merging main (#1)

[chetankokil]

• Use MongoDB 4.4 consistently

• Fix handling of HTTP/2 H2 empty frames in Resteasy Reactive

Closes #36604

• Bump com.google.api.grpc:proto-google-common-protos

Bumps com.google.api.grpc:proto-google-common-protos from 2.23.0 to 2.27.0.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: com.google.api.grpc:proto-google-common-protos dependency-type: direct:production update-type: version-update:semver-minor ...

• Add a custom OIDC identity provider test

• Updates Liquibase integrationtest to reproduce error: Regression: Liquibase fails to migrate on Quarkus start, crashing the application #36446

• Fix zlib broken link

• Reverts changes made to workaround liquibase issue: LabelExpression constructed with a collection of strings is not usable for Liquibase.*(...) liquibase/liquibase#4763 since we've updated to liquibase 4.24.0

• Fix version reporting and parsing

Quarkus currently only parses the feature and update version of JDK and incorrectly prints message like:

[INFO] [io.quarkus.deployment.pkg.steps.NativeImageBuildStep] Running Quarkus native-image plugin on MANDREL 22.3.3.1 JDK 17.8

while it should be

[INFO] [io.quarkus.deployment.pkg.steps.NativeImageBuildStep] Running Quarkus native-image plugin on MANDREL 22.3.3.1 JDK 17.0.8

i.e. 17.0.8 vs 17.8

This change fixes that issue and relies on java.lang.Runtime.Version for parsing and comparing the JDK version.

Follow up to #36267

• Make sure OIDC/GraphQL client integration runs after client config is initialized, get rid of config merger bean

• Fix termination of the fallback virtual thread executor

• Stork observability integration

• Move HTTP CORS section to a new security-cors.adoc

• Add security-cors.adoc to the downstreamdoc.yaml

• QuarkusTest: handle beans declared on test profile specifically

• beans declared on a test profile implementation are only taken into account if the test profile is used
• resolves TestProfile specific CDI beans #36554

• Fix gRPC context propagation.

• Make the ZSTD Substitutions more robust

• Remove the pinned event example from the documentation

• Use container urls for connecting to services by default

It is better for the build cache and for local testing, nowadays, there is a good chance people will use containers anyway.

• Update gRPC Protoc to version 3.24.4 and the generator to 1.59.0

• Add move architecture to cover ppcle64 and s390x
• Update code to handle deprecation and removed API

• Use GRADLE_JAVA_HOME in CI and test Java 21

• Remove more Docker images

• Indicate that Java 21 is supported

• Remove additional stuff before starting CI

• Remove --enable-preview from virtual-threads ITs

We are now using Java 21 so we don't need the flag anymore.

• Add a ci-disk-usage.sh script

• Skip Scala 2 tests on Java 21+

• Make RegisterForReflectionTestCase#testLambdaCapturing compatible with Java 21

• Higher Xmx for Java 21 testing

• Deprecate the scala extension

• https://github.com/quarkiverse/quarkus-scala3 should be preferred instead

• Codestarts: Add Entity annotation to Kotlin all-open

• QuarkusSecurityTestExtension afterEach call should not be made for tests without @testsecurity

• Introduce OidcClientRequestFilter

• Bump org.jboss.threads:jboss-threads from 3.5.0.Final to 3.5.1.Final

Bumps org.jboss.threads:jboss-threads from 3.5.0.Final to 3.5.1.Final.

• Commits

---

updated-dependencies:

• dependency-name: org.jboss.threads:jboss-threads dependency-type: direct:production update-type: version-update:semver-patch ...

• Bump jacoco.version from 0.8.10 to 0.8.11

Bumps jacoco.version from 0.8.10 to 0.8.11.

Updates org.jacoco:org.jacoco.core from 0.8.10 to 0.8.11

• Release notes
• Commits

Updates org.jacoco:org.jacoco.report from 0.8.10 to 0.8.11

• Release notes
• Commits

Updates org.jacoco:org.jacoco.agent from 0.8.10 to 0.8.11

• Release notes
• Commits

Updates org.jacoco:jacoco-maven-plugin from 0.8.10 to 0.8.11

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: org.jacoco:org.jacoco.core dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.jacoco:org.jacoco.report dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.jacoco:org.jacoco.agent dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.jacoco:jacoco-maven-plugin dependency-type: direct:production update-type: version-update:semver-patch ...

• Dev UI: Fix height in Rest Client

• Disable CDI TCK ManagedBeanTypesTest for now

This test is not compatible with Java 21.

See jakartaee/cdi-tck#485

• Reinitialized the com.google.protobuf.UnsafeUtil class at runtime

Also fix the Unsafe accessor.
Fix #30293.

This has been tested on GraalVM CE and EE.

• Revert "Bump io.strimzi:kafka-oauth-client from 0.12.0 to 0.14.0"

This reverts commit 09a13e6.

• Add a warning for how to report security vulnerability

• add JBang script to analyze our CI raw logs

• Small additional features to ModuleBuildDurationReport.java

• Some additional improvements and fixes

• More readable module names

• Add auth mechanism to the Liquibase MongoDB connection string

• Fix missing import probably due to asynchronous PRs

• Disable VertxMDCTest on Windows

It has been extremely unstable for weeks now. Let's disable it until we have time to fix it.

• Take @ConstrainedTo into account for interceptors

Without this change interceptors meant to be
used on the client were being used on the
server as well

• Rename tooling codestarts

• ArC: introduce optimized contexts

• introduce the ContextInstances abstraction
• if optimization is enabled then generate the ContextInstances implementation for application and request context

• ⬆️ Update Gitpod configuration with Java 17

• CORS content review

• ArC: optimize client proxy delegate access

• for normal scopes for which a single context is registered
• similar to how we optimize the client proxy delegate access for application context

• Fix update on extensions

• Remove a duplicate dependency from Micrometer extension

• Avoid relying on Docker for Stork tests

We don't need the Redis Dev Services so let's not start them.

• Update the content for RHBQ docs.

• Bump io.smallrye.reactive:smallrye-mutiny-vertx-core from 3.6.0 to 3.7.2

Bumps io.smallrye.reactive:smallrye-mutiny-vertx-core from 3.6.0 to 3.7.2.

---

updated-dependencies:

• dependency-name: io.smallrye.reactive:smallrye-mutiny-vertx-core dependency-type: direct:production update-type: version-update:semver-minor ...

• Document gRPC code generation

Also:

• Allows configuring the proto directory (gRPC: Configurable proto input directory #12802)
• Provides Gradle snippets (Quarkus gRPC guide doesn't have Gradle examples #33854)

• Bump asm.version from 9.5 to 9.6

Bumps asm.version from 9.5 to 9.6.

Updates org.ow2.asm:asm from 9.5 to 9.6

Updates org.ow2.asm:asm-commons from 9.5 to 9.6

Updates org.ow2.asm:asm-tree from 9.5 to 9.6

Updates org.ow2.asm:asm-analysis from 9.5 to 9.6

Updates org.ow2.asm:asm-util from 9.5 to 9.6

---

updated-dependencies:

• dependency-name: org.ow2.asm:asm dependency-type: direct:production update-type: version-update:semver-minor
• dependency-name: org.ow2.asm:asm-commons dependency-type: direct:production update-type: version-update:semver-minor
• dependency-name: org.ow2.asm:asm-tree dependency-type: direct:production update-type: version-update:semver-minor
• dependency-name: org.ow2.asm:asm-analysis dependency-type: direct:production update-type: version-update:semver-minor
• dependency-name: org.ow2.asm:asm-util dependency-type: direct:production update-type: version-update:semver-minor ...

• Vert.x: fix NPE in ForwardedProxyHandler

The test TrustedXForwarderProxiesUnknownHostnameFailureTest sometimes fail in CI due to a NPE in ForwardedProxyHandler. This shows an actual bug: per the documentation, io.vertx.core.dns.DnsClient.lookup() may succeed with a null value when no record was found. The ForwardedProxyHandler ignores the possibility of a null result, which this commit fixes. We deal with a null result just like with a failure, because it's equivalent to a NXDOMAIN error.

• Arc - change hashing function to use base64 to shorten resulting String

• Try to stabilize PausedSchedulerTest

Let's give things a bit more time as CI is slow.

• HTTP and RestEasy-related content review

resteasy.adoc sanity check

• Indicate that 2.x is not supported anymore

• Bump Keycloak version to 22.0.5

• Disable MySQL OIDC DB token manager test due to limited Github CI resources

• Bump org.yaml:snakeyaml from 2.1 to 2.2

Bumps org.yaml:snakeyaml from 2.1 to 2.2.

• Commits

---

updated-dependencies:

• dependency-name: org.yaml:snakeyaml dependency-type: direct:production update-type: version-update:semver-minor ...

• Make Maven ITs less fragile

Enforcing versions of the plugins make sure we don't start downloading them when running the tests which can lead to timeouts. Also it makes the build more stable and actually tests the version we are using when creating new projects.

• Not pushing compile in the command actually fixes this test

When running mvn compile quarkus:dev, compile is not executed when restarting dev mode after the pom change. Not specifying compile makes the compile goal to be run.

• Try to stabilize the tests on Windows

• Disable JarRunnerIT#testNonAsciiDir on Windows

With maven-compiler-plugin 2.11.0, this test is not working anymore on Windows:
Error while storing the mojo status: Input length = 1

• Enable errors in Maven RunningInvoker

We need to see the details of the errors when something is going wrong.

• Disable DevMojoIT#testExternalReloadableArtifacts on Windows

Installing the lib jar a second time leads to an access denied exception on Windows, probably because the jar is still used by the dev mode instance.

• refactor BuildChainBuilder

• Move KeycloakContainer to keycloak-server test-framework

Create realm by posting to Keycloak admin API

• Bump io.strimzi:kafka-oauth-client from 0.12.0 to 0.14.0

• Fixes for Kafka and Pulsar schema discovery

• Bump elasticsearch-opensource-components.version from 8.10.2 to 8.10.4

Bumps elasticsearch-opensource-components.version from 8.10.2 to 8.10.4.

Updates org.elasticsearch.client:elasticsearch-rest-client from 8.10.2 to 8.10.4

• Release notes
• Changelog
• Commits

Updates co.elastic.clients:elasticsearch-java from 8.10.2 to 8.10.4

• Release notes
• Changelog
• Commits

Updates org.elasticsearch.client:elasticsearch-rest-client-sniffer from 8.10.2 to 8.10.4

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: org.elasticsearch.client:elasticsearch-rest-client dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: co.elastic.clients:elasticsearch-java dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.elasticsearch.client:elasticsearch-rest-client-sniffer dependency-type: direct:production update-type: version-update:semver-patch ...

• Bump flyway.version from 9.22.2 to 9.22.3

Bumps flyway.version from 9.22.2 to 9.22.3.

Updates org.flywaydb:flyway-core from 9.22.2 to 9.22.3

• Release notes
• Commits

Updates org.flywaydb:flyway-sqlserver from 9.22.2 to 9.22.3

• Release notes
• Commits

Updates org.flywaydb:flyway-mysql from 9.22.2 to 9.22.3

• Release notes
• Commits

Updates org.flywaydb:flyway-database-oracle from 9.22.2 to 9.22.3

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: org.flywaydb:flyway-core dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.flywaydb:flyway-sqlserver dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.flywaydb:flyway-mysql dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.flywaydb:flyway-database-oracle dependency-type: direct:production update-type: version-update:semver-patch ...

• Bump io.micrometer:micrometer-bom from 1.11.1 to 1.11.5

Bumps io.micrometer:micrometer-bom from 1.11.1 to 1.11.5.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: io.micrometer:micrometer-bom dependency-type: direct:production update-type: version-update:semver-patch ...

• Make it possible to acquire OIDC SecurityIdentity after HTTP request has completed

• Clarify why QuarkusClassLoader doesn't pass its name to the super constructor

• Enrich classloader names with the name of the application/QuarkusUnitTest

• Fix a suspicious H2 URL in Hibernate ORM test config

It doesn't matter in practice since the only test using this config reproduces a startup failure that happens before we start H2; but still, let's fix this for correctness.

• Always reset the ForkJoinPool TCCL on startup

• Safer, slightly simpler register/release patterns for config

Some config was lazily created and bound to the dev class loader through the configsForClassLoader map
io.smallrye.config.SmallRyeConfigProviderResolver#getConfig(java.lang.ClassLoader), and the corresponding map entry was never cleared, resulting in the corresponding classloader never being garbage collected.

• Avoid referencing ClassLoaders in ProtectionDomains

This removes a whole class of metaspace leaks caused by Thread.inheritedAccessControlContext referencing ProtectionDomains which reference older classloaders.

Of course this may have impacts on how the SecurityManager behaves, but as I understand it, absolutely no part of Quarkus is ready to run with a SecurityManager enabled anyway.

• Improve error messages on KafkaDevServicesDevModeTestCase failures

• Plug leak in tests relying on lazily-initialized config

Since a previous commit, we now remember the lazily-created config in QuarkusConfigFactory, which is good because in dev mode it allows us to release it upon restart (when we call setConfig(null)).

However, in tests that rely on this lazily initialized config, just calling releaseConfig(ConfigProvider.getConfig()) is no longer enough, because of that remembered config in QuarkusConfigFactory: we need to reset that reference too.

If we forget to reset it, then when KafkaDevServicesDevModeTestCase will execute, TestHTTPResourceManager#getUri will retrieve the leaked config from DefaultSerdeConfigTest or DefaultSchemaConfigTest, the injected URI in KafkaDevServicesDevModeTestCase will be wrong, and the test will fail (with very unhelpful error messages).

• Stronger safeguards against leaked config in internal Quarkus*Test extensions

If someone calls ConfigProvider.getConfig() out of the blue in a test that doesn't use any Quarkus*Test extension, this will call QuarkusConfigFactory and leak config in two ways:

1. In QuarkusConfigFactory#config
2. In SmallRyeConfigProviderResolver, registering config for the TCCL, which in such a case is most likely the system CL.

A well-behaved test would call QuarkusConfigFactory.setConfig(null) to clean up all that, but it's easy to miss and there is potential for ConfigProvider.getConfig() being called indirectly, so there's no way we can guarantee all tests are well-behaved.

This should at least guarantee that after a badly behaving test executes, the next test using a Quarkus*Test extension will clean up the mess.

• More comprehensive registration/release of config in some tests

If someone calls ConfigProvider.getConfig() out of the blue in a test that doesn't use any Quarkus*Test extension, this will indirectly call QuarkusConfigFactory and leak config in two ways:

1. In QuarkusConfigFactory#config
2. In SmallRyeConfigProviderResolver, registering config for the TCCL, which in such a case is most likely the system CL.

Thus, a well-behaved test should call QuarkusConfigFactory.setConfig(null) to clean up all that, no just SmallRyeConfigProviderResolver.releaseConfig().

Similarly, tests that register configuration explicitly can just call QuarkusConfigFactory.setConfig(config) at the beginning and QuarkusConfigFactory.setConfig(null) at the end,
which will properly simulate how a real Quarkus application behaves, and should cover all edge cases involving multiple classloaders, properly cleaning up everything at the end of the test.

