From 8e6f1137f078354bb958c62b3889366f68bcd1eb Mon Sep 17 00:00:00 2001 From: sharanmoore <24194251+sharanmoore@users.noreply.github.com> Date: Thu, 22 Oct 2026 11:43:48 +0100 Subject: [PATCH 1/3] [docs] note fixed JDKs for eMudhra CA compromise The client trusts the JDK's bundled cacerts, so customers need a JDK build with the eMudhra fix. Part of PLA-176. --- README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/README.md b/README.md index f452033..20ee019 100644 --- a/README.md +++ b/README.md @@ -170,6 +170,21 @@ GradientLabsClient client = GradientLabsClient.builder() - Java 17 or higher - Jackson 2.18+ for JSON serialization +### Security: eMudhra certificate authority compromise + +The client uses the JDK's built-in `HttpClient`, which trusts the CA +certificates bundled with your JDK (`cacerts`), not the operating system's +store. JDKs up to and including 27.0.1, 25.0.5, 21.0.13 and 17.0.21 still +trust the eMudhra intermediate certificate authorities compromised in +October 2026, which would let an attacker impersonate the Gradient Labs API +and capture your API key. + +Run JDK 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, or the equivalent +fixed build from your JDK vendor. JDKs installed from Linux distribution +packages use the OS certificate store, so updating the OS CA certificates is +enough for those. See the +[OpenJDK advisory](https://openjdk.org/groups/vulnerability/advisories/2026-10-21). + ## Documentation - [API Documentation](https://api-docs.gradient-labs.ai) From d96991476f464ef8e96541b87fcdfc4fcaa8325b Mon Sep 17 00:00:00 2001 From: sharanmoore <24194251+sharanmoore@users.noreply.github.com> Date: Thu, 22 Oct 2026 11:50:16 +0100 Subject: [PATCH 2/3] [ci] build on Oracle JDK 25 with the eMudhra fix Temurin has no fixed build yet; Oracle 25.0.5.0.2 is the first free one. Switch the pom to maven.compiler.release 17 so the bytecode target and API surface stay Java 17. Also document the blocked.certs and revocation-check workarounds for customers. Part of PLA-176. --- .github/workflows/ci.yml | 9 ++++++--- .github/workflows/release.yml | 10 ++++++---- README.md | 6 ++++++ pom.xml | 6 ++---- 4 files changed, 20 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9554efb..c328664 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,11 +12,14 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Set up JDK 17 + # Oracle JDK 25 is the first freely available build with the eMudhra CA + # fix (25.0.5.0.2); Temurin hasn't shipped one yet. The bytecode target + # stays Java 17 via maven.compiler.release in the root pom. + - name: Set up JDK 25 uses: actions/setup-java@v4 with: - java-version: '17' - distribution: 'temurin' + java-version: '25' + distribution: 'oracle' cache: maven - name: Build and test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5686f12..e2dc4c9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,12 +11,14 @@ jobs: steps: - uses: actions/checkout@v4 - # Must match maven.compiler.target in the root pom (17), and the CI workflow. - - name: Set up JDK 17 + # Oracle JDK 25 is the first freely available build with the eMudhra CA + # fix (25.0.5.0.2); Temurin hasn't shipped one yet. The bytecode target + # stays Java 17 via maven.compiler.release in the root pom. + - name: Set up JDK 25 uses: actions/setup-java@v4 with: - java-version: '17' - distribution: 'temurin' + java-version: '25' + distribution: 'oracle' cache: maven server-id: central server-username: SONATYPE_USERNAME diff --git a/README.md b/README.md index 20ee019..ccf7a55 100644 --- a/README.md +++ b/README.md @@ -185,6 +185,12 @@ packages use the OS certificate store, so updating the OS CA certificates is enough for those. See the [OpenJDK advisory](https://openjdk.org/groups/vulnerability/advisories/2026-10-21). +If your JDK vendor hasn't shipped a fixed build yet, Oracle's +[advisory](https://ops.java/emudhra) describes two workarounds: replace +`$JAVA_HOME/lib/security/blocked.certs` with the version it links to, or +enable revocation checking with +`-Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true`. + ## Documentation - [API Documentation](https://api-docs.gradient-labs.ai) diff --git a/pom.xml b/pom.xml index 7d9a9d8..bd82efc 100644 --- a/pom.xml +++ b/pom.xml @@ -43,8 +43,7 @@ UTF-8 - 17 - 17 + 17 2.19.0 6.0.0 5.11.4 @@ -156,8 +155,7 @@ maven-compiler-plugin 3.13.0 - 17 - 17 + 17 From 0c901cf4bd42ca8fcd5607992169b15f89ea9f3a Mon Sep 17 00:00:00 2001 From: sharanmoore <24194251+sharanmoore@users.noreply.github.com> Date: Thu, 22 Oct 2026 12:04:01 +0100 Subject: [PATCH 3/3] [ci] bump setup-java to v5 setup-java v4 is deprecated and warns on every run. --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c328664..c326e6b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: # fix (25.0.5.0.2); Temurin hasn't shipped one yet. The bytecode target # stays Java 17 via maven.compiler.release in the root pom. - name: Set up JDK 25 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '25' distribution: 'oracle' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e2dc4c9..646cd73 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: # fix (25.0.5.0.2); Temurin hasn't shipped one yet. The bytecode target # stays Java 17 via maven.compiler.release in the root pom. - name: Set up JDK 25 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '25' distribution: 'oracle'