Merge pull request #40973 from gsmet/3.11.1-backports-1

[3.11] 3.11.1 backports 1

bom/application/pom.xml

@@ -26,7 +26,7 @@
         <parsson.version>1.1.6</parsson.version>
         <resteasy-microprofile.version>2.1.5.Final</resteasy-microprofile.version>
         <resteasy-spring-web.version>3.1.2.Final</resteasy-spring-web.version>
-        <resteasy.version>6.2.8.Final</resteasy.version>
+        <resteasy.version>6.2.9.Final</resteasy.version>
         <opentracing.version>0.33.0</opentracing.version>
         <opentracing-jdbc.version>0.2.4</opentracing-jdbc.version>
         <opentracing-kafka.version>0.1.15</opentracing-kafka.version>
@@ -67,7 +67,7 @@
         <jakarta.activation.version>2.1.3</jakarta.activation.version>
         <jakarta.annotation-api.version>3.0.0</jakarta.annotation-api.version>
         <jakarta.authentication-api>3.0.0</jakarta.authentication-api>
-        <jakarta.authorization-api.version>3.0.0</jakarta.authorization-api.version>
+        <jakarta.authorization-api.version>2.1.0</jakarta.authorization-api.version>
         <jakarta.el-api.version>5.0.1</jakarta.el-api.version>
         <jakarta.enterprise.cdi-api.version>4.1.0</jakarta.enterprise.cdi-api.version>
         <jakarta.inject-api.version>2.0.1</jakarta.inject-api.version>
@@ -104,12 +104,12 @@
         <hibernate-orm.version>6.5.2.Final</hibernate-orm.version>
         <bytebuddy.version>1.14.15</bytebuddy.version> <!-- Version controlled by Hibernate ORM's needs -->
         <hibernate-commons-annotations.version>6.0.6.Final</hibernate-commons-annotations.version> <!-- version controlled by Hibernate ORM -->
-        <hibernate-reactive.version>2.3.0.Final</hibernate-reactive.version>
+        <hibernate-reactive.version>2.3.1.Final</hibernate-reactive.version>
         <hibernate-validator.version>8.0.1.Final</hibernate-validator.version>
         <!-- When updating, align hibernate-search.version-for-documentation in docs/pom.xml -->
         <hibernate-search.version>7.1.1.Final</hibernate-search.version>
         <narayana.version>7.0.1.Final</narayana.version>
-        <agroal.version>2.3</agroal.version>
+        <agroal.version>2.4</agroal.version>
         <jboss-transaction-spi.version>8.0.0.Final</jboss-transaction-spi.version>
         <elasticsearch-opensource-components.version>8.13.4</elasticsearch-opensource-components.version>
         <rxjava.version>2.2.21</rxjava.version>
@@ -216,7 +216,7 @@
         <jgit.version>6.9.0.202403050737-r</jgit.version>
         <!-- these two artifacts needs to be compatible together -->
         <strimzi-oauth.version>0.15.0</strimzi-oauth.version>
-        <strimzi-oauth.nimbus.version>9.39</strimzi-oauth.nimbus.version>
+        <strimzi-oauth.nimbus.version>9.39.3</strimzi-oauth.nimbus.version>
         <jose4j.version>0.9.6</jose4j.version>
         <java-buildpack-client.version>0.0.6</java-buildpack-client.version>
         <org-crac.version>0.1.3</org-crac.version>

build-parent/pom.xml

@@ -75,7 +75,7 @@
              and unfortunately annotation processors are not covered by dependency management
              in kotlin-maven-plugin; see https://github.com/quarkusio/quarkus/issues/37477#issuecomment-1923662964
          -->
-        <hibernate-orm.version>6.4.4.Final</hibernate-orm.version>
+        <hibernate-orm.version>6.5.2.Final</hibernate-orm.version>
         <!-- Antlr 4 is used by the PanacheQL parser but also needs to match the requirements of Hibernate ORM 6.x-->
         <antlr.version>4.13.0</antlr.version>
 

core/deployment/src/main/java/io/quarkus/deployment/configuration/ConfigCompatibility.java

@@ -285,12 +285,12 @@ private static List<String> quarