Update java version to 25

[sondermanish]

Create plan for changing java version and find out all the caveats.

[sondermanish]

@claude evaluate this issue and write the findings in the description of the issue

[claude]

Claude finished @sondermanish's task in 2m 45s —— View job

---

Java 25 Upgrade Evaluation

Note: I don't have a tool to edit the issue description directly, so findings are posted here instead.

• Gather context - exploring repository structure
• Identify current Java version and configuration
• Research Java 25 features and breaking changes
• Write findings and upgrade plan

---

Current State

Item	Current Value
Java version	17
Build tool	Maven (no explicit compiler plugin version)
Spring Security Crypto	6.3.1
Key APIs used	HexFormat, Encryptors.delux(), Swing

---

Required Changes

1. pom.xml — Java version properties

<java.version>17</java.version>
<maven.compiler.source>17</maven.compiler.source>
<maven.compiler.target>17</maven.compiler.target>


<java.version>25</java.version>
<maven.compiler.release>25</maven.compiler.release>

Note: maven.compiler.release is preferred over source/target pair because it also enforces the bootstrap classpath, preventing accidental use of newer APIs.

2. pom.xml — Explicit Maven compiler plugin

The current pom.xml has no explicit maven-compiler-plugin version. Older plugin versions don't recognize Java 25 as a valid target. Add:

<build>
  <plugins>
    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-compiler-plugin</artifactId>
      <version>3.13.0</version>
    </plugin>
  </plugins>
</build>

3. pom.xml — Upgrade Spring Security Crypto

Spring Security Crypto 6.3.1 targets Java 17–21. Java 25 support requires 6.4.x or later.

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-crypto</artifactId>
    <version>6.4.4</version>  
</dependency>

---

Caveats and Breaking Changes (Java 17 → 25)

🔴 High Priority

1. salt.getBytes() without explicit charset (EncryptionTool.java:108)

// Current (potentially unsafe):
String saltHex = hexFormat.formatHex(salt.getBytes());

// JEP 400 (Java 18) made UTF-8 the default platform charset.
// On systems previously using a different default charset, this changes behavior.
// Should be explicit:
String saltHex = hexFormat.formatHex(salt.getBytes(StandardCharsets.UTF_8));

2. Removed deprecated ciphers (JEP 501, Java 24)

Java 24 permanently removed 13 deprecated cipher suites from the JDK's security libraries, including weak/legacy algorithms. Encryptors.delux() internally uses AES-256-CBC — which is not on the removed list. However, if any dependency transitively relies on DES, RC2, RC4, or similar, those calls will fail at runtime with no fallback.

3. Security Manager permanently disabled (JEP 486, Java 24)

The Security Manager was deprecated in Java 17 and is permanently disabled in Java 24+. If any code or library installs a SecurityManager, it will throw UnsupportedOperationException. Spring Security Crypto does not use it, so this project is not directly affected, but worth verifying when upgrading dependencies.

🟡 Medium Priority

4. sun.misc.Unsafe memory-access methods (JEP 471/498, Java 23/24)

Memory-access methods in sun.misc.Unsafe are deprecated for removal as of Java 23. Java 24 added runtime warnings. These may be removed in a future release. Spring Security Crypto may use libraries that call Unsafe internally (e.g., for byte buffer operations). Running mvn dependency:tree and checking for such usage is recommended.

5. JNI usage restrictions coming (JEP 472, Java 24)

Java 24 begins warning about JNI usage. Future releases may restrict it. Not directly relevant here, but relevant if any crypto provider uses native code (e.g., BouncyCastle's native backends).

6. ZGC non-generational mode removed (JEP 490, Java 24)

If any startup scripts use -XX:+UseZGC without -XX:+ZGenerationalGC, the flag combination will be invalid. Not applicable here (no startup scripts found), but worth noting for deployment environments.

🟢 No Action Needed

7. HexFormat class — Introduced in Java 17, fully stable in Java 25. No changes needed.

8. Swing — Still available and supported in Java 25. No deprecation for removal.

9. Lambda expressions and method references — Fully stable. No changes.

10. Virtual threads / structured concurrency — New features in Java 21+, not required changes, but available to use if desired.

---

Migration Plan

Step 1: Update pom.xml
  - Set maven.compiler.release=25 (replace source/target)
  - Add explicit maven-compiler-plugin 3.13.0
  - Upgrade spring-security-crypto to 6.4.x+

Step 2: Fix charset in EncryptionTool.java:108
  - salt.getBytes() → salt.getBytes(StandardCharsets.UTF_8)

Step 3: Verify no removed ciphers in dependency tree
  - mvn dependency:tree
  - Check for DES, RC2, RC4, MD2 usage

Step 4: Build and test with Java 25
  - mvn clean compile
  - mvn test (if tests exist)
  - Check for -Xlint:deprecation warnings

Step 5: CI/CD (if a build pipeline is added)
  - Use actions/setup-java with java-version: '25'
  - Use a distribution that ships Java 25 (e.g., temurin)

---

Risk Assessment

Risk	Severity	Likelihood
getBytes() charset change causes wrong hex salt	Medium	Low (most CI runs UTF-8)
Spring Security Crypto 6.3.1 incompatibility with Java 25	High	Medium
Removed cipher affects Encryptors.delux()	Low	Low (uses AES-256)
Maven compiler plugin not recognizing Java 25	High	High (must be fixed)
Unsafe/JNI warnings from transitive deps	Low	Low

Overall, this is a low-risk upgrade given the small codebase. The two mandatory changes are the pom.xml version bump and the Spring Security Crypto version upgrade. The getBytes() charset fix is a correctness improvement that should be included.

---