revert to java 22 and javafx 24 due to bug in jpackage launcher linking (jdk-8345810)
What the developer wrote
Authored by Craig Raw
revert to java 22 and javafx 24 due to bug in jpackage launcher linking (jdk-8345810)
What changed, and why it matters
This commit rolls back the build toolchain from Java 25 and JavaFX 25 to Java 22.0.2 and JavaFX 24.0.2 because of a known upstream packaging bug in the Java Development Kit (JDK bug ID 8345810). It is a build/packaging workaround, not a code change inside the wallet itself. There is no direct evidence in the commit that this fixes a security vulnerability in Sparrow Wallet.
Treat this as a routine build compatibility revert. If the referenced JDK bug JDK-8345810 is later found to have security implications, reassess. No immediate security response is warranted based solely on this commit.
Security signals we found
Downgrades build toolchain versions
References upstream JDK bug JDK-8345810
No application code or cryptographic code modified
No mention of CVE, vulnerability, or security fix in commit message
Evidence from the diff
The diff changes two build files: .github/workflows/package.yaml now installs JDK 22.0.2 instead of 25.0.0, and build.gradle reverts the beryx jlink plugin from 3.1.4-rc to 3.1.3 and JavaFX from 25 to 24.0.2. The stated reason is a jpackage launcher linking bug tracked as JDK-8345810. The change affects only the build environment and bundled runtime, not application logic, cryptography, or wallet handling code.
Changed components
GitHub Actions package workflowGradle build configurationBundled JDK/JavaFX runtime versionsInspect captured patch +5 / −5
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 1c3b2e1..d18d555 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -15,11 +15,11 @@ jobs:
- uses: actions/checkout@v5
with:
submodules: true
- - name: Set up JDK 25
+ - name: Set up JDK 22.0.2
uses: actions/setup-java@v5
with:
distribution: 'temurin'
- java-version: '25.0.0'
+ java-version: '22.0.2'
- name: Show Build Versions
run: ./gradlew -v
- name: Build with Gradle
diff --git a/build.gradle b/build.gradle
index 7c21d22..1d6d167 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,7 +1,7 @@
plugins {
id 'application'
id 'org-openjfx-javafxplugin'
- id 'org.beryx.jlink' version '3.1.4-rc'
+ id 'org.beryx.jlink' version '3.1.3'
id 'org.gradlex.extra-java-module-info' version '1.13'
id 'io.matthewnelson.kmp.tor.resource-filterjar' version '408.16.3'
}
@@ -27,13 +27,13 @@ repositories {
maven { url = uri('https://code.sparrowwallet.com/api/packages/sparrowwallet/maven') }
}
-tasks.withType(AbstractArchiveTask) {
+tasks.withType(AbstractArchiveTask).configureEach {
preserveFileTimestamps = false
reproducibleFileOrder = true
}
javafx {
- version = headless ? "18" : "25"
+ version = headless ? "18" : "24.0.2"
modules = [ 'javafx.controls', 'javafx.fxml', 'javafx.swing', 'javafx.graphics' ]
}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.