From c64727409589348244cc27db207e033491e0ffd9 Mon Sep 17 00:00:00 2001
From: Mihir Pradhan <mihirpradhan2004@gmail.com>
Date: Mon, 21 Sep 2026 10:13:07 -0500
Subject: [PATCH 1/3] Fix SDK build and unit tests on JDK 27

---
 duo-universal-sdk/pom.xml                     | 43 +++++++++++--------
 .../test/java/com/duosecurity/ClientTest.java |  4 +-
 2 files changed, 28 insertions(+), 19 deletions(-)

diff --git a/duo-universal-sdk/pom.xml b/duo-universal-sdk/pom.xml
index fad2833..7699194 100644
--- a/duo-universal-sdk/pom.xml
+++ b/duo-universal-sdk/pom.xml
@@ -31,6 +31,16 @@
     </scm>
 
     <profiles>
+        <profile>
+            <!-- 4.11.0 is the last Mockito release that runs on Java 8 -->
+            <id>jdk8</id>
+            <activation>
+                <jdk>1.8</jdk>
+            </activation>
+            <properties>
+                <mockito.version>4.11.0</mockito.version>
+            </properties>
+        </profile>
         <profile>
             <id>release</id>
             <build>
@@ -124,13 +134,21 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>3.11.2</version>
+            <version>${mockito.version}</version>
             <scope>test</scope>
         </dependency>
+        <!-- Pinned ahead of the version jackson-databind pulls in. Kept in lockstep with
+             byte-buddy-agent so the version Mockito mocks with matches, on every JDK. -->
         <dependency>
             <groupId>net.bytebuddy</groupId>
             <artifactId>byte-buddy</artifactId>
-            <version>1.15.4</version>
+            <version>1.17.7</version>
+        </dependency>
+        <dependency>
+            <groupId>net.bytebuddy</groupId>
+            <artifactId>byte-buddy-agent</artifactId>
+            <version>1.17.7</version>
+            <scope>test</scope>
         </dependency>
     </dependencies>
 
@@ -144,7 +162,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>2.5.4</version>
+                <version>3.8.0</version>
                 <configuration>
                     <descriptorRefs>
                         <descriptorRef>jar-with-dependencies</descriptorRef>
@@ -155,7 +173,7 @@
                         <id>make-assembly</id>
                         <phase>package</phase>
                         <goals>
-                            <goal>attached</goal>
+                            <goal>single</goal>
                         </goals>
                     </execution>
                 </executions>
@@ -184,19 +202,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.22.1</version>
-                <dependencies>
-                    <dependency>
-                        <groupId>org.junit.platform</groupId>
-                        <artifactId>junit-platform-surefire-provider</artifactId>
-                        <version>1.2.0-M1</version>
-                    </dependency>
-                    <dependency>
-                        <groupId>org.junit.jupiter</groupId>
-                        <artifactId>junit-jupiter-engine</artifactId>
-                        <version>5.2.0-M1</version>
-                    </dependency>
-                </dependencies>
+                <version>3.6.0</version>
             </plugin>
             <plugin>
                 <groupId>org.cyclonedx</groupId>
@@ -220,5 +226,8 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
+        <!-- Mockito 5 is needed to mock on JDK 22 and newer. It is compiled for Java 11,
+             so the jdk8 profile drops back to the 4.x line when building on a Java 8 JDK. -->
+        <mockito.version>5.23.0</mockito.version>
     </properties>
 </project>
diff --git a/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java b/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java
index 5f167b6..3b3510a 100644
--- a/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java
+++ b/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java
@@ -19,8 +19,8 @@
 import java.net.URL;
 
 import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Matchers.any;
-import static org.mockito.Matchers.anyString;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.verify;
 
 class ClientTest {

From b97036a479692f79c1c4572498d8ab093d1ecab2 Mon Sep 17 00:00:00 2001
From: Mihir Pradhan <mihirpradhan2004@gmail.com>
Date: Mon, 21 Sep 2026 10:29:03 -0500
Subject: [PATCH 2/3] Add JDK 27 to the CI matrix

---
 .github/workflows/java-ci.yml | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index b3a4c22..95e677c 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -14,7 +14,13 @@ jobs:
 
      strategy:
        matrix:
-        java-version: [8, 11, 17, 21]
+        include:
+          - { java-version: 8, distribution: temurin }
+          - { java-version: 11, distribution: temurin }
+          - { java-version: 17, distribution: temurin }
+          - { java-version: 21, distribution: temurin }
+          # Adoptium has not published Temurin 27 yet, so the 27 legs use Zulu
+          - { java-version: 27, distribution: zulu }
 
      steps:
        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -22,7 +28,7 @@ jobs:
        - name: Set up Java
          uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
          with:
-           distribution: 'temurin'
+           distribution: ${{ matrix.distribution }}
            java-version: ${{ matrix.java-version }}
 
        - name: Build and test SDK
@@ -41,7 +47,10 @@ jobs:
 
      strategy:
        matrix:
-        java-version: [17, 21]
+        include:
+          - { java-version: 17, distribution: temurin }
+          - { java-version: 21, distribution: temurin }
+          - { java-version: 27, distribution: zulu }
 
      steps:
        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -49,7 +58,7 @@ jobs:
        - name: Set up Java
          uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
          with:
-           distribution: 'temurin'
+           distribution: ${{ matrix.distribution }}
            java-version: ${{ matrix.java-version }}
 
        - name: Inject dummy example config

From 5190cd8dfacebb080a14cac761edc3f7741a6a1e Mon Sep 17 00:00:00 2001
From: Mihir Pradhan <mihirpradhan2004@gmail.com>
Date: Mon, 21 Sep 2026 15:20:48 -0500
Subject: [PATCH 3/3] Scope byte-buddy to tests and exclude it from production

---
 duo-universal-sdk/pom.xml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/duo-universal-sdk/pom.xml b/duo-universal-sdk/pom.xml
index 7699194..80e2b04 100644
--- a/duo-universal-sdk/pom.xml
+++ b/duo-universal-sdk/pom.xml
@@ -119,6 +119,13 @@
             <groupId>com.squareup.retrofit2</groupId>
             <artifactId>converter-jackson</artifactId>
             <version>2.11.0</version>
+            <exclusions>
+                <!-- jackson-databind declares byte-buddy but never references it -->
+                <exclusion>
+                    <groupId>net.bytebuddy</groupId>
+                    <artifactId>byte-buddy</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.auth0</groupId>
@@ -137,12 +144,13 @@
             <version>${mockito.version}</version>
             <scope>test</scope>
         </dependency>
-        <!-- Pinned ahead of the version jackson-databind pulls in. Kept in lockstep with
-             byte-buddy-agent so the version Mockito mocks with matches, on every JDK. -->
+        <!-- Test only: Mockito mocks with byte-buddy and self-attaches with
+             byte-buddy-agent, so the two are pinned in lockstep. -->
         <dependency>
             <groupId>net.bytebuddy</groupId>
             <artifactId>byte-buddy</artifactId>
             <version>1.17.7</version>
+            <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>net.bytebuddy</groupId>