[ribhav-pahuja]

Summary

• Raise the minimum Java version from 17 to Java 25 LTS and bump the library to 7.0.0.
• Update Maven (release 25), Savant, GitHub Actions, and IntelliJ project settings.
• Rely on the default JCA for SHAKE256 (available on Java 25+), so Ed448 OpenID Connect at_hash / c_hash no longer require a third-party provider such as Bouncy Castle.
• Replace deprecated new URL(String) usage with URI.create(...).toURL().

Test plan

• mvn clean verify (default JCA + FIPS surefire executions)
• Confirmed bytecode major version 69 (Java 25)
• CI green on GitHub Actions with Temurin 25

[Copilot]

Pull request overview

This PR upgrades the library’s baseline runtime/tooling to Java 25 LTS (major version bump to 7.0.0), and aligns cryptography and networking code with the newer JDK (notably relying on JDK-provided SHAKE256 and replacing new URL(String) usage).

Changes:

• Bump project/library version to 7.0.0 and raise the compiler baseline to Java 25 (Maven release=25, Savant, GitHub Actions, IntelliJ config).
• Update OIDC Ed448 at_hash / c_hash expectations to rely on default-JCA SHAKE256 (removing prior “requires FIPS/provider” guard in tests and updating docs/comments).
• Replace new URL(String) with URI.create(...).toURL() in test and HTTP helper call sites (including improved exception handling for invalid endpoints).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/test/java/io/fusionauth/oauth2/ServerMetaDataTest.java	Switch URL construction to URI.create(...).toURL() for test connection creation.
src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java	Remove SHAKE256 “requires provider” test wrapper; assert Ed448 hashes directly under Java 25.
src/test/java/io/fusionauth/jwks/JSONWebKeySetHelperTest.java	Switch URL construction to URI.create(...).toURL() for HTTPS connection creation.
src/main/java/io/fusionauth/jwt/OpenIDConnect.java	Update Ed448 SHAKE256 comment to reflect Java 25 default JCA availability.
src/main/java/io/fusionauth/http/AbstractHttpHelper.java	Replace new URL(...) with URI.create(...).toURL() and catch IllegalArgumentException for invalid endpoints.
README.md	Update Ed448 SHAKE256 guidance and bump dependency coordinates to 7.0.0.
pom.xml	Bump to 7.0.0, set compiler release to 25, add/update compiler & surefire plugin versions.
fusionauth-jwt.ipr	Update IntelliJ project language level/JDK to 25.
CHANGES	Add 7.0.0 release notes for Java 25 + SHAKE256 change.
build.savant	Update version to 7.0.0 and Java settings to 25.
.github/workflows/test.yml	Run CI on Temurin 25.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mmanes]

Can we remove the BC dependency now?

[mooreds]

I thought we needed it for FIPS?

[mmanes]

It seems a bit unnecessary to test both BC and JCE here vs in a final product, but the tests exercise them both, so we can leave the dep in.

[mmanes]

It seems a bit unnecessary to test both BC and JCE here vs in a final product, but the tests exercise them both, so we can leave the dep in.