Axual · jeroenvandisseldorp · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -25,12 +25,16 @@ updates:
       prod-deps:
         dependency-type: "production"
     ignore:
-    - dependency-name: "com.google.protobuf:protobuf-java"
-      versions: [ ">=4.0.0" ]   # 4.x has breaking lite-runtime semantics; KSML on 3.25.9
-    - dependency-name: "com.github.victools:*"
-      versions: [ ">=5.0.0" ]   # 5.0 requires Jackson 3 + Java 17
-    - dependency-name: "com.squareup.wire:*"
-      versions: [ ">=5.3.0" ]   # 5.3 changed ProtoFileElement constructor (added a param)
+      # GraalPy 25.1 and 25.2 cannot load Python C extension modules such as
+      # _ctypes, which PythonContextTest.testNativeAccess catches (see #688).
+      # Fixed upstream by https://github.com/oracle/graalpython/pull/1018, but
+      # we do not know if that reached 25.2.5, so the range stops there and
+      # Dependabot may offer it once it exists. These jars are only half of
+      # GraalVM: going past 25.0.x also needs GRAALVM_JDK_VERSION bumped in the
+      # workflows, or polyglot's version check quietly drops Python to the
+      # slow interpreter.
+      - dependency-name: "org.graalvm.*:*"
+        versions: [ ">=25.1.0, <25.2.5" ]
   - package-ecosystem: "pip"
     directory: "/"
     schedule:

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -37,11 +37,7 @@ jobs:
           path: build-output/
 
       - name: Prepare JVM Tars
-        env:
-          GRAALVM_JDK_VERSION: 25.0.2
-        run: |
-          wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-x64_bin.tar.gz -O graalvm-amd64.tar.gz
-          wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-aarch64_bin.tar.gz -O graalvm-arm64.tar.gz
+        run: scripts/graalvm-tarballs.sh download
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

diff --git a/.github/workflows/build-push-docker.yml b/.github/workflows/build-push-docker.yml
@@ -29,11 +29,7 @@ jobs:
           path: build-output/
 
       - name: Prepare JVM Tars
-        env:
-          GRAALVM_JDK_VERSION: 25.0.2
-        run: |
-          wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-x64_bin.tar.gz -O graalvm-amd64.tar.gz
-          wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-aarch64_bin.tar.gz -O graalvm-arm64.tar.gz
+        run: scripts/graalvm-tarballs.sh download
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

diff --git a/.github/workflows/ci-pr-fork-build.yml b/.github/workflows/ci-pr-fork-build.yml
@@ -17,11 +17,23 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      # Fork PRs skip build-and-test.yml, whose docker-build-test job is the only
+      # place on that path that fetches these tarballs. Runs before the build so a
+      # bad version fails in seconds instead of after the merge.
+      - name: Check GraalVM JDK tarballs exist
+        run: scripts/graalvm-tarballs.sh check
+
+      # Same JVM the Docker image ships, from the same single source. Note "graalvm"
+      # would be Oracle GraalVM, a different product under a different licence.
+      - name: Read GraalVM version
+        id: graalvm
+        run: echo "version=$(cat .graalvm-jdk-version)" >> "$GITHUB_OUTPUT"
+
       - name: Set up GraalVM
         uses: actions/setup-java@v5
         with:
-          distribution: graalvm
-          java-version: '25'
+          distribution: graalvm-community
+          java-version: ${{ steps.graalvm.outputs.version }}
           cache: maven
 
       - name: Build and test

diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml
@@ -25,11 +25,18 @@ jobs:
         with:
           fetch-depth: 0  # Fetch full history for SonarCloud analysis, because SonarCloud needs full git history to properly analyze changes.
 
+      # Build and test on the same JVM the Docker image ships, read from the same
+      # single source, so the two cannot drift apart. Note "graalvm" would be Oracle
+      # GraalVM, a different product under a different licence.
+      - name: Read GraalVM version
+        id: graalvm
+        run: echo "version=$(cat .graalvm-jdk-version)" >> "$GITHUB_OUTPUT"
+
       - name: Set up GraalVM
         uses: actions/setup-java@v5
         with:
-          distribution: 'graalvm'
-          java-version: '25'
+          distribution: 'graalvm-community'
+          java-version: ${{ steps.graalvm.outputs.version }}
           cache: 'maven'
 
