Trim the bundled JRE: drop java.desktop, jdk.jfr, java.compiler and strip native libraries (-13 MB per wheel) - #452

Closes #447.

The wheel's bundled jlink runtime no longer carries java.desktop (with java.datatransfer and java.prefs, which only it requires), jdk.jfr and java.compiler, and on Linux its .so files are stripped. The Linux x86_64 wheel built from the same 71 jars goes from 80,848,056 bytes (80.8 MB) to 67,688,031 bytes (67.7 MB, 64.6 MiB), and the runtime goes from 20 modules to 15. The module list is still detected by jdeps. scripts/jre_module_exclusions.txt lists what to keep out, Dockerfile.build (Linux) and build-native.sh (macOS, Windows) remove those names from the jdeps answer before jlink, and both fail the build when java --list-modules of the finished runtime still shows one of them. Detection that finds no modules now stops the build, because the java.se fallback would bring the three modules back.

Size after each step, Linux x86_64 runtime (deflated, as in the wheel): baseline 40.9 MB, with strip --strip-unneeded on the .so files only 39.2 MB, with the three modules removed only 29.3 MB, both 27.8 MB. jlink already ran with --strip-debug, --no-header-files, --no-man-pages and --compress zip-9; libjvm.so still carried its symbol table, which the strip removes (a JVM crash report names fewer native frames). The strip runs on Linux only: macOS and Windows keep their libraries as jlink writes them, and the Windows build already prunes its own artifacts.

jdeps findings over the 62 shipped jars the build analyses, then checked on the constant pools of every shipped class (multi-release entries included): java.desktop is named by org.locationtech.jts.awt.* and TestBuilderProxy (JTS), java.beans in jackson-databind Java7SupportImpl, snakeyaml MethodProperty, commons-lang3 AbstractCircuitBreaker, micrometer Log4j2Metrics and jakarta.xml.bind-api JAXB, java.awt.geom in commons-math3 twod.Line, and java.awt.datatransfer in jakarta.activation-api DataHandler. jdk.jfr is named only by the engine's JVMGCHistogramReporter, and java.compiler only by org.agrona.generation.*. For every one of them no class outside the named one refers to it (nothing instantiates Yaml, nothing calls the JFR reporter or agrona's generator, swagger-core refers only to the JAXB annotations), so each is optional and unreachable from the bindings, the server, Studio and the SQL and Cypher engines. Jackson loads Java7SupportImpl by name (no class refers to it) and the runtime prints no warning for it. Nothing in the engine, server or bindings sources imports java.awt, javax.swing, javax.tools or javax.lang.model.

tests/test_jar_closure.py now starts the bundled runtime, reads the class files of the shipped jars, and fails when a class names a package of a removed module unless the jar and package are on ALLOWED_REMOVED_MODULE_USE with a reason (ten entries, each one of the findings above). It also checks that the running runtime lacks the removed modules, that the scan sees the known references, that no allow-list entry is dead, and that Jackson and its YAML mapper run without java.beans. On the untrimmed baseline wheel only test_bundled_runtime_lacks_the_excluded_modules fails, as it should.

Gate, linux/amd64 wheel built with build.sh linux/amd64 3.12 on the local jars: the build's Docker smoke test passed, the full bindings suite (uv run pytest, 1,266 tests) gave 1,262 passed, 4 failed, 1 skipped (polars not installed), and the same four fail on the untouched baseline wheel with the same jars: three test_collection_equality_known_issues.py tests are XPASS(strict) for ArcadeData#10448 (the engine jars now fix it, so those xfail markers are stale), and test_sigint_during_a_query_that_calls_python_is_a_keyboard_interrupt fails in the full run at the same place on both wheels and passes alone (3 of 3 on this wheel). Of 12 standalone examples run on this wheel (01, 02, 17 to 21, 23 to 26, 28), 11 pass; 21_graph_analytical_view_sql.py fails with Expected restored GAV nodeCount = 135000 on both wheels. The examples that need downloaded datasets or sentence-transformers were not run. build-native.sh passes bash -n and shfmt but was not run: macOS and Windows runners build it in the release workflow.

Docs: the module exclusion and the strip are in build-architecture.md, contributing.md, testing.md and architecture.md; the wheel and runtime sizes in README.md, bindings/python/README.md, index.md, installation.md, build-architecture.md and ci-setup.md are the numbers measured on this wheel (2026-10-22); strict mkdocs builds.

🤖 Generated with Claude Code