From fd3d1689bfc714d42691135911503f00922735cf Mon Sep 17 00:00:00 2001
From: Matthew Buckett <matthew.buckett@ctl.ox.ac.uk>
Date: Tue, 7 Oct 2025 16:30:27 +0100
Subject: [PATCH 1/2] AB#94461 Upgrade to Java 21 distroless image.

This switches to Java 21, but also changes the docker image to be distroless so that we don't have as many bundled applications that we don't need which cause security alerts.
---
 .java-version | 2 +-
 pom.xml       | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.java-version b/.java-version
index 8e2afd3..b5045cc 100644
--- a/.java-version
+++ b/.java-version
@@ -1 +1 @@
-17
\ No newline at end of file
+21
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 19d189c..e9630cb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,7 +22,7 @@
     </licenses>
 
     <properties>
-        <java.version>17</java.version>
+        <java.version>21</java.version>
         <jib.tag>latest</jib.tag>
         <git.commit.id>unknown</git.commit.id>
     </properties>
@@ -241,7 +241,7 @@
             <plugin>
                 <groupId>com.google.cloud.tools</groupId>
                 <artifactId>jib-maven-plugin</artifactId>
-                <version>3.3.1</version>
+                <version>3.4.6</version>
                 <dependencies>
                     <!-- This isn't strictly needed but makes sense to include -->
                     <dependency>
@@ -259,8 +259,7 @@
                         </pluginExtension>
                     </pluginExtensions>
                     <from>
-                        <!-- The alpine images are small but don't support arm64 so use ubuntu instead -->
-                        <image>eclipse-temurin:17.0.8.1_1-jre-jammy</image>
+                        <image>gcr.io/distroless/java21-debian12</image>
                         <platforms>
                             <platform>
                                 <architecture>arm64</architecture>

From ee1db5a89624a0e4d432fdd159b61f8199b80f6a Mon Sep 17 00:00:00 2001
From: Matthew Buckett <matthew.buckett@ctl.ox.ac.uk>
Date: Tue, 7 Oct 2025 16:41:25 +0100
Subject: [PATCH 2/2] AB#94461 Fix the user who is used

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e9630cb..96bc293 100644
--- a/pom.xml
+++ b/pom.xml
@@ -280,7 +280,7 @@
                     </to>
                     <container>
                         <!-- As we're in docker we really don't want to be running as root -->
-                        <user>nobody:nogroup</user>
+                        <user>nonroot:nonroot</user>
                         <labels>
                             <!-- This is so that published packaged are linked to this repository -->
                             <org.opencontainers.image.source>