[eliottness]

What Does This Do

Installs Temurin 21 (21.0.13.0+9-tem) through SDKMAN in Dockerfile.exploration-tests and adds it to Gradle's toolchain paths.

Motivation

#13026 (eMudhra CA remediation, APPSEC-71277) disabled Gradle toolchain auto-download so the build can't fetch a JDK whose cacerts still trusts the compromised roots. okhttp's okhttp_5.3.x branch now requires a Java 21 toolchain, so the manual build-exploration-tests-image job fails at ./gradlew dependencies with "Cannot find a Java installation ... matching languageVersion=21" (job 2195000692). The existing cacerts scrub step already covers every SDKMAN JDK, so JDK 21 is scrubbed too.

Additional Notes

After merge, build-exploration-tests-image needs to be run again on master. I will run it.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T10:12:33.163520Z	11e9e9e	PR opened
🔒 Security Review	✅ Completed 2026-10-30T10:14:56.061184Z	11e9e9e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-prod-us1-6]

More details

The JDK 21 installation matches Gradle’s configured toolchain path and is covered by the existing certificate-scrubbing step. The complete Docker image build remains unverified.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 11e9e9e}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.03 s	13.99 s	[-0.5%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.91 s	12.97 s	[-1.0%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	17.26 s	17.19 s	[-0.5%; +1.3%] (no difference)
startup:petclinic:iast:Agent	17.05 s	17.18 s	[-1.5%; -0.0%] (maybe better)
startup:petclinic:profiling:Agent	16.66 s	16.91 s	[-2.4%; -0.7%] (maybe better)
startup:petclinic:sca:Agent	17.21 s	17.13 s	[-0.4%; +1.3%] (no difference)
startup:petclinic:tracing:Agent	16.34 s	16.37 s	[-0.9%; +0.6%] (no difference)

Commit: 11e9e9e1 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.