From a04c376691a339036ce6d6790331d1cc919c7c7d Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Tue, 10 Nov 2026 11:25:32 +0100
Subject: [PATCH 1/3] fix: run Docker formatter without root privileges

---
 Dockerfile | 9 ++++++++-
 Makefile   | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 66c4a01e1..dc333ce90 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,4 +11,11 @@ COPY settings.gradle .
 # Make gradlew executable
 RUN chmod +x gradlew
 
-CMD ["sh", "-c", "./gradlew :spotlessApply"] 
\ No newline at end of file
+RUN yum install -y shadow-utils findutils && yum clean all \
+    && useradd --create-home --uid 1000 formatter \
+    && chown -R formatter:formatter /code
+
+ENV GRADLE_USER_HOME=/tmp/gradle
+USER formatter
+
+CMD ["sh", "-c", "./gradlew :spotlessApply"] 
diff --git a/Makefile b/Makefile
index c4d77014d..a94000c3f 100644
--- a/Makefile
+++ b/Makefile
@@ -12,4 +12,4 @@ test_with_docker:
 
 format_with_docker:
 	docker build -t stream-chat-java-formatter . && \
-	docker run -v $(PWD):/code stream-chat-java-formatter
+	docker run --user $$(id -u):$$(id -g) -v $(PWD):/code stream-chat-java-formatter

From ca2f2211022a911897282a0e8eaf76a636c062c2 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Tue, 10 Nov 2026 11:25:47 +0100
Subject: [PATCH 2/3] style: remove trailing Dockerfile whitespace

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index dc333ce90..4371fa12a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,4 +18,4 @@ RUN yum install -y shadow-utils findutils && yum clean all \
 ENV GRADLE_USER_HOME=/tmp/gradle
 USER formatter
 
-CMD ["sh", "-c", "./gradlew :spotlessApply"] 
+CMD ["sh", "-c", "./gradlew :spotlessApply"]

From 34362017499481a645ba2f2b740db646688cb426 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Tue, 10 Nov 2026 11:48:25 +0100
Subject: [PATCH 3/3] fix: [APPSEC-327] pin CI to supported Java 11 runtime

Added Java 11 setup step to CI workflow.
---
 .github/workflows/ci.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9fc734c22..28d2e2755 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,7 +2,7 @@ name: Build
 
 on: [pull_request]
 
-concurrency: 
+concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
@@ -19,6 +19,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Java 11
+        uses: actions/setup-java@v4
+        with:
+          distribution: corretto
+          java-version: '11'
+
       - name: Test
         env:
           STREAM_KEY: ${{ secrets.STREAM_KEY }}