Modernize build toolchain: Gradle 9, bytecode-processing tooling bumps

CLAUDE.md

@@ -2,6 +2,10 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+## Requirements
+
+The build runs on Gradle 9.x, which requires a JVM of **17 or higher** to run the Gradle daemon itself. Compilation targets Java 17 via the toolchain declared in `bdk.java-common-conventions` — the daemon JVM and the toolchain JVM are independent, so contributors on a newer daemon JDK still produce Java 17 bytecode.
+
 ## Build & Test Commands
 
 ```bash
@@ -49,7 +53,7 @@ OBO (On-Behalf-Of) flows are surfaced through `OboServices` / `OboService`, whic
 
 Four Groovy convention plugins used by sub-modules:
 
-- `bdk.java-common-conventions` — Java 17, UTF-8, JaCoCo, JUnit Platform, sources+javadoc jars, BOM platform import
+- `bdk.java-common-conventions` — Java 17 toolchain, UTF-8, JaCoCo, JUnit Platform, sources+javadoc jars, BOM platform import
 - `bdk.java-library-conventions` — extends common + `java-library` plugin (used by all published libs)
 - `bdk.java-publish-conventions` — `maven-publish` + `signing`; signing is **only required for release versions** (`isReleaseVersion = !version.endsWith('SNAPSHOT')`)
 - `bdk.java-codegen-conventions` — OpenAPI Generator (Jersey2, Java 8 date library) reading `src/main/resources/api.yaml`; generated sources land in `build/generated/openapi`

allow-list.xml

@@ -32,6 +32,15 @@
         <packageUrl regex="true">^pkg:maven/io\.netty/netty.*@.*$</packageUrl>
         <cve>CVE-2026-42582</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+          CVE-2026-56816 is a high-severity memory exhaustion vulnerability in Netty's HTTP/3 codec (Http3FrameCodec).
+          BDK does not use netty-codec-http3 or HTTP/3 capabilities, so this is unreachable.
+          Netty 4.1.136.Final is the latest 4.1.x release and no 4.1.x patch exists. Suppressing pending a 4.1.137+ release.
+          ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.netty/netty.*@.*$</packageUrl>
+        <cve>CVE-2026-56816</cve>
+    </suppress>
     <suppress>
         <notes><![CDATA[
           handlebars.java 4.5.0 still bundles handlebars-v4.7.7.js as a resource. We use the

build.gradle

@@ -3,12 +3,12 @@ plugins {
     id "org.owasp.dependencycheck" version "12.2.2"
 }
 
-ext.projectVersion = project.properties['projectVersion'] ?: '0.0.0-SNAPSHOT'
+ext.projectVersion = project.findProperty('projectVersion') ?: '0.0.0-SNAPSHOT'
 ext.isReleaseVersion = !ext.projectVersion.endsWith('SNAPSHOT')
 
-ext.mavenRepoUrl = project.properties['mavenRepoUrl'] ?: 'https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/'
-ext.mavenRepoUsername = project.properties['mavenRepoUsername'] ?: 'Symphony artifactory user'
-ext.mavenRepoPassword = project.properties['mavenRepoPassword'] ?: 'Symphony artifactory password'
+ext.mavenRepoUrl = project.findProperty('mavenRepoUrl') ?: 'https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/'
+ext.mavenRepoUsername = project.findProperty('mavenRepoUsername') ?: 'Symphony artifactory user'
+ext.mavenRepoPassword = project.findProperty('mavenRepoPassword') ?: 'Symphony artifactory password'
 
 ext.pomDefinition = {
     url = 'https://symphony-bdk-java.finos.org'
@@ -35,7 +35,7 @@ ext.pomDefinition = {
 
 allprojects {
     group = 'org.finos.symphony.bdk'
-    version = projectVersion
+    version = rootProject.ext.projectVersion
 
     defaultTasks 'build'
 }

buildSrc/build.gradle

@@ -9,7 +9,7 @@ repositories {
 dependencies {
     implementation 'org.openapitools:openapi-generator-gradle-plugin:6.6.0'
     implementation 'de.undercouch:gradle-download-task:5.0.2'
-    implementation 'com.github.ben-manes:gradle-versions-plugin:0.42.0'
+    implementation 'com.github.ben-manes:gradle-versions-plugin:0.54.0'
 }
 
 configurations.all {

buildSrc/src/main/groovy/bdk.java-codegen-conventions.gradle

@@ -9,7 +9,7 @@ dependencies {
 }
 
 
-def generatedFolder = "$buildDir/generated/openapi"
+def generatedFolder = "${layout.buildDirectory.get()}/generated/openapi"
 sourceSets.main.java.srcDirs += "$generatedFolder/src/main/java"
 
 tasks.compileJava.dependsOn tasks.openApiGenerate

buildSrc/src/main/groovy/bdk.java-common-conventions.gradle

@@ -9,7 +9,13 @@ repositories {
     mavenCentral()
 }
 
-sourceCompatibility = JavaVersion.VERSION_17
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(17)
+    }
+    withJavadocJar()
+    withSourcesJar()
+}
 
 tasks.withType(JavaCompile) {
     options.encoding = 'UTF-8'
@@ -21,9 +27,8 @@ javadoc {
     options.addStringOption('Xdoclint:none', '-quiet')
 }
 
-java {
-    withJavadocJar()
-    withSourcesJar()
+jacoco {
+    toolVersion = '0.8.15'
 }
 
 jar {

buildSrc/src/main/groovy/bdk.java-publish-conventions.gradle

@@ -22,15 +22,15 @@ publishing {
     repositories {
         maven {
             credentials {
-                username rootProject.ext.mavenRepoUsername
-                password rootProject.ext.mavenRepoPassword
+                username = rootProject.ext.mavenRepoUsername
+                password = rootProject.ext.mavenRepoPassword
             }
-            url rootProject.ext.mavenRepoUrl
+            url = rootProject.ext.mavenRepoUrl
         }
     }
 }
 
 signing {
-    required { rootProject.isReleaseVersion }
+    required = { rootProject.isReleaseVersion }
     sign publishing.publications.maven
 }

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists