Java 25 native-access warning from bundled Netty requires broad ALL-UNNAMED permission

Description

We are using the Microsoft Application Insights Java agent 3.7.9 with a
Java 25 Spring Boot application deployed to Azure Kubernetes Service cluster.

The application is packaged as an OCI container using the Paketo Buildpacks Azure Application Insights buildpack.

During pod startup, the Application Insights agent successfully starts, but
Java 25 reports a restricted native-access warning. The warning identifies
io.netty.util.internal.NativeLibraryUtil, loaded from the Application
Insights agent JAR, as the caller.

Expected behavior

No WARNING
or
Ideally, the Application Insights agent should either:

• avoid attempting native-library loading when the associated native functionality is not required;
• place the native-calling code in an appropriately named module so native access can be granted narrowly; or
• clearly document --enable-native-access=ALL-UNNAMED as a required and supported JVM option for Java 25 and later, including why the native access is required.

Actual behavior

See the WARNING message in the log:
2026-09-13 07:56:17.795-04:00 INFO c.m.a.a.i.c.ConfigurationBuilder - Some telemetry may be sampled out because a default sampling configuration was added in version 3.4.0 to reduce the default billing cost. You can set the sampling configuration explicitly: https://learn.microsoft.com/azure/azure-monitor/app/java-standalone-config#sampling
2026-09-13 07:56:36.797-04:00 INFO c.m.applicationinsights.agent - Application Insights Java Agent 3.7.9 started successfully (PID 1, JVM running for 21.612 s)
2026-09-13 07:56:36.798-04:00 INFO c.m.applicationinsights.agent - Java version: 25.0.4, vendor: Microsoft, home: /layers/paketo-buildpacks_microsoft-openjdk/jdk
WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::loadLibrary has been called by io.netty.util.internal.NativeLibraryUtil in an unnamed module (file:/layers/paketo-buildpacks_azure-application-insights/azure-application-insights-java/applicationinsights-agent-3.7.9.jar)
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

To Reproduce

Submitting a PR with an example reproducing the issue in this repository would make it easier for the Application Insight maintainers to help you. Before doing this, you have to fork this repository.

System information

• Java: Microsoft OpenJDK 25.0.4
• Application Insights Java agent: 3.7.9
• Framework: Spring Boot: 4.0.7
• Runtime platform: Azure Kubernetes Service
• Container packaging: Paketo Buildpacks
• Application Insights integration:
  paketo-buildpacks/azure-application-insights
• Operating system: Linux container

Logs

Spring Cloud Bindings Enabled
Picked up JAVA_TOOL_OPTIONS: -Xmx800M -XX:MaxDirectMemorySize=64M -Dfile.encoding=UTF-8 -Duser.timezone=America/Toronto -Djava.security.properties=/layers/paketo-buildpacks_microsoft-openjdk/java-security-properties/java-security.properties -XX:+ExitOnOutOfMemoryError -javaagent:/layers/paketo-buildpacks_azure-application-insights/azure-application-insights-java/applicationinsights-agent-3.7.9.jar -XX:MaxMetaspaceSize=217866K -XX:ReservedCodeCacheSize=240M -Xss1M -XX:+UnlockDiagnosticVMOptions -XX:NativeMemoryTracking=summary -XX:+PrintNMTStatistics -Djavax.net.ssl.trustStore=/tmp/truststore -Dorg.springframework.cloud.bindings.boot.enable=true
OpenJDK 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended
2026-09-13 07:56:17.795-04:00 INFO c.m.a.a.i.c.ConfigurationBuilder - Some telemetry may be sampled out because a default sampling configuration was added in version 3.4.0 to reduce the default billing cost. You can set the sampling configuration explicitly: https://learn.microsoft.com/azure/azure-monitor/app/java-standalone-config#sampling
2026-09-13 07:56:36.797-04:00 INFO c.m.applicationinsights.agent - Application Insights Java Agent 3.7.9 started successfully (PID 1, JVM running for 21.612 s)
2026-09-13 07:56:36.798-04:00 INFO c.m.applicationinsights.agent - Java version: 25.0.4, vendor: Microsoft, home: /layers/paketo-buildpacks_microsoft-openjdk/jdk
WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::loadLibrary has been called by io.netty.util.internal.NativeLibraryUtil in an unnamed module (file:/layers/paketo-buildpacks_azure-application-insights/azure-application-insights-java/applicationinsights-agent-3.7.9.jar)
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

Concerns

Concern

This is currently a warning, but the Java documentation indicates that restricted native access may be denied by default in a future Java release.

We want to address this proactively without granting native access to every classpath dependency if a narrower option is technically possible.