[konveyor-ci-bot]

• 🐛 Bump JDT LS 1.60.0 -> 1.63.0 to pick up fixed jsoup

The jdtls tarball bundled in the image ships the vulnerable Java libraries
flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9:

• jsoup 1.19.1 -> 1.23.2 fixes CVE-2026-75140 (and CVE-2026-71497)
• apache ant 1.10.17 -> 1.10.18 (1.10.17 was already past the CVE-2026-78254 fix)

Bumps the jdtls download URL (Dockerfile, Dockerfile.test) and the Tycho
build target platform (java-analyzer-bundle.target) from 1.60.0 to 1.63.0.

Known gap: guava is still vulnerable to CVE-2026-102554 (needs >= 33.7.2);
jdtls 1.63.0 ships 33.7.1 and no OSGi-packaged 33.7.2 exists upstream yet, so
that one cannot be resolved by a jdtls bump and is tracked separately.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Signed-off-by: Dylan Murray dymurray@redhat.com

• Run JDT.LS on Java 25

JDT.LS 1.63.0 is built on Eclipse 2026-09, whose bundles (e.g.
org.eclipse.core.filesystem) require a JavaSE-25 runtime. Running the
server on Java 21 fails OSGi resolution and the application aborts at
initialize with "An error has occurred. See the log file", which breaks
the Phase 2 integration tests.

Bump the runtime JDK in the final image to java-25-openjdk. The Tycho
build stage stays on Java 21 since ECJ compiles against the Java 25
bundles without issue.

Signed-off-by: Juanma Leflet Estrada jleflete@redhat.com

---

Signed-off-by: Dylan Murray dymurray@redhat.com
Signed-off-by: Juanma Leflet Estrada jleflete@redhat.com
Co-authored-by: Claude Opus 4.8 noreply@anthropic.com
Co-authored-by: Juanma Leflet Estrada jleflete@redhat.com
Signed-off-by: Cherry Picker noreply@github.com

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e9c8f1ac-bd33-43c0-8077-9dcdc73e6c0a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn