Update bundled JDK to 25.0.4.1+1

[reta]

Description

Update bundled JDK to 25.0.4.1+1 (new JDK CPU release cadence).
See please https://www.oracle.com/security-alerts/cspuaug2026.html#AppendixJAVA

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 437824e.

⛔ Hard block: Issues at Medium severity or above will block this PR from merging.

Path	Line	Severity	Description
gradle/libs.versions.toml	6	high	Bundled JDK dependency version changed from '25.0.4+7' to '25.0.4.1+1'. Per mandatory policy, all dependency version changes must be flagged — maintainers should verify this artifact resolves to the expected Adoptium Temurin release and that the new build number is authentic.
buildSrc/src/main/java/org/opensearch/gradle/test/DistroTestPlugin.java	80	high	SYSTEM_JDK_VERSION and GRADLE_JDK_VERSION both changed from '25.0.4+7' to '25.0.4.1+1'. These constants drive JDK artifact resolution at build time; per mandatory policy, any dependency version change must be flagged for maintainer verification against the official Adoptium release catalog.
buildSrc/src/main/java/org/opensearch/gradle/JavaVariant.java	34	low	VERSION_PATTERN regex loosened to accept a 4-part version component (e.g., '25.0.4.1'). This is consistent with the JDK version bump above, but slightly broadens the accepted version string format. Worth confirming the new format is the only intended change and no other unexpected version strings are now matched.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 0 | High: 2 | Medium: 0 | Low: 1

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit ff7bf78)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Regex Correctness The updated VERSION_PATTERN uses (\.\d+\.\d+(?:\.\d+)?)? to allow an optional 4th version segment (e.g., 25.0.4.1). However, the capture group (\.\d+\.\d+(?:\.\d+)?)? still assigns the entire .0.4.1 string to group 2, which downstream consumers of the matcher groups may parse assuming a fixed 3-segment format. Verify that all callers extracting the version components (major/minor/patch) handle the new optional 4th segment correctly; otherwise version parsing could silently truncate or misinterpret 25.0.4.1+1. private static final Pattern VERSION_PATTERN = Pattern.compile( "(\\d+)(\\.\\d+\\.\\d+(?:\\.\\d+)?)?\\+(\\d+(?:\\.\\d+)?)(@([a-f0-9]{32}))?" );

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Verify version group parsing downstream The current regex captures the entire .\d+.\d+(?:.\d+)? sub-version in group 2, but downstream code that parses baseVersion likely expects the patch-level tuple. Verify that consumers of matcher group 2 correctly handle the new optional 4th version component (e.g., 25.0.4.1) rather than treating it as part of group 2 unchanged, otherwise version comparison/formatting may drop the emergency patch digit. buildSrc/src/main/java/org/opensearch/gradle/JavaVariant.java [34-36] +private static final Pattern VERSION_PATTERN = Pattern.compile( + "(\\d+)(\\.\\d+\\.\\d+(?:\\.\\d+)?)?\\+(\\d+(?:\\.\\d+)?)(@([a-f0-9]{32}))?" +); - Suggestion importance[1-10]: 4 __ Why: The suggestion only asks to verify downstream consumers of the regex groups without proposing an actual code change (existing_code equals improved_code). While the concern about the emergency patch digit is valid, it lacks a concrete fix.	Low

[github-actions]

❌ Gradle check result for 437824e: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

❌ Gradle check result for 437824e: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

❌ Gradle check result for 437824e: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

❌ Gradle check result for 437824e: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

Persistent review updated to latest commit ff7bf78

[github-actions]

❌ Gradle check result for ff7bf78: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

❌ Gradle check result for ff7bf78: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

✅ Gradle check result for ff7bf78: SUCCESS

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.63%. Comparing base (24a14b9) to head (ff7bf78).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #22808      +/-   ##
============================================
+ Coverage     71.58%   71.63%   +0.04%     
- Complexity    77353    77359       +6     
============================================
  Files          6170     6170              
  Lines        359700   359700              
  Branches      52459    52459              
============================================
+ Hits         257493   257655     +162     
+ Misses        81808    81644     -164     
- Partials      20399    20401       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[reta]

@andrross @cwperks could you please help me here folks? thank you