Upgrade from Java 17 to Java 25 with all dependencies

[rjthg]

Summary

• Upgrade Java toolchain from 17 to 25 across build, CI, and Docker
• Upgrade Gradle 7.4.2 to 9.3.1 (required for Java 25 support) and Shadow plugin to com.gradleup.shadow 9.3.1
• Bump all dependencies: AWS SDK 2.20.0 → 2.41.34, JUnit 5.8.1 → 5.14.2, Mockito 3.6.0 → 5.21.0, SLF4J 1.7.30 → 2.0.17
• Refactor S3Cleaner to accept bucketName via constructor instead of reading System.getenv() at runtime, removing the reflection-based env var hack in tests that Java 25 module encapsulation blocks

Changes

Component	Before	After
Java	17	25
Gradle	7.4.2	9.3.1
Shadow plugin	com.github.johnrengelman.shadow 7.1.2	com.gradleup.shadow 9.3.1
AWS SDK	2.20.0	2.41.34
JUnit	5.8.1	5.14.2
Mockito	3.6.0	5.21.0
SLF4J	1.7.30	2.0.17
Docker base image	eclipse-temurin:17.0.17_10-jre	eclipse-temurin:25-jre

Test plan

• ./gradlew build passes locally with all 20 tests green
• CI pipeline builds and tests successfully
• Docker image builds with the new base image
• Verify application runs correctly in staging environment

[sa-appSec01]

Checkmarx One – Scan Summary & Details – d0691724-84d5-40a4-95b3-bd61daef74a8

---

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Missing User Instruction	/Dockerfile: 2	details Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user. ID: TQlHhLRLRX356eUoWFkSwSPKiso%3D
2		Healthcheck Instruction Missing	/Dockerfile: 2	details Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working ID: R8HhtenFALXZkop6rC8lLqX6Q1o%3D

---

Fixed Issues (2)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	Missing User Instruction	/Dockerfile: 2
	Healthcheck Instruction Missing	/Dockerfile: 2

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

[Copilot]

Pull request overview

Upgrades the project’s Java/Gradle toolchain and dependency set to support Java 25, and adjusts the S3 cleanup implementation/tests to avoid Java 25’s stronger encapsulation restrictions around reflection.

Changes:

• Upgrade Gradle wrapper/scripts to Gradle 9.3.1 and update CI to build with JDK 25.
• Update application build to Java toolchain 25 and bump key dependencies (AWS SDK, JUnit, Mockito, SLF4J).
• Refactor S3Cleaner to take bucketName via constructor and update tests accordingly (removing env-var reflection hacks).

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
gradlew.bat	Updates Windows Gradle wrapper script for the new Gradle version.
gradlew	Updates Unix Gradle wrapper script for the new Gradle version.
gradle/wrapper/gradle-wrapper.properties	Points wrapper to Gradle 9.3.1 distribution and adds wrapper download hardening settings.
gradle/wrapper/gradle-wrapper.jar	Updates wrapper JAR to match the new Gradle version.
app/src/test/java/com/procure/thg/cockroachdb/S3CleanerTest.java	Removes reflection-based env var mutation; passes bucket name via constructor.
app/src/test/java/com/procure/thg/cockroachdb/AppTest.java	Updates S3Cleaner construction to include bucket name.
app/src/main/java/com/procure/thg/cockroachdb/S3Cleaner.java	Refactors cleaner to use constructor-injected bucketName instead of System.getenv() at runtime.
app/src/main/java/com/procure/thg/cockroachdb/App.java	Updates runtime wiring to pass BUCKET_NAME into S3Cleaner.
app/build.gradle	Updates Shadow plugin, dependencies, and Java toolchain to 25.
app/Dockerfile	Updates base image to Temurin 25 JRE.
.github/workflows/build.yml	Updates CI to run on JDK 25.

Comments suppressed due to low confidence (1)

app/src/main/java/com/procure/thg/cockroachdb/S3Cleaner.java:33

• bucketName is accepted without validation, but it’s used to build S3 requests (.bucket(bucketName)). If bucketName is null/blank this will fail at runtime (likely NPE or request validation error). Consider validating in the constructor (e.g., require non-null/non-blank) and throwing an IllegalArgumentException with a clear message to enforce the invariant for all call sites.

  public S3Cleaner(final S3Client s3Client, final String bucketName, final long thresholdSeconds, final String folder) {
    this.s3Client = s3Client;
    this.bucketName = bucketName;
    this.thresholdSeconds = thresholdSeconds;
    this.folder = folder != null && !folder.isEmpty() ?
            folder.endsWith("/") ? folder : folder + "/"
            : null;
  }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.