Build on a JDK with the eMudhra fix; note it for customers

.github/workflows/ci.yml

@@ -12,11 +12,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
+      # Oracle JDK 25 is the first freely available build with the eMudhra CA
+      # fix (25.0.5.0.2); Temurin hasn't shipped one yet. The bytecode target
+      # stays Java 17 via maven.compiler.release in the root pom.
+      - name: Set up JDK 25
+        uses: actions/setup-java@v5
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '25'
+          distribution: 'oracle'
           cache: maven
 
       - name: Build and test

.github/workflows/release.yml

@@ -11,12 +11,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Must match maven.compiler.target in the root pom (17), and the CI workflow.
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
+      # Oracle JDK 25 is the first freely available build with the eMudhra CA
+      # fix (25.0.5.0.2); Temurin hasn't shipped one yet. The bytecode target
+      # stays Java 17 via maven.compiler.release in the root pom.
+      - name: Set up JDK 25
+        uses: actions/setup-java@v5
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '25'
+          distribution: 'oracle'
           cache: maven
           server-id: central
           server-username: SONATYPE_USERNAME

README.md

@@ -170,6 +170,27 @@ GradientLabsClient client = GradientLabsClient.builder()
 - Java 17 or higher
 - Jackson 2.18+ for JSON serialization
 
+### Security: eMudhra certificate authority compromise
+
+The client uses the JDK's built-in `HttpClient`, which trusts the CA
+certificates bundled with your JDK (`cacerts`), not the operating system's
+store. JDKs up to and including 27.0.1, 25.0.5, 21.0.13 and 17.0.21 still
+trust the eMudhra intermediate certificate authorities compromised in
+October 2026, which would let an attacker impersonate the Gradient Labs API
+and capture your API key.
+
+Run JDK 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, or the equivalent
+fixed build from your JDK vendor. JDKs installed from Linux distribution
+packages use the OS certificate store, so updating the OS CA certificates is
+enough for those. See the
+[OpenJDK advisory](https://openjdk.org/groups/vulnerability/advisories/2026-10-21).
+
+If your JDK vendor hasn't shipped a fixed build yet, Oracle's
+[advisory](https://ops.java/emudhra) describes two workarounds: replace
+`$JAVA_HOME/lib/security/blocked.certs` with the version it links to, or
+enable revocation checking with
+`-Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true`.
+
 ## Documentation
 
 - [API Documentation](https://api-docs.gradient-labs.ai)

pom.xml

@@ -43,8 +43,7 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <maven.compiler.source>17</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
+        <maven.compiler.release>17</maven.compiler.release>
         <jackson.version>2.19.0</jackson.version>
         <jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
         <junit.version>5.11.4</junit.version>
@@ -156,8 +155,7 @@
                     <artifactId>maven-compiler-plugin</artifactId>
                     <version>3.13.0</version>
                     <configuration>
-                        <source>17</source>
-                        <target>17</target>
+                        <release>17</release>
                     </configuration>
                 </plugin>
                 <plugin>