Automic VaultAutomic Vault

brew

Install graalvm with Homebrew, chocolatey

JDK distribution with Graal compiler and Native Image. Version 25.1.3 via Homebrew; verified 2026-07-05.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install graalvm

local Homebrew formula metadata

overview

Package summary

JDK distribution with Graal compiler and Native Image

Commands and aliases

  • native-image
  • native-image-configure

history

Project history and usage

GraalVM is Oracle Labs' high-performance JDK and language-runtime project built around the Graal compiler, the Truffle language implementation framework, and Native Image ahead-of-time compilation. In package-manager terms it is a JDK distribution with extra runtime and native-compilation tooling, so installing it is closer to selecting a Java toolchain than installing a single application.

The Homebrew package is significant because it gives macOS and Unix-like developers a normal package-manager route to `native-image` and the GraalVM JDK. That matters for build scripts, CI jobs, Java microservices, and framework ecosystems that test against or produce GraalVM Native Image binaries.

Project history

Oracle Labs describes GraalVM as a runtime for Java and JVM languages, JavaScript, Python, WebAssembly, and other languages that can run standalone or embedded in OpenJDK, Oracle JDK, Oracle Database, and MySQL. The project grew from Oracle Labs compiler and VM research led around the Graal dynamic compiler and the Truffle self-optimizing runtime system.

GraalVM's public pre-production line used 1.0 release candidates in 2018. Those releases show the package becoming more than a compiler experiment: artifacts moved toward the `org.graalvm` coordinates, Native Image pieces were published to Maven Central, and the distribution carried language runtimes, SDK APIs, tools, and the Substrate VM implementation behind Native Image.

The source repository `oracle/graal` brings together the compiler, SDK, SubstrateVM, Truffle, language runtimes and related tools. That monorepo shape is part of the project's identity: GraalVM is not only a JDK build, but also a platform for language implementers and ahead-of-time compilation research.

Adoption history

GraalVM adoption in the Java ecosystem has been tied to two overlapping use cases: using the Graal compiler as an optimizing JIT, and using Native Image to build standalone executables with fast startup and lower resource use. The latter became especially visible in cloud-native Java, where container startup time and memory footprint are package-level concerns.

Oracle's 2023 licensing change made Oracle GraalVM for JDK 17, JDK 20, and following releases available under the GraalVM Free Terms and Conditions, including commercial production use subject to the license terms. That reduced a practical adoption barrier for teams that needed Oracle-provided builds rather than only community builds.

Oracle later described a shift in Java-runtime strategy: GraalVM technologies were aligned with the Java release cadence after years of research, the Graal JIT informed Oracle JDK work, and Native Image work informed OpenJDK Project Leyden. For package users, that means GraalVM sits at the intersection of a shipping JDK distribution and upstream Java platform experiments.

How it is used

Developers use GraalVM as a Java Development Kit in IDEs and build tools, then opt into Native Image through the `native-image` command or build plugins. The Native Image docs describe compiling Java code ahead of time into a native executable that includes only reachable application, library, runtime, and statically linked JDK code for a target operating system and architecture.

Typical command-line and package-manager usage revolves around setting `JAVA_HOME`, ensuring a local C toolchain is available, and running Maven or Gradle Native Image plugins. The Homebrew package exposes the JDK and tools such as `native-image` and `native-image-configure`, making it convenient for repeatable local builds.

The package also has a metadata angle: Native Image needs reachability metadata for dynamic Java features such as reflection, resources, and service loading. The curated path `META-INF/native-image/<groupId>/<artifactId>/reachability-metadata.json` reflects that package-ecosystem convention.

Why package nerds care

GraalVM is package-nerd bait because it blurs boundaries between compiler, JDK, language runtime, and build artifact. Installing it can change Java bytecode execution, native executable generation, container image size, startup behavior, and dependency metadata requirements.

Its release and licensing history also affects distribution policy. Packagers need to distinguish GraalVM Community Edition licensing from Oracle GraalVM licensing, match builds to JDK baselines, and expose tooling in a way that works with `JAVA_HOME`, Gradle, Maven, CI runners, and architecture-specific native toolchains.

For Homebrew users, `brew install graalvm` is a practical way to obtain a specialized Java toolchain while keeping the installation visible to scripts and package-manager audits.

Timeline

  • 2018: GraalVM 1.0 release candidates documented polyglot runtimes, Maven artifacts, Native Image work, and SDK/API changes.
  • 2018-10: GraalVM 1.0-RC8 documented Native Image Maven integration and Maven Central publication of Substrate VM components.
  • 2019: GraalVM moved from the 1.0 release-candidate era into production-oriented release lines.
  • 2022: Oracle Labs announced alignment of GraalVM technology development with Java release cadence.
  • 2023: Oracle announced the GraalVM Free Terms and Conditions for Oracle GraalVM releases beginning with JDK 17 and JDK 20.
  • 2026: GraalVM release-calendar documentation describes monthly feature releases from the 25.1 line with quarterly CPU updates.

Related projects

  • OpenJDK is the Java platform baseline that GraalVM builds on and tracks.
  • Truffle is the language implementation framework used by GraalVM language runtimes.
  • SubstrateVM is the Native Image implementation area in the Graal repository.
  • GraalJS, GraalPy, GraalWasm, Espresso, Sulong, Native Build Tools, and the GraalVM reachability metadata repository are adjacent GraalVM ecosystem projects.
  • Project Leyden is related through ahead-of-time Java work that Oracle says was informed by Native Image.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for graalvm. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 5 platform targets.
  • Installs with 6 runtime dependencies.
  • Build metadata lists 5 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
META-INF/native-image/<groupId>/<artifactId>/reachability-metadata.json

executables

Installed executables

CommandKindExposureNote
native-imagecliglobal executable
native-image-configurecliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version25.1.3
manager updated2026-07-05
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/oracle/graal

install metadata

Package metadata

Package keybrew:graalvm
Version25.1.3
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/graalvm
Homepagehttps://www.graalvm.org/
Repositoryhttps://github.com/oracle/graal
Upstream docshttps://www.graalvm.org/latest/docs
LicenseGPL-2.0-only WITH Classpath-exception-2.0
Source archivehttps://github.com/oracle/graal/archive/refs/tags/graal-25.1.3.tar.gz
Last updated2026-07-05T23:51:35Z
Pulseupdated
Dependenciesfreetype, giflib, harfbuzz, jpeg-turbo, libpng, little-cms2
Build dependenciesautoconf, mx, ninja, openjdk@25, pkgconf
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namegraalvm
Version Scheme0
Revision0
Requirements
  • arch
  • xcode
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyyes
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Chocolatey95%

graalvm

choco install graalvm
  • normalized package name match
  • Matched by: Graalvm
Chocolatey community package catalog · community.chocolatey.org · Chocolatey community package catalog: graalvm from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='7.756','razer-synapse-3'

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment