Hi Everyone,

I could not get ESAPI to build on Fedora 44 with OpenJDK 25. There were too many runtime errors. They seemed to be related to reflection.

I see "Java CI with Maven" in the CI/CD pipeline is having trouble, too. I was hoping to use ESAPI/GitHub pipeline to perform the testing.

$ lsb_release -a
Distributor ID: Fedora
Description:    Fedora Linux 44 (KDE Plasma Desktop Edition)
Release:        44

$ java -version
openjdk version "25.0.3" 2026-04-21
OpenJDK Runtime Environment (Red_Hat-25.0.3.0.9-1) (build 25.0.3+9)
OpenJDK 64-Bit Server VM (Red_Hat-25.0.3.0.9-1) (build 25.0.3+9, mixed mode, sharing)

$ java -version
openjdk version "25.0.3" 2026-04-21
OpenJDK Runtime Environment (Red_Hat-25.0.3.0.9-1) (build 25.0.3+9)
OpenJDK 64-Bit Server VM (Red_Hat-25.0.3.0.9-1) (build 25.0.3+9, mixed mode, sharing)

This is presently expected. Java 8 is needed for compatibility with the reflection utilities presently used to test the heavily used singleton state in this baseline.

We have been debating newer versions of Java, and associated tool updates; however, that path is not yet fully fleshed out.
For now the recommended (if not required) java version is 8. (we are aware of EOL and a large number of the restrictions that come with it)

One thing I forgot to mention in the first comment... I could not tell what the canonical form is for a Credit Card number. I got lost when trying to find the behavior in the Encoder (and I was not able to run the code to see it in action).

I deduced the canonical form from the regex of ^(\\d{4}[- ]?){3}\\d{4}$. Since the regex asks for four groups of four decimal digits -- with spaces and hyphens optional -- the canonical form can only be the string of 16 decimal digits. Otherwise, space or hyphen would not be optional.

If someone can verify the canonicalized form for a credit card number, that would be super helpful.

@noloader , the test case on line 135 is failing:
assertEquals("1234987600000008", instance.getValidCreditCard("cctest17", "1234 9876 0000 0008", false));
Test failure

[ERROR] Failures: 
[ERROR]   ValidatorTest.testGetValidCreditCard:135 expected:<1234[98760000]0008> but was:<1234[ 9876 0000 ]0008>
[INFO] 
[ERROR] Tests run: 4312, Failures: 1, Errors: 0, Skipped: 0

Once that is addressed I think this will be good to go. @xeno6696

Hmmm....

Compiling this with

esapi-java-legacy> java -version
openjdk version "1.8.0_502"
OpenJDK Runtime Environment (Temurin)(build 1.8.0_502-b07)
OpenJDK 64-Bit Server VM (Temurin)(build 25.502-b07, mixed mode)

has this running without any failures. Double checking.

Yeah @jeremiahjstacey for me "mvn test" concludes with: