release(nzbhydra2): update docker.io/library/eclipse-temurin ( 17 → 25 )

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/eclipse-temurin (source)	final	major	17-jre-alpine-3.22 → 25-jre-alpine-3.22

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (Adoptium Temurin JRE, Alpine variant)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22 (JDK 17 → JDK 25, both LTS; 25 is the JDK 25 LTS line, resolved binary Java 25.0.4)
• Type: major (runtime base image)

Release Changes

• JDK 25 (GA 2025-09-16, LTS per JSR 400). JEPs delivered between our current 17 and 25 that are relevant at runtime (source: openjdk.org/projects/jdk/25 and the JEPs-since-JDK-21 list):
  • JEP 486 (24): Security Manager permanently disabled — System.setSecurityManager now throws
  • JEP 471 (23) / JEP 498 (24): sun.misc.Unsafe memory-access methods deprecated for removal, runtime warnings on first use; removal planned in a future release
  • JEP 472 (24): prepare to restrict JNI (warnings)
  • JEP 519 (25): Compact Object Headers (product option, off by default), JEP 521 (25): Generational Shenandoah (not the default GC; G1 remains default on this platform)
  • JEP 503 (25): 32-bit x86 port removed (irrelevant — amd64/arm64 only)
• Temurin container changes: none relevant; 25-jre-alpine-3.22 exists on Docker Hub for linux/amd64 and linux/arm64 (verified via Docker Hub API, manifest digest sha256:824157b4…). This repo builds only linux/amd64 (apps/nzbhydra2/docker-bake.hcl image-all).

Breaking Changes

None affecting our usage — verified empirically, not assumed:

Empirical validation (built from this PR's branch and run locally):

• Build: docker buildx bake equivalent build of the PR branch (git context #renovate/nzbhydra2-docker.io-library-eclipse-temurin-25.x:apps/nzbhydra2) with VERSION=8.9.0 succeeds. The 25-jre-alpine-3.22 base still provides busybox wget/unzip needed by the Dockerfile RUN step.
• Runtime: nzbhydra2 v8.9.0 boots cleanly — log line Starting NzbHydra using Java 25.0.4, Tomcat started on port(s): 5076, Started NzbHydra in 9.705 seconds. Java 17 baseline: Started NzbHydra in 10.738 seconds (same app version, same host).
• tests.yaml equivalence: java process running (PID 1), listen socket :::5076 (matches the tcp6:5076 goss check), GET / returns 200 with 5618 bytes — byte-identical to the Java 17 baseline.
• No sun.misc.Unsafe warnings, no illegal reflective access warnings, no InaccessibleObjectException in the Java 25 logs. The one ERROR in logs (OutdatedWrapperDetector: Didn't find any of the expected wrapper files…) also appears identically on Java 17 — pre-existing packaging artifact (the image ships only the exec jar, not the python wrappers), not a regression from this PR.

Caveats a maintainer should weigh (documented, not observed):

• Upstream's readme states: "You need to install Java 17 (not lower, not higher)" — upstream explicitly documents Java 17 as the required runtime.
• The app is Spring Boot 3.1.5 (verified in upstream pom.xml, maven.compiler.source/target=17), a release line that predates JDK 25 GA by two years and does not list JDK 25 in its tested/supported range.
• sun.misc.Unsafe removal (targeted after JDK 25) may affect older transitive dependencies in future JDKs — this will surface as warnings first.

Code Changes Required

None. The Dockerfile ENTRYPOINT flags are compatible with JDK 25:

• -XX:MaxRAMPercentage=75.0 — valid
• -Dfile.encoding=UTF8 — still valid (UTF-8 is default since JEP 400 in 18)
• -Dsun.security.pkcs11.enable-solaris=false — unknown/inert system property, harmless
  No version references exist in docker-bake.hcl (only the app VERSION=8.9.0, unchanged). tests.yaml needs no changes (process/port/http checks verified passing on Java 25).

Security Impact

JDK 17 → 25 brings two LTS generations of security fixes (JDK 21 + 24 CPU/PSU cycles and JDK 25 up to 25.0.4), including crypto and TLS hardening. nzbhydra2 is an internet-facing indexer proxy, so staying on a current LTS JRE reduces exposure. No new attack surface introduced by the base image swap itself (same Alpine 3.22 userland, same non-root nobody:nogroup user, same single-process model).

Recommendation

Needs manual review — the image builds and the app functions correctly on Java 25 (verified by an actual build + run + HTTP/port/process checks from this PR's branch), but this is a major runtime base image bump, which is excluded from auto-merge by repo policy. Additionally, upstream documents Java 17 "not lower, not higher" as the supported runtime and the app runs on an EOL Spring Boot 3.1.x line that predates JDK 25. Functional smoke tests pass; the risk is medium-term (untested-by-upstream runtime, not immediate breakage). A maintainer should decide whether tracking the newest LTS JRE outweighs diverging from upstream's documented runtime. Do not merge under the automated policy.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: docker.io/library/eclipse-temurin (runtime base image for apps/nzbhydra2)
• Version: 17-jre-alpine-3.22 → 25-jre-alpine-3.22
• Type: major (JRE LTS line 17 → 21 → 25)

Release Changes

This jumps two LTS lines (17 → 21 → 25). Notable JDK changes along the way (Temurin = OpenJDK builds, so the JDK JEP/release notes apply):

• JDK 21 (LTS): virtual threads finalized, generational ZGC, pattern matching refinements — no runtime-behavior impact for existing bytecode
• JDK 25 (LTS): continues JDK 22–24 removals (SecurityManager deprecated for removal, sun.misc.Unsafe memory-access methods progressively deprecated, native-access restrictions enforced with warnings)
• Temurin container changes between the tags: Alpine 3.22 base stays the same; both tags include busybox wget/unzip used by the Dockerfile build stage (verified empirically — build succeeded)
• Regular quarterly CPU security fixes are included in the 25.0.x line

Breaking Changes

None that block our usage, with caveats:

• nzbhydra2 8.9.0 is compiled for Java 17 (<source>17</source>/<target>17</target> in upstream pom.xml) on Spring Boot 3.1.5. Java 25 runs Java 17 bytecode, and Spring Boot 3.1's officially supported matrix tops out below 25 — it works in practice (verified below) but is outside the framework's supported configuration.
• The ENTRYPOINT flag -Dsun.security.pkcs11.enable-solaris=false (apps/nzbhydra2/Dockerfile:25) refers to a property that no longer exists in JDK 25; unknown -D properties are ignored by the JVM, so it is harmless but dead — a candidate for removal.
• Startup emits a JDK 25 warning: tomcat-embed-core 10.1.15 calls java.lang.System::load (restricted native access). It is a warning only today; a future JDK will block it unless --enable-native-access=ALL-UNNAMED is added. Not actionable for this PR, but it will resurface on JDK 26+.
• -XX:MaxRAMPercentage and -Dfile.encoding=UTF8 remain valid in JDK 25 (the latter is now the default since JEP 400).

Code Changes Required

None required. Optional cleanups a maintainer may consider (not blockers):

• Drop the dead -Dsun.security.pkcs11.enable-solaris=false from the ENTRYPOINT (apps/nzbhydra2/Dockerfile:25)
• Pin the base image by sha256 digest, consistent with the repo's pin-everything principle (this app currently pins by tag only)

Security Impact

Moving 17 → 25 brings the accumulated CPU security fixes of the 21 and 25 LTS lines, which is a net positive for this internet-facing web UI image. The native-access warning above slightly narrows future compatibility, not the current security posture.

Verification Performed

• Built the image with the new base (eclipse-temurin:25-jre-alpine-3.22, resolved to sha256:824157b4a5a6...) and nzbhydra2 8.9.0 via docker buildx bake --no-cache --load: build succeeded.
• Ran the container: log line Starting NzbHydra using Java 25.0.4 with PID 1 (/app/nzbhydra2.jar started by nobody in /config).
• All three goss assertions from apps/nzbhydra2/tests.yaml verified by hand:
  • process: java: running: true → docker top shows nobody java -XX:MaxRAMPercentage=75.0 ... -jar /app/nzbhydra2.jar
  • port: tcp6:5076: listening: true → netstat -tln inside the container shows :::5076 LISTEN
  • http://localhost:5076: status 200 → wget -S inside the container returns HTTP/1.1 200
• Multi-arch: this app builds linux/amd64 only (docker-bake.hcl image-all), so no cross-arch divergence.

Recommendation

Needs manual review — this is a major version bump of a runtime base image (JRE 17 → 25), which changes the container's runtime environment and moves the app outside Spring Boot 3.1's officially supported Java matrix, even though the full test suite passes empirically on Java 25.0.4. Per repo policy this class of update is never auto-merged; a maintainer should decide whether to accept the newer-JVM risk profile (including the tomcat native-access deprecation warning) or hold on 17/21.