• Merge test-related ConfigUtils into a single class

• Maven CLI: use recipes for platform extensions

• Raise FileSystemWatcherTestCase wait times

Consecutive to:
https://github.com/quarkusio/quarkus/runs/18068790284

• Improve error messages when an @Embedded type is not annotated with @embeddable

• Strimzi OAuth substitutions

• Changes to support jaeger remote sampler

• Ignore bridge methods when checking for @embeddable annotation on @Embedded/@EmbeddedId

• enable use layer 7 proxy for reactive pg client

• Remove type from ResolverMapKey

• Update OpenSearch container test configuration

• Limit OpenSearch memory usage
• Disable disk-based shard allocation thresholds

• Fix grpc-generation-reference.adoc

It was missing the header, not including the attributes and not using the right syntax for subs=attributes+ leading to all sorts of rendering issues.

• Fix a broken reference in grpc-getting-started.adoc

• docs: how to store secrets locally

Handy guide on how to deal with local secrets, SEO friendly.

• Add to Security JPA support for named persistence units

• Bump jaxb-runtime.version from 4.0.3 to 4.0.4

Bumps jaxb-runtime.version from 4.0.3 to 4.0.4.

Updates org.glassfish.jaxb:jaxb-runtime from 4.0.3 to 4.0.4

Updates org.glassfish.jaxb:jaxb-core from 4.0.3 to 4.0.4

Updates org.glassfish.jaxb:txw2 from 4.0.3 to 4.0.4

---

updated-dependencies:

• dependency-name: org.glassfish.jaxb:jaxb-runtime dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.glassfish.jaxb:jaxb-core dependency-type: direct:production update-type: version-update:semver-patch
• dependency-name: org.glassfish.jaxb:txw2 dependency-type: direct:production update-type: version-update:semver-patch ...

• Fix sockjs documentation

• ArC: improve how single-context normal scopes are found

• Disable Http2RSTFloodProtectionTest on Windows

• Fix typo in reactive-event-bus.adoc

• Validate Startup observers are not secured with RBAC annotations

• Cleanup codestarter tests

• Remove unnecessary modifiers
• Unify line-breaks
• Unify indentation

• Make contextResolverMap used for both reader and writer

• Update virtual thread documentation to Java 21

• Add a description to the Stork extension metadata

• Kc Admin Cl.:Fix typo that allows using customized ObjectMapper

• Bump apicurio-registry.version from 2.4.7.Final to 2.4.14.Final

• Kafka Confluent avro schema serializer doc update

Resolves #36372

• Qute: dev mode - add config to skip restart for some templates

• resolves Qute templates needs a "no restart" config to avoid auto-reload in dev-mode #36692

• Maven CLI: add wildcard matching into recipes detection

• Recommend GraalVM CE

• Fix missing section in the gRPC getting started guide

• Security JPA: support Hibernate multitenancy

• Exclude resteasy-client from lra-proxy-api in narayana-lra extension

• Add jvmArgs option to Quarkus Gradle plugin task quarkusRun

• added discord as know oidc provider

added unittest for merging discord oidc properties

• Quarkus code-gen (Gradle): Fix behavior to filter unavailable services

Java Services (those in META-INF/services/* files) that are defined in the (Gradle) project that uses the Quarkus Gradle plugin, are not available when Quarkus code generation runs. This is simply a task-dependency requirement in Gradle, because Java compilation happens after code generation. If a Java service, for example a Smallrye config sources, is present and the (Smallrye) configuration is needed by a Quarkus extension, the build fails during Quarkus code generation with an error message like this:

org.gradle.api.tasks.TaskExecutionException: Execution failed for task ':quarkusGenerateCode'.
...
Caused by: org.gradle.workers.internal.DefaultWorkerExecutor$WorkExecutionException: A failure occurred while executing io.quarkus.gradle.tasks.worker.CodeGenWorker
...
Caused by: java.util.ServiceConfigurationError: io.smallrye.config.ConfigSourceFactory: Provider xyz not found

io.quarkus.deployment.CodeGenerator has a mechanism to filter out unavailable services via getUnavailableConfigServices(). However the callback passed to io.quarkus.paths.PathTree.apply() can stop before all roots/trees (io.quarkus.paths.PathTree.getRoots()) have been "asked" (MultiRootPathTree), because the callback can return a non-null value. This "early stop" happens before the root/tree containing the source with the META-INF/services/* has been processed.

The bug is only triggered, if a Java service is defined in the Gradle project using the Quarkus Gradle plugin and if a Quarkus extension using the configuration is a dependency of that project.

This change updates the callback implementation to collect all unavailable services from all PathTree roots/trees.

An integration test using the Gradle plugin is included as well.

Two logging/spelling mistakes have been fixed as well.

Fixes #36716

• Fix assertions in Hibernate ORM 5.6 compatibility tests

Hibernate ORM 5.6 does not, in fact, preserve information for OffsetTime columns. It just slaps the current JVM timezone on a stored LocalTime.

• Gradle plugin: use full URI for configuration source locations

io.quarkus.gradle.tasks.EffectiveConfig.CombinedConfigSourceProvider passes only the "file extension" (e.g. application.properties) down to io.smallrye.config.AbstractLocationConfigSourceLoader#loadConfigSources(java.lang.String[], int, java.lang.ClassLoader), which may let that function behave wrong and try to for example access an application.properties in the wrong location. This can be reproduced by placing an application.properties file in the project directory of a Gradle project that uses the Quarkus Gradle plugin.

This change fixes this behavior by passing down the correct locations as the String representation of the resource URIs, instead of just the "file extensions".

Fixes #36767

• Tests to check content type between Services and OpenAPI

• Kafka Streams Dev UI migration to v2

• Fix codestarts snapshots

• [Unit test always succeeds in combination with hibernate-reactive & panache #36582] Fix bug: TransactionalUniAsserter never fails

TransactionalUniAsserterTestMethodInvoker is a subclass of RunOnVertxContextTestMethodInvoker.

The problem is that there were two separate pointers keeping track of the asserter in the superclass and in the subclass. This lead to only one pointer being initialized and, if the wrong pointer was null-checked, the asserter was ignored causing the test to never fail.

This commit fixes the issue by keeping only one reference to the asserter in the superclass.

• [Unit test always succeeds in combination with hibernate-reactive & panache #36582] Minor clean up in TransactionalUniAsserterTest

Use method reference where possible

• [Unit test always succeeds in combination with hibernate-reactive & panache #36582] Minor clean up around lambdas

• [Unit test always succeeds in combination with hibernate-reactive & panache #36582] Add UnwrappableUniAsserter interface

The goal is to extract the asUni() method from UniAsserter

• Duplicate Authorization Bearer Header Fix

• Tiny Vale tweaks for Datasource and Logging guide

• More reliable test setup in integration-tests/hibernate-orm-tenancy/datasource

The previous config was relying on FlyWay on a default datasource to create other databases which named datasources pointed at.

Which works well, until a named datasource gets initialized before the default datasource; then named datasource initialization fails because the corresponding database doesn't exist yet.

This happened on my local laptop, I don't know why it didn't happen on CI.

• Skip non-existing directory when watching for changes

Fix #32092. The issue was not specific to Gradle.
It was problematic with Gradle, as it was configuring the watcher on not existing directories.

• Remove erroneous preview status from cache doc

• Fix OIDC key resolver to accept SHA256 certificate thumbprints

---

[quarkus-bot]

Thanks for your pull request!

The title of your pull request does not follow our editorial rules. Could you have a look?

• title should preferably start with an uppercase character (if it makes sense!)
• title should not contain an issue number (use Fix #1234 in the description instead)

_{This message is automatically generated by a bot.}

[sberyozkin]

Please rework this PR