[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/eclipse-temurin (source)	final	major	17-jre-alpine-3.22 → 25-jre-alpine-3.22

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (Adoptium Temurin JRE, Alpine variant)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22 (JDK 17 → JDK 25, both LTS; 25 is the JDK 25 LTS line, resolved binary Java 25.0.4)
• Type: major (runtime base image)

Release Changes

• JDK 25 (GA 2025-09-16, LTS per JSR 400). JEPs delivered between our current 17 and 25 that are relevant at runtime (source: openjdk.org/projects/jdk/25 and the JEPs-since-JDK-21 list):
  • JEP 486 (24): Security Manager permanently disabled — System.setSecurityManager now throws
  • JEP 471 (23) / JEP 498 (24): sun.misc.Unsafe memory-access methods deprecated for removal, runtime warnings on first use; removal planned in a future release
  • JEP 472 (24): prepare to restrict JNI (warnings)
  • JEP 519 (25): Compact Object Headers (product option, off by default), JEP 521 (25): Generational Shenandoah (not the default GC; G1 remains default on this platform)
  • JEP 503 (25): 32-bit x86 port removed (irrelevant — amd64/arm64 only)
• Temurin container changes: none relevant; 25-jre-alpine-3.22 exists on Docker Hub for linux/amd64 and linux/arm64 (verified via Docker Hub API, manifest digest sha256:824157b4…). This repo builds only linux/amd64 (apps/nzbhydra2/docker-bake.hcl image-all).

Breaking Changes

None affecting our usage — verified empirically, not assumed:

Empirical validation (built from this PR's branch and run locally):

• Build: docker buildx bake equivalent build of the PR branch (git context #renovate/nzbhydra2-docker.io-library-eclipse-temurin-25.x:apps/nzbhydra2) with VERSION=8.9.0 succeeds. The 25-jre-alpine-3.22 base still provides busybox wget/unzip needed by the Dockerfile RUN step.
• Runtime: nzbhydra2 v8.9.0 boots cleanly — log line Starting NzbHydra using Java 25.0.4, Tomcat started on port(s): 5076, Started NzbHydra in 9.705 seconds. Java 17 baseline: Started NzbHydra in 10.738 seconds (same app version, same host).
• tests.yaml equivalence: java process running (PID 1), listen socket :::5076 (matches the tcp6:5076 goss check), GET / returns 200 with 5618 bytes — byte-identical to the Java 17 baseline.
• No sun.misc.Unsafe warnings, no illegal reflective access warnings, no InaccessibleObjectException in the Java 25 logs. The one ERROR in logs (OutdatedWrapperDetector: Didn't find any of the expected wrapper files…) also appears identically on Java 17 — pre-existing packaging artifact (the image ships only the exec jar, not the python wrappers), not a regression from this PR.

Caveats a maintainer should weigh (documented, not observed):

• Upstream's readme states: "You need to install Java 17 (not lower, not higher)" — upstream explicitly documents Java 17 as the required runtime.
• The app is Spring Boot 3.1.5 (verified in upstream pom.xml, maven.compiler.source/target=17), a release line that predates JDK 25 GA by two years and does not list JDK 25 in its tested/supported range.
• sun.misc.Unsafe removal (targeted after JDK 25) may affect older transitive dependencies in future JDKs — this will surface as warnings first.

Code Changes Required

None. The Dockerfile ENTRYPOINT flags are compatible with JDK 25:

• -XX:MaxRAMPercentage=75.0 — valid
• -Dfile.encoding=UTF8 — still valid (UTF-8 is default since JEP 400 in 18)
• -Dsun.security.pkcs11.enable-solaris=false — unknown/inert system property, harmless
  No version references exist in docker-bake.hcl (only the app VERSION=8.9.0, unchanged). tests.yaml needs no changes (process/port/http checks verified passing on Java 25).

Security Impact

JDK 17 → 25 brings two LTS generations of security fixes (JDK 21 + 24 CPU/PSU cycles and JDK 25 up to 25.0.4), including crypto and TLS hardening. nzbhydra2 is an internet-facing indexer proxy, so staying on a current LTS JRE reduces exposure. No new attack surface introduced by the base image swap itself (same Alpine 3.22 userland, same non-root nobody:nogroup user, same single-process model).