       - name: Log in to Docker Hub

diff --git a/.github/workflows/release-push-docker.yml b/.github/workflows/release-push-docker.yml
@@ -36,11 +36,7 @@ jobs:
           path: build-output/
 
       - name: Prepare JVM Tars
-        env:
-          GRAALVM_JDK_VERSION: 25.0.2
-        run: |
-          wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-x64_bin.tar.gz -O graalvm-amd64.tar.gz
-          wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-aarch64_bin.tar.gz -O graalvm-arm64.tar.gz
+        run: scripts/graalvm-tarballs.sh download
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

diff --git a/.graalvm-jdk-version b/.graalvm-jdk-version
@@ -0,0 +1 @@
+25.0.2
diff --git a/build-local-docker.sh b/build-local-docker.sh
@@ -22,17 +22,9 @@ cp -r ksml-runner/target/libs build-output/
 cp ksml-test-runner/target/libs/*.jar build-output/libs/
 cp ksml-runner/NOTICE.txt build-output/
 cp LICENSE.txt build-output/
-GRAALVM_JDK_VERSION=${GRAALVM_JDK_VERSION:-25.0.2}
-
-# Download graalvm tarfiles
-if [ ! -f graalvm-amd64.tar.gz ]; then
-  echo "Downloading GraalVM for AMD64"
-  wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-x64_bin.tar.gz -O graalvm-amd64.tar.gz
-fi
-if [ ! -f graalvm-arm64.tar.gz ]; then
-  echo "Downloading GraalVM for ARM64"
-  wget https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_JDK_VERSION}/graalvm-community-jdk-${GRAALVM_JDK_VERSION}_linux-aarch64_bin.tar.gz -O graalvm-arm64.tar.gz
-fi
+# Download graalvm tarfiles. Version comes from .graalvm-jdk-version; override it with
+# GRAALVM_JDK_VERSION=... to try another one.
+scripts/graalvm-tarballs.sh download
 
 # Create builder if it doesn't exist
 if ! docker buildx ls --format {{.Name}} | grep -E "^ksml$"; then

diff --git a/ksml-data-apicurio/NOTICE.txt b/ksml-data-apicurio/NOTICE.txt
@@ -3,8 +3,8 @@ Lists of 64 third-party dependencies.
      (Apache License, Version 2.0) LZ4 Java Compression (at.yawk.lz4:lz4-java:1.10.2 - https://github.com/yawkat/lz4-java)
      (Apache License, Version 2.0) com.dashjoin:jsonata (com.dashjoin:jsonata:0.9.10 - https://github.com/dashjoin/jsonata-java)
      (The Apache Software License, Version 2.0) Jackson-annotations (com.fasterxml.jackson.core:jackson-annotations:2.22 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.0 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.0 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.1 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.1 - https://github.com/FasterXML/jackson)
      (BSD 2-Clause License) zstd-jni (com.github.luben:zstd-jni:1.5.6-10 - https://github.com/luben/zstd-jni)
      (The Apache Software License, Version 2.0) FindBugs-jsr305 (com.google.code.findbugs:jsr305:3.0.2 - http://findbugs.sourceforge.net/)
      (Apache 2.0) error-prone annotations (com.google.errorprone:error_prone_annotations:2.47.0 - https://errorprone.info/error_prone_annotations)
@@ -61,6 +61,6 @@ Lists of 64 third-party dependencies.
      (MIT License) SLF4J API Module (org.slf4j:slf4j-api:2.1.0-alpha1 - http://www.slf4j.org)
      (Apache License, Version 2.0) SnakeYAML Engine (org.snakeyaml:snakeyaml-engine:3.0.1 - https://bitbucket.org/snakeyaml/snakeyaml-engine)
      (Apache-2.0) snappy-java (org.xerial.snappy:snappy-java:1.1.10.7 - https://github.com/xerial/snappy-java)
-     (The Apache Software License, Version 2.0) Jackson-core (tools.jackson.core:jackson-core:3.2.0 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (tools.jackson.core:jackson-databind:3.2.0 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-dataformat-YAML (tools.jackson.dataformat:jackson-dataformat-yaml:3.2.0 - https://github.com/FasterXML/jackson-dataformats-text)
+     (The Apache Software License, Version 2.0) Jackson-core (tools.jackson.core:jackson-core:3.2.1 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (tools.jackson.core:jackson-databind:3.2.1 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-dataformat-YAML (tools.jackson.dataformat:jackson-dataformat-yaml:3.2.1 - https://github.com/FasterXML/jackson-dataformats-text)
diff --git a/ksml-data-avro-apicurio/NOTICE.txt b/ksml-data-avro-apicurio/NOTICE.txt
@@ -3,8 +3,8 @@ Lists of 79 third-party dependencies.
      (Apache License, Version 2.0) LZ4 Java Compression (at.yawk.lz4:lz4-java:1.10.2 - https://github.com/yawkat/lz4-java)
      (Apache License, Version 2.0) com.dashjoin:jsonata (com.dashjoin:jsonata:0.9.10 - https://github.com/dashjoin/jsonata-java)
      (The Apache Software License, Version 2.0) Jackson-annotations (com.fasterxml.jackson.core:jackson-annotations:2.22 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.0 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.0 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.1 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.1 - https://github.com/FasterXML/jackson)
      (BSD 2-Clause License) zstd-jni (com.github.luben:zstd-jni:1.5.6-10 - https://github.com/luben/zstd-jni)
      (The Apache Software License, Version 2.0) FindBugs-jsr305 (com.google.code.findbugs:jsr305:3.0.2 - http://findbugs.sourceforge.net/)
      (Apache 2.0) error-prone annotations (com.google.errorprone:error_prone_annotations:2.47.0 - https://errorprone.info/error_prone_annotations)
@@ -76,6 +76,6 @@ Lists of 79 third-party dependencies.
      (MIT License) SLF4J API Module (org.slf4j:slf4j-api:2.1.0-alpha1 - http://www.slf4j.org)
      (Apache License, Version 2.0) SnakeYAML Engine (org.snakeyaml:snakeyaml-engine:3.0.1 - https://bitbucket.org/snakeyaml/snakeyaml-engine)
      (Apache-2.0) snappy-java (org.xerial.snappy:snappy-java:1.1.10.7 - https://github.com/xerial/snappy-java)
-     (The Apache Software License, Version 2.0) Jackson-core (tools.jackson.core:jackson-core:3.2.0 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (tools.jackson.core:jackson-databind:3.2.0 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-dataformat-YAML (tools.jackson.dataformat:jackson-dataformat-yaml:3.2.0 - https://github.com/FasterXML/jackson-dataformats-text)
+     (The Apache Software License, Version 2.0) Jackson-core (tools.jackson.core:jackson-core:3.2.1 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (tools.jackson.core:jackson-databind:3.2.1 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-dataformat-YAML (tools.jackson.dataformat:jackson-dataformat-yaml:3.2.1 - https://github.com/FasterXML/jackson-dataformats-text)
diff --git a/ksml-data-avro-confluent/NOTICE.txt b/ksml-data-avro-confluent/NOTICE.txt
@@ -3,10 +3,10 @@ Lists of 48 third-party dependencies.
      (Apache License, Version 2.0) LZ4 Java Compression (at.yawk.lz4:lz4-java:1.10.2 - https://github.com/yawkat/lz4-java)
      (MIT License) minimal-json (com.eclipsesource.minimal-json:minimal-json:0.9.5 - https://github.com/ralfstx/minimal-json)
      (The Apache Software License, Version 2.0) Jackson-annotations (com.fasterxml.jackson.core:jackson-annotations:2.22 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.0 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.0 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-dataformat-CSV (com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.22.0 - https://github.com/FasterXML/jackson-dataformats-text)
-     (The Apache Software License, Version 2.0) Jackson datatype: jdk8 (com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.22.0 - https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jdk8)
+     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.1 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.1 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-dataformat-CSV (com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.22.1 - https://github.com/FasterXML/jackson-dataformats-text)
+     (The Apache Software License, Version 2.0) Jackson datatype: jdk8 (com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.22.1 - https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jdk8)
      (BSD 2-Clause License) zstd-jni (com.github.luben:zstd-jni:1.5.6-10 - https://github.com/luben/zstd-jni)
      (The Apache Software License, Version 2.0) FindBugs-jsr305 (com.google.code.findbugs:jsr305:3.0.2 - http://findbugs.sourceforge.net/)
      (Apache 2.0) error-prone annotations (com.google.errorprone:error_prone_annotations:2.47.0 - https://errorprone.info/error_prone_annotations)
@@ -20,12 +20,12 @@ Lists of 48 third-party dependencies.
      (Apache 2.0) KSML Data Library (io.axual.ksml:ksml-data:2.0.0-SNAPSHOT - https://github.com/Axual/ksml/ksml-data)
      (Apache 2.0) KSML Data Library - AVRO (io.axual.ksml:ksml-data-avro:2.0.0-SNAPSHOT - https://github.com/Axual/ksml/ksml-data-avro)
      (Apache 2.0) KSML Kafka clients (io.axual.ksml:ksml-kafka-clients:2.0.0-SNAPSHOT - https://github.com/Axual/ksml/ksml-kafka-clients)
-     (Apache License 2.0) utils (io.confluent:common-utils:8.3.0 - https://confluent.io/common-utils)
-     (Apache License 2.0) kafka-avro-serializer (io.confluent:kafka-avro-serializer:8.3.0 - http://confluent.io/kafka-avro-serializer)
-     (Apache License 2.0) kafka-avro-types (io.confluent:kafka-avro-types:8.3.0 - http://confluent.io/kafka-avro-types)
-     (Apache License 2.0) kafka-schema-registry-client (io.confluent:kafka-schema-registry-client:8.3.0 - http://confluent.io/kafka-schema-registry-client)
-     (Apache License 2.0) kafka-schema-serializer (io.confluent:kafka-schema-serializer:8.3.0 - http://confluent.io/kafka-schema-serializer)
-     (Apache License 2.0) kafka-schema-types (io.confluent:kafka-schema-types:8.3.0 - http://confluent.io/kafka-schema-types)
+     (Apache License 2.0) utils (io.confluent:common-utils:8.3.1 - https://confluent.io/common-utils)
+     (Apache License 2.0) kafka-avro-serializer (io.confluent:kafka-avro-serializer:8.3.1 - http://confluent.io/kafka-avro-serializer)
+     (Apache License 2.0) kafka-avro-types (io.confluent:kafka-avro-types:8.3.1 - http://confluent.io/kafka-avro-types)
+     (Apache License 2.0) kafka-schema-registry-client (io.confluent:kafka-schema-registry-client:8.3.1 - http://confluent.io/kafka-schema-registry-client)
+     (Apache License 2.0) kafka-schema-serializer (io.confluent:kafka-schema-serializer:8.3.1 - http://confluent.io/kafka-schema-serializer)
+     (Apache License 2.0) kafka-schema-types (io.confluent:kafka-schema-types:8.3.1 - http://confluent.io/kafka-schema-types)
      (The Apache Software License, Version 2.0) Log Redactor (io.confluent:logredactor:1.0.18 - https://github.com/confluentinc/logredactor)
      (The Apache Software License, Version 2.0) Log Redactor Metrics (io.confluent:logredactor-metrics:1.0.18 - https://github.com/confluentinc/logredactor)
      (Apache License 2.0) swagger-annotations-jakarta (io.swagger.core.v3:swagger-annotations-jakarta:2.2.42 - https://github.com/swagger-api/swagger-core/modules/swagger-annotations-jakarta)
@@ -45,6 +45,6 @@ Lists of 48 third-party dependencies.
      (Apache License, Version 2.0) SnakeYAML Engine (org.snakeyaml:snakeyaml-engine:3.0.1 - https://bitbucket.org/snakeyaml/snakeyaml-engine)
      (Apache-2.0) snappy-java (org.xerial.snappy:snappy-java:1.1.10.7 - https://github.com/xerial/snappy-java)
      (Apache License, Version 2.0) SnakeYAML (org.yaml:snakeyaml:2.0 - https://bitbucket.org/snakeyaml/snakeyaml)
-     (The Apache Software License, Version 2.0) Jackson-core (tools.jackson.core:jackson-core:3.2.0 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (tools.jackson.core:jackson-databind:3.2.0 - https://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-dataformat-YAML (tools.jackson.dataformat:jackson-dataformat-yaml:3.2.0 - https://github.com/FasterXML/jackson-dataformats-text)
+     (The Apache Software License, Version 2.0) Jackson-core (tools.jackson.core:jackson-core:3.2.1 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (tools.jackson.core:jackson-databind:3.2.1 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-dataformat-YAML (tools.jackson.dataformat:jackson-dataformat-yaml:3.2.1 - https://github.com/FasterXML/jackson-dataformats-text)