Use Constructor Injection + add JSpecify

.github/workflows/build.yml

@@ -7,7 +7,7 @@ on:
 
 env:
   NODE_VERSION: 22
-  JAVA_VERSION: 21
+  JAVA_VERSION: 25
 
 defaults:
   run:

.github/workflows/dependabot-frontend-build.yml

@@ -18,7 +18,7 @@ defaults:
 
 env:
   NODE_VERSION: 22
-  JAVA_VERSION: 21
+  JAVA_VERSION: 25
 
 jobs:
   test:

CHANGELOG.md

@@ -20,7 +20,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Updated Keycloak to 26.6.3
-- Update Quarkus to 3.27.3.1 LTS
+- Updated to Java 25
+- Update Quarkus to 3.33.2.1 LTS
 - Improved browser locale detection (#371)
 - Improved efficiency of keycloak-to-hub data sync (#377)
 - Improved efficiency of group-based access permission checks (#372)

backend/pom.xml

@@ -8,10 +8,11 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <project.jdk.version>21</project.jdk.version>
+        <project.jdk.version>25</project.jdk.version>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-        <quarkus.platform.version>3.27.3.1</quarkus.platform.version>
+        <quarkus.platform.version>3.33.2.1</quarkus.platform.version>
         <jwt.version>4.5.1</jwt.version>
+        <jspecify.version>1.0.0</jspecify.version>
         <compiler-plugin.version>3.15.0</compiler-plugin.version>
         <dependency-plugin.version>3.10.0</dependency-plugin.version>
         <surefire-plugin.version>3.5.5</surefire-plugin.version>
@@ -22,8 +23,8 @@
     <dependencyManagement>
         <dependencies>
             <dependency>
-                <groupId>io.quarkus</groupId>
-                <artifactId>quarkus-universe-bom</artifactId>
+                <groupId>io.quarkus.platform</groupId>
+                <artifactId>quarkus-bom</artifactId>
                 <version>${quarkus.platform.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
@@ -98,12 +99,12 @@
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
-            <artifactId>quarkus-junit5</artifactId>
+            <artifactId>quarkus-junit</artifactId>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
-            <artifactId>quarkus-junit5-mockito</artifactId>
+            <artifactId>quarkus-junit-mockito</artifactId>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -134,6 +135,11 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-opentelemetry</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.jspecify</groupId>
+            <artifactId>jspecify</artifactId>
+            <version>${jspecify.version}</version>
+        </dependency>
     </dependencies>
 
     <build>
@@ -183,7 +189,7 @@
                     </dependency>
                 </dependencies>
                 <configuration>
-                    <argLine>-javaagent:${org.mockito:mockito-core:jar} --add-opens java.base/java.lang=ALL-UNNAMED</argLine>
+                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar} --add-opens java.base/java.lang=ALL-UNNAMED</argLine>
                     <systemPropertyVariables>
                         <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                         <maven.home>${maven.home}</maven.home>
@@ -215,7 +221,7 @@
                     </dependency>
                 </dependencies>
                 <configuration>
-                    <argLine>-javaagent:${org.mockito:mockito-core:jar} --add-opens java.base/java.lang=ALL-UNNAMED</argLine>
+                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar} --add-opens java.base/java.lang=ALL-UNNAMED</argLine>
                     <reportFormat>plain</reportFormat>
                     <consoleOutputReporter>
                         <disable>false</disable>

backend/src/main/docker/Dockerfile.jvm

@@ -1,5 +1,5 @@
 ## Stage 1 : build with maven builder image
-FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21 AS builder
+FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-25 AS builder
 COPY --chown=quarkus:quarkus --chmod=0755 mvnw /code/mvnw
 COPY --chown=quarkus:quarkus .mvn /code/.mvn
 COPY --chown=quarkus:quarkus pom.xml /code/
@@ -10,7 +10,7 @@ COPY src /code/src
 RUN ./mvnw -B package -DskipTests --no-transfer-progress --strict-checksums
 
 ## Stage 2 : create the docker final image
-FROM eclipse-temurin:21
+FROM eclipse-temurin:25
 COPY --from=builder /code/target/quarkus-app/ /work/
 WORKDIR /work/
 

backend/src/main/docker/Dockerfile.native

@@ -1,5 +1,5 @@
 ## Stage 1 : build with maven builder image with native capabilities
-FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21 AS builder
+FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-25 AS builder
 COPY --chown=quarkus:quarkus --chmod=0755 mvnw /code/mvnw
 COPY --chown=quarkus:quarkus .mvn /code/.mvn
 COPY --chown=quarkus:quarkus pom.xml /code/

backend/src/main/java/org/cryptomator/hub/Main.java

@@ -12,8 +12,12 @@ public class Main implements QuarkusApplication {
 
 	private static final Logger LOG = Logger.getLogger(Main.class);
 
+	private final LicenseHolder license;
+
 	@Inject
-	LicenseHolder license;
+	Main(LicenseHolder license) {
+		this.license = license;
+	}
 
 	@Override
 	public int run(String... args) throws Exception {

backend/src/main/java/org/cryptomator/hub/api/AuditLogResource.java

@@ -56,10 +56,14 @@ public class AuditLogResource {
 			VaultKeyRetrievedEvent.TYPE, VaultMemberAddedEvent.TYPE, VaultMemberRemovedEvent.TYPE, VaultMemberUpdatedEvent.TYPE, VaultOwnershipClaimedEvent.TYPE,
 			EmergencyAccessSetupEvent.TYPE, EmergencyAccessSettingsUpdatedEvent.TYPE, EmergencyAccessRecoveryStartedEvent.TYPE, EmergencyAccessRecoveryApprovedEvent.TYPE, EmergencyAccessRecoveryCompletedEvent.TYPE, EmergencyAccessRecoveryAbortedEvent.TYPE);
 
+	private final AuditEvent.Repository auditEventRepo;
+	private final LicenseHolder license;
+
 	@Inject
-	AuditEvent.Repository auditEventRepo;
-	@Inject
-	LicenseHolder license;
+	AuditLogResource(AuditEvent.Repository auditEventRepo, LicenseHolder license) {
+		this.auditEventRepo = auditEventRepo;
+		this.license = license;
+	}
 
 	@GET
 	@RolesAllowed("admin")

backend/src/main/java/org/cryptomator/hub/api/AuthorityDto.java

@@ -5,6 +5,7 @@
 import org.cryptomator.hub.entities.Authority;
 import org.cryptomator.hub.entities.Group;
 import org.cryptomator.hub.entities.User;
+import org.jspecify.annotations.Nullable;
 
 @JsonInclude(JsonInclude.Include.NON_NULL)
 abstract sealed class AuthorityDto permits UserDto, GroupDto, MemberDto {
@@ -23,9 +24,9 @@ public enum Type {
 	public final String name;
 
 	@JsonProperty("pictureUrl")
-	public final String pictureUrl;
+	public final @Nullable String pictureUrl;
 
-	protected AuthorityDto(String id, Type type, String name, String pictureUrl) {
+	protected AuthorityDto(String id, Type type, String name, @Nullable String pictureUrl) {
 		this.id = id;
 		this.type = type;
 		this.name = name;

backend/src/main/java/org/cryptomator/hub/api/AuthorityResource.java

@@ -21,8 +21,12 @@
 @Produces(MediaType.TEXT_PLAIN)
 public class AuthorityResource {
 
+	private final Authority.Repository authorityRepo;
+
 	@Inject
-	Authority.Repository authorityRepo;
+	AuthorityResource(Authority.Repository authorityRepo) {
+		this.authorityRepo = authorityRepo;
+	}
 
 	@GET
 	@Path("/search")

backend/src/main/java/org/cryptomator/hub/api/BillingResource.java

@@ -15,7 +15,6 @@
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import org.cryptomator.hub.entities.EffectiveVaultAccess;
-import org.cryptomator.hub.entities.Settings;
 import org.cryptomator.hub.license.LicenseHolder;
 import org.cryptomator.hub.validation.ValidJWS;
 import org.eclipse.microprofile.openapi.annotations.Operation;
@@ -27,12 +26,14 @@
 @Path("/billing")
 public class BillingResource {
 
+	private final LicenseHolder licenseHolder;
+	private final EffectiveVaultAccess.Repository effectiveVaultAccessRepo;
+
 	@Inject
-	LicenseHolder licenseHolder;
-	@Inject
-	EffectiveVaultAccess.Repository effectiveVaultAccessRepo;
-	@Inject
-	Settings.Repository settingsRepo;
+	BillingResource(LicenseHolder licenseHolder, EffectiveVaultAccess.Repository effectiveVaultAccessRepo) {
+		this.licenseHolder = licenseHolder;
+		this.effectiveVaultAccessRepo = effectiveVaultAccessRepo;
+	}
 
 	@GET
 	@Path("/")
@@ -61,7 +62,7 @@ public Response setToken(@NotNull @ValidJWS String token) {
 		try {
 			licenseHolder.set(token);
 			return Response.status(Response.Status.NO_CONTENT).build();
-		} catch (JWTVerificationException e) {
+		} catch (JWTVerificationException _) {
 			return Response.status(Response.Status.BAD_REQUEST).build();
 		}
 	}

backend/src/main/java/org/cryptomator/hub/api/ConfigResource.java

@@ -18,35 +18,33 @@
 @Path("/config")
 public class ConfigResource {
 
-	@Inject
-	@ConfigProperty(name = "hub.keycloak.public-url", defaultValue = "")
-	String keycloakPublicUrl;
-
-	@Inject
-	@ConfigProperty(name = "hub.keycloak.realm", defaultValue = "")
-	String keycloakRealm;
-
-	@Inject
-	@ConfigProperty(name = "quarkus.oidc.client-id", defaultValue = "")
-	String keycloakClientIdHub;
-
-	@Inject
-	@ConfigProperty(name = "hub.keycloak.oidc.cryptomator-client-id", defaultValue = "")
-	String keycloakClientIdCryptomator;
+	private final String keycloakPublicUrl;
+	private final String keycloakRealm;
+	private final String keycloakClientIdHub;
+	private final String keycloakClientIdCryptomator;
+	private final String internalRealmUrl;
+	private final String billingUrl;
+	private final OidcConfigurationMetadata oidcConfData;
+	private final LicenseHolder license;
 
 	@Inject
-	@ConfigProperty(name = "quarkus.oidc.auth-server-url")
-	String internalRealmUrl;
-
-	@Inject
-	@ConfigProperty(name = "hub.billing-url", defaultValue = "")
-	String billingUrl;
-
-	@Inject
-	OidcConfigurationMetadata oidcConfData;
-
-	@Inject
-	LicenseHolder license;
+	ConfigResource(@ConfigProperty(name = "hub.keycloak.public-url", defaultValue = "") String keycloakPublicUrl,
+				   @ConfigProperty(name = "hub.keycloak.realm", defaultValue = "") String keycloakRealm,
+				   @ConfigProperty(name = "quarkus.oidc.client-id", defaultValue = "") String keycloakClientIdHub,
+				   @ConfigProperty(name = "hub.keycloak.oidc.cryptomator-client-id", defaultValue = "") String keycloakClientIdCryptomator,
+				   @ConfigProperty(name = "quarkus.oidc.auth-server-url") String internalRealmUrl,
+				   @ConfigProperty(name = "hub.billing-url", defaultValue = "") String billingUrl,
+				   OidcConfigurationMetadata oidcConfData,
+				   LicenseHolder license) {
+		this.keycloakPublicUrl = keycloakPublicUrl;
+		this.keycloakRealm = keycloakRealm;
+		this.keycloakClientIdHub = keycloakClientIdHub;
+		this.keycloakClientIdCryptomator = keycloakClientIdCryptomator;
+		this.internalRealmUrl = internalRealmUrl;
+		this.billingUrl = billingUrl;
+		this.oidcConfData = oidcConfData;
+		this.license = license;
+	}
 
 	@PermitAll
 	@GET
@@ -61,7 +59,7 @@ public ConfigDto getConfig() {
 	}
 
 	//visible for testing
-	String replacePrefix(String str, String prefix, String replacement) {
+	static String replacePrefix(String str, String prefix, String replacement) {
 		int index = str.indexOf(prefix);
 		if (index == 0) {
 			return replacement + str.substring(prefix.length());
@@ -71,7 +69,7 @@ String replacePrefix(String str, String prefix, String replacement) {
 	}
 
 	//visible for testing
-	String trimTrailingSlash(String str) {
+	static String trimTrailingSlash(String str) {
 		if (str.endsWith("/")) {
 			return str.substring(0, str.length() - 1);
 		} else {