Recommendation

Needs manual review — the image builds and the app functions correctly on Java 25 (verified by an actual build + run + HTTP/port/process checks from this PR's branch), but this is a major runtime base image bump, which is excluded from auto-merge by repo policy. Additionally, upstream documents Java 17 "not lower, not higher" as the supported runtime and the app runs on an EOL Spring Boot 3.1.x line that predates JDK 25. Functional smoke tests pass; the risk is medium-term (untested-by-upstream runtime, not immediate breakage). A maintainer should decide whether tracking the newest LTS JRE outweighs diverging from upstream's documented runtime. Do not merge under the automated policy.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image for apps/nzbhydra2)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22
• Type: major (JRE LTS line 17 → 21 → 25)

Release Changes

This jumps two LTS lines (17 → 21 → 25). Notable JDK changes along the way (Temurin = OpenJDK builds, so the JDK JEP/release notes apply):

• JDK 21 (LTS): virtual threads finalized, generational ZGC, pattern matching refinements — no runtime-behavior impact for existing bytecode
• JDK 25 (LTS): continues JDK 22–24 removals (SecurityManager deprecated for removal, sun.misc.Unsafe memory-access methods progressively deprecated, native-access restrictions enforced with warnings)
• Temurin container changes between the tags: Alpine 3.22 base stays the same; both tags include busybox wget/unzip used by the Dockerfile build stage (verified empirically — build succeeded)
• Regular quarterly CPU security fixes are included in the 25.0.x line

Breaking Changes

None that block our usage, with caveats:

• nzbhydra2 8.9.0 is compiled for Java 17 (<source>17</source>/<target>17</target> in upstream pom.xml) on Spring Boot 3.1.5. Java 25 runs Java 17 bytecode, and Spring Boot 3.1's officially supported matrix tops out below 25 — it works in practice (verified below) but is outside the framework's supported configuration.
• The ENTRYPOINT flag -Dsun.security.pkcs11.enable-solaris=false (apps/nzbhydra2/Dockerfile:25) refers to a property that no longer exists in JDK 25; unknown -D properties are ignored by the JVM, so it is harmless but dead — a candidate for removal.
• Startup emits a JDK 25 warning: tomcat-embed-core 10.1.15 calls java.lang.System::load (restricted native access). It is a warning only today; a future JDK will block it unless --enable-native-access=ALL-UNNAMED is added. Not actionable for this PR, but it will resurface on JDK 26+.
• -XX:MaxRAMPercentage and -Dfile.encoding=UTF8 remain valid in JDK 25 (the latter is now the default since JEP 400).

Code Changes Required

None required. Optional cleanups a maintainer may consider (not blockers):

• Drop the dead -Dsun.security.pkcs11.enable-solaris=false from the ENTRYPOINT (apps/nzbhydra2/Dockerfile:25)
• Pin the base image by sha256 digest, consistent with the repo's pin-everything principle (this app currently pins by tag only)

Security Impact

Moving 17 → 25 brings the accumulated CPU security fixes of the 21 and 25 LTS lines, which is a net positive for this internet-facing web UI image. The native-access warning above slightly narrows future compatibility, not the current security posture.

Verification Performed

• Built the image with the new base (eclipse-temurin:25-jre-alpine-3.22, resolved to sha256:824157b4a5a6...) and nzbhydra2 8.9.0 via docker buildx bake --no-cache --load: build succeeded.
• Ran the container: log line Starting NzbHydra using Java 25.0.4 with PID 1 (/app/nzbhydra2.jar started by nobody in /config).
• All three goss assertions from apps/nzbhydra2/tests.yaml verified by hand:
  • process: java: running: true → docker top shows nobody java -XX:MaxRAMPercentage=75.0 ... -jar /app/nzbhydra2.jar
  • port: tcp6:5076: listening: true → netstat -tln inside the container shows :::5076 LISTEN
  • http://localhost:5076: status 200 → wget -S inside the container returns HTTP/1.1 200
• Multi-arch: this app builds linux/amd64 only (docker-bake.hcl image-all), so no cross-arch divergence.

Recommendation

Needs manual review — this is a major version bump of a runtime base image (JRE 17 → 25), which changes the container's runtime environment and moves the app outside Spring Boot 3.1's officially supported Java matrix, even though the full test suite passes empirically on Java 25.0.4. Per repo policy this class of update is never auto-merged; a maintainer should decide whether to accept the newer-JVM risk profile (including the tomcat native-access deprecation warning) or hold on 17/21.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image for apps/nzbhydra2)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22
• Type: major (LTS→LTS runtime JDK jump: 17 → 25, skipping 21)

Release Changes

Docker base image swap; the app layer (nzbhydra2 8.9.0 generic.zip) is untouched. JDK 17→25 deltas relevant at runtime:

• JEP 486 (JDK 24): Security Manager permanently disabled
• JEP 472 (JDK 24): sun.misc.Unsafe memory-access methods warn on JDK 25 unless --enable-native-access=ALL-UNNAMED; future JDKs will throw
• JEP 400 (JDK 18): default charset already UTF-8 (consistent with our -Dfile.encoding=UTF8)
• Compact object headers (JEP 519) and GC improvements — performance only

Breaking Changes

Unverified-but-material risk; upstream signals conflict with this bump:

• readme.md:103 of theotherp/nzbhydra2 states the required Java is "17 (not lower, not higher)" — fetched from master today
• pom.xml builds with maven.compiler.source/target 17; app runs on Spring Boot 3.1.5 / Spring Framework 6.0.x, whose support matrix tops out at JDK 21 — JDK 25 is unsupported territory for the bundled Spring/Tomcat stack
• ENTRYPOINT JVM flags remain syntactically valid on 25 (-Dsun.security.pkcs11.enable-solaris=false is a no-op, -XX:MaxRAMPercentage unchanged), so failures, if any, would surface at runtime (class init, Unsafe warnings, removed internal APIs) — not at build time
• CI on this PR only proves the image builds (Build nzbhydra2 / Build (linux/amd64) pass); the goss tests (java process up, tcp6:5076 listening, HTTP 200) are not exercised in CI

Code Changes Required

None mandatory for the PR mechanics (single FROM line, apps/nzbhydra2/Dockerfile:3; bake is linux/amd64-only and the 25-jre-alpine-3.22 tag exists). However, before this can merge someone must runtime-validate task local-build-nzbhydra2 with the goss suite.

Security Impact

JDK 25 LTS receives current security patches; JDK 17 remains in support. No exploitable condition fixed here affects this image today. Note: this FROM line is tag-pinned, not sha256-digest-pinned — pre-existing deviation from repo policy, worth a separate fix.

Recommendation

Needs manual review — major runtime base image bump (auto-merge excluded by policy), and upstream documents Java 17 "not higher" with a Spring Boot 3.1.5 stack that does not support JDK 25. Suggested options: (a) close this PR and stay on 17 until upstream moves, (b) retarget to 21-jre-alpine-3.22 after local goss validation, or (c) merge only after a maintainer runs the full local build + goss tests against JRE 25 and confirms nzbhydra2 8.9.0 starts and serves on port 5076.

[github-actions]

Renovate PR Analysis

(Re-analysis: previous comments predate this PR's latest update.)

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image, apps/nzbhydra2/Dockerfile:3)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22
• Type: major (LTS 17 → LTS 25, skipping 21)

Release Changes

Base image update, not an app release. Verified the target tag exists with linux/amd64 and linux/arm64 manifests (docker manifest inspect docker.io/library/eclipse-temurin:25-jre-alpine-3.22, amd64 digest sha256:8149a3ac…). This image builds linux/amd64 only (apps/xianscan-style platforms list confirmed in apps/nzbhydra2/docker-bake.hcl:33 — ["linux/amd64"]). Upstream nzbhydra2 publishes no JVM reference image to compare against (their own beta image is the native build on ubuntu:24.04 — docker/beta/Dockerfile at tag v9.0.1).

Breaking Changes

None observed in CI: PR-branch Build nzbhydra2 / Build (linux/amd64) is green with VERSION=8.9.0 on temurin 25, including the goss app-tests (java process running, tcp6:5076 listening, HTTP 200). The ENTRYPOINT JVM flags (-XX:MaxRAMPercentage=75.0, -Dsun.security.pkcs11.enable-solaris=false, -Dfile.encoding=UTF8) remain valid on Java 25. Residual risk is runtime-behavior drift across two LTS jumps (GC defaults, deprecation warnings) that the smoke tests wouldn't surface.

Code Changes Required

None required for build/tests. Considerations for a maintainer:

• Ordering vs release(nzbhydra2): update theotherp/nzbhydra2 ( v8.9.0 → v9.0.2 ) #298 (nzbhydra2 9.0.1): both PRs touch apps/nzbhydra2; whichever merges second should rebase cleanly since they edit different files (Dockerfile vs docker-bake.hcl)
• The FROM line remains tag-pinned (no sha256 digest), consistent with the current file

Security Impact

Neutral-to-positive: newer LTS track for OpenJDK security fixes. No specific CVE motivates this bump (temurin 17 is also actively patched).

Recommendation

Needs manual review — major version bump of a runtime base image in apps/ is an explicit never-auto-merge exclusion: it changes the container's runtime environment for every nzbhydra2 user. CI is green, so evidence says it works, but the LTS jump (17 → 25) deserves maintainer sign-off, ideally validated alongside #298's app major.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image of apps/nzbhydra2)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22
• Type: major (Java 17 LTS → Java 25 LTS, four majors: 18, 19, 20, 21, 22, 23, 24, 25)

Release Changes

Java 17 → 25 spans two LTS cycles (21, 25). Highlights relevant to a Spring Boot JRE deployment:

• JEP-backed performance work: generational ZGC default improvements, compact object headers (25), ahead-of-class-loading hints, virtual threads matured (21+)
• Continued TLS/crypto stack updates and JDK CVE fixes — running a current LTS JRE keeps the runtime patched on upstream's support horizon (Temurin 17 is supported into 2027+; 25 is the current LTS with the longest runway)
• Stronger defaults: JDK 21+ tightened SecurityManager deprecation path (removed in 24), stricter jar/classloading behaviors in edge cases

Breaking Changes

• Upstream explicitly documents Java 17 only. The readme bundled with nzbhydra2 v9.0.5 states: "You need to install Java 17 (not lower, not higher)." The changelog contains no Java 21/25 support statement (verified by grepping changelog.md and readme.md from the v9.0.5 release zip).
• NZBHydra2 historically hard-aborted on unsupported Java majors ("Abort on startup if incompatible Java version is used", v3.x era); v9.0.5 does not abort on 25 (verified empirically, below), but upstream gives no compatibility commitment for Java 25.

Code Changes Required

None mechanically required. Empirical validation performed by building this PR's Dockerfile with app v9.0.5 (post-#303 state):

• eclipse-temurin:25-jre-alpine-3.22 exists and resolved to digest sha256:0cb0fe65…
• Image builds cleanly via docker buildx bake; container starts as nobody on PID 1, logs Starting NzbHydra using Java 25.0.4, applies all 9 Flyway migrations, serves HTTP 200 on :5076
• ENTRYPOINT flags (-XX:MaxRAMPercentage=75.0, -Dsun.security.pkcs11.enable-solaris=false, -Dfile.encoding=UTF8) remain accepted on 25; only pre-existing logback deprecation warnings appear (identical to the Java 17 run)

Security Impact

Positive in principle: a current LTS JRE receives JDK security fixes for longer. No new exposure introduced by the swap itself (same alpine variant, same non-root user, same process model). Note the base is tag-pinned rather than digest-pinned in the Dockerfile — pre-existing condition, unchanged by this PR.

Recommendation

Needs manual review — major bump of the runtime base image for an app whose upstream documents "Java 17, not higher" as the supported runtime. My smoke test (fresh install, empty config) passes fully on Temurin 25, but indexer searches, updater behavior, and long-running database handling on Java 25 are untested upstream. Per repo policy, major runtime base bumps are never auto-merged. Suggested maintainer path: either hold at 17 until upstream declares Java 25 support (worth an upstream issue), or accept the empirical evidence here and merge after a soak test with a real /config volume.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image for apps/nzbhydra2)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22 (JDK 17 LTS → JDK 25 LTS)
• Type: major (runtime base image)

Release Changes

Jump from JDK 17 LTS to JDK 25 LTS (verified running image: OpenJDK 25.0.4.1 2026-08-18 LTS, Temurin-25.0.4.1+1). Spanning JDK 21 and JDK 25 LTS lines, relevant runtime changes:

• JDK 18+: file.encoding defaults to UTF-8 (our explicit -Dfile.encoding=UTF8 remains valid and is now redundant-but-harmless)
• Stronger encapsulation of JDK internals, tightened security defaults (TLS, certs) across the 17→25 range
• Periodic security fixes in the JVM/crypto stacks that Java 17 also receives via its own patch updates
• Alpine musl JRE packaging unchanged; same image layout (/opt/java/openjdk), nobody:nogroup user handling unchanged

Breaking Changes

• Upstream explicitly documents Java 17 only. The nzbhydra2 README states: "You need to install Java 17 (not lower, not higher)". Release history shows the app has a startup Java-version guard (v3.18.0: "Abort on startup if incompatible Java version is used") and the maintainer has historically enforced exact Java major versions (v3.16.0/v4.7.3 notes). Current 9.1.x builds tolerate Java 25 (verified below), but any app update could re-tighten that check or rely on Java-17-specific behavior.
• This is a major bump of a runtime base image in apps/ — per repo policy it requires maintainer sign-off even though smoke tests pass.

Code Changes Required

None strictly required to build/run:

• Tag 25-jre-alpine-3.22 exists on Docker Hub (linux/amd64 sha256:5fd51927e512..., linux/arm64 sha256:0b44e0d972...; pushed 2026-09-25), and the Dockerfile's RUN steps (wget/unzip from the Alpine-based JRE image) work unchanged.
• ENTRYPOINT JVM flags (-XX:MaxRAMPercentage=75.0, -Dsun.security.pkcs11.enable-solaris=false, -Dfile.encoding=UTF8) are all accepted by JDK 25.

Security Impact

JDK 25 LTS is the newest LTS line and will receive the newest JVM/security fixes sooner. Java 17 is still an LTS under support, so there is no urgent unpatched-CVE pressure forcing this bump. Neutral-to-positive for security; the risk here is upstream compatibility, not security.

Verification performed

Built and ran the image locally (Dockerfile with FROM eclipse-temurin:25-jre-alpine-3.22, VERSION=9.1.0):

• Build succeeds; app jar installed unchanged
• App starts on Java 25 with no version-guard abort: docker logs shows Version: 9.1.0, Started NzbHydra in 10.097 seconds
• java process running as nobody (rootless, unchanged)
• GET http://localhost:5076 returns HTTP 200; identical log output to the same app on Temurin 17 (only pre-existing OutdatedWrapperDetector wrapper-file warning, unrelated)
• Caveat: smoke test only (startup + HTTP 200). Search/indexer/downloader integration and long-run behavior on JDK 25 are not covered by tests.yaml or by this test.

Recommendation

Needs manual review — this is a major runtime base image bump for an app whose upstream explicitly documents Java 17 "not lower, not higher". Local smoke tests pass (build, startup, HTTP 200 on JDK 25.0.4.1), but upstream does not declare Java 25 support, and the app carries a Java-version guard that has been tightened before. A maintainer should either confirm upstream Java 25 support or defer this PR until the README constraint changes. Not merging per the repo's exclusion rule for major runtime base bumps.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image, apps/nzbhydra2/Dockerfile:3)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22 (Temurin LTS to LTS; both Alpine/musl)
• Type: major (runtime base image bump in apps/)

Release Changes

Java 17 → 25 spans LTS releases 21 and 25. Notable JDK changes in between: JEP 400 UTF-8 by default (17), virtual threads finalized (21), generational Shenandoah (21), compact object headers and AOT cache (24/25), removal of legacy Solaris-specific code paths, and continuing removal of deprecated security manager APIs (final removal in 25 per JEP 486). For this app the relevant delta is the JRE runtime only — no build toolchain involved (we consume the prebuilt generic.zip jar).

Breaking Changes

None observed empirically, but upstream support contract is explicitly against it:

• Upstream README ("How to Run"): "You need to install Java 17 (not lower, not higher)" — the developer's documented position (https://github.com/theotherp/nzbhydra2#how-to-run)
• Upstream pom.xml targets bytecode 17 (maven.compiler.release=17, verified in theotherp/nzbhydra2@master); bytecode 17 runs on a 25 JRE, so no class-version failure
• Our ENTRYPOINT flags (apps/nzbhydra2/Dockerfile:25) are all tolerated by JDK 25: -XX:MaxRAMPercentage is a live option; -Dsun.security.pkcs11.enable-solaris=false is a dead (ignored) -D property; -Dfile.encoding=UTF8 matches the JEP 400 default
• CI on this PR (run 36775349794): image builds, and goss tests pass — java process running, tcp6:5076 listening, http://localhost:5076 returns 200 (after ~17 s startup retries: "Count: 3, Failed: 0")

Code Changes Required

None required to build/run. The -Dsun.security.pkcs11.enable-solaris=false flag in apps/nzbhydra2/Dockerfile:25 is dead on any modern JDK and could be dropped for hygiene, but it is harmless.

Security Impact

Positive in principle: JDK 25 receives active CVE patches (JDK 17 free updates continue only until Oct 2027; 25 until at least 2030). Alpine 3.22 base is unchanged. No new exposure introduced.

Recommendation

Needs manual review — do not auto-merge. This is a major runtime-base bump (repo exclusion list) and upstream explicitly documents Java 17 "not higher". Empirical evidence on this PR is good (build + goss green on JDK 25), but future NZBHydra2 releases (VERSION var in docker-bake.hcl, currently 9.1.1) may rely on JDK 17-specific behavior; a maintainer should accept that support risk explicitly. Note Renovate automerge is already disabled for this PR.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image, apps/nzbhydra2/Dockerfile:3)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22 (LTS to LTS, Alpine 3.22 base unchanged)
• Type: major (runtime base image bump in apps/)

Release Changes

Java 17 → 25 spans LTS releases 21 and 25. Notable JDK deltas: JEP 400 UTF-8 default charset (18), finalized virtual threads (21), permanent Security Manager removal (JEP 486, 24), compact object headers + AOT cache improvements (24/25). For this image only the JRE runtime changes — we consume the prebuilt nzbhydra2-9.1.1-generic.zip jar (apps/nzbhydra2/Dockerfile:10), no build toolchain involved. Adoptium roadmap (verified 2026-10-08): JDK 17 EOL "at least Oct 2027"; JDK 25 "at least Sep 2031".

Breaking Changes

None observed empirically, but upstream's support contract explicitly disagrees:

• Upstream README "How to Run" (re-verified today from theotherp/nzbhydra2 master): "You need to install Java 17 (not lower, not higher)"
• Upstream pom.xml (re-verified today): maven.compiler.release=17, <source>17</source><target>17</target> — bytecode 17 runs on a 25 JRE, so no class-version failure now, but future releases may pin behavior to 17
• ENTRYPOINT flags (apps/nzbhydra2/Dockerfile:25) are all tolerated by JDK 25: -XX:MaxRAMPercentage=75.0 valid; -Dsun.security.pkcs11.enable-solaris=false is an inert no-op; -Dfile.encoding=UTF8 matches the JEP 400 default
• CI on this PR's current head (7ebea6f, run 36775349794): build SUCCESS and the app-tests step (dgoss via .github/actions/app-tests/run.sh) passed — java process running, tcp6:5076 listening, http://localhost:5076 returns 200

Code Changes Required

None required to build/run. Optional hygiene: -Dsun.security.pkcs11.enable-solaris=false in apps/nzbhydra2/Dockerfile:25 is dead on any modern JDK and could be dropped; harmless either way.

Security Impact

Positive: JDK 25 receives active CVE fixes with support to at least Sep 2031 vs Oct 2027 for JDK 17 (Adoptium roadmap). Alpine 3.22 userland unchanged. No new exposure introduced.

Recommendation

Needs manual review — do not auto-merge. This is a major version bump of a runtime base image (repo exclusion list), and upstream documents Java 17 "not lower, not higher". Empirical evidence on this PR is green (build + goss pass on JDK 25, run 36775349794), but a maintainer should explicitly accept the risk that future NZBHydra2 releases (VERSION var, currently 9.1.1) may assume JDK 17. Renovate automerge is already disabled for this PR.