupported class file major version 69. On GraalVM 25.0.2, this breaks 12 of 17 native modules. The upstream issue is oracle/graal#12723. GraalVM 25 innovation releases parse class files with the Java Class-File API instead of ASM. This only affects the native tests that use Mockito. Users can build Powertools functions with GraalVM 25.0 LTS.

Verification: The graalvm-build job resolved Oracle GraalVM 25.4.4.1.1 and passed the native tests of all 16 modules with tests (664 tests, 0 failures). java-build passed on Java 17, 21 and 25. The verify dependency review fails because the license metadata of native-maven-plugin 1.1.14 resolves to LicenseRef-bad-non-standard. That is a license gate, not a code failure.

Issue number: closes #2416

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 7 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA f4d40dc.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

examples/powertools-examples-cloudformation/pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

examples/powertools-examples-core-utilities/sam-graalvm/pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

examples/powertools-examples-idempotency/sam-graalvm/pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

examples/powertools-examples-parameters/sam-graalvm/pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

examples/powertools-examples-serialization/sam-graalvm/pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

powertools-e2e-tests/handlers/pom.xml

Package	Version	License	Issue Type
org.graalvm.buildtools:native-maven-plugin	1.1.14	LicenseRef-bad-non-standard	Incompatible License

Allowed Licenses:

Apache-1.1, Apache-2.0, ISC, MIT, MIT-0, MIT-CMU, MIT-enna, MIT-feh, MIT-Festival, MIT-Modern-Variant, MIT-open-group, MIT-testregex, MIT-Wu, BSD-1-Clause, BSD-2-Clause, BSD-2-Clause-Views, BSD-3-Clause, BSD-3-Clause-Attribution, BSD-3-Clause-Clear, BSD-3-Clause-flex, BSD-3-Clause-HP, BSD-3-Clause-LBNL, BSD-3-Clause-Modification, BSD-3-Clause-No-Military-License, BSD-3-Clause-No-Nuclear-License, BSD-3-Clause-No-Nuclear-License-2014, BSD-3-Clause-No-Nuclear-Warranty, BSD-3-Clause-Open-MPI, UPL-1.0

OpenSSF Scorecard

Package	Version	Score	Details
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.graalvm.buildtools:native-maven-plugin	1.1.14	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 5 binaries present in source code Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• examples/powertools-examples-cloudformation/pom.xml
• examples/powertools-examples-core-utilities/sam-graalvm/pom.xml
• examples/powertools-examples-idempotency/sam-graalvm/pom.xml
• examples/powertools-examples-parameters/sam-graalvm/pom.xml
• examples/powertools-examples-serialization/sam-graalvm/pom.xml
• pom.xml
• powertools-e2e-tests/handlers/pom.xml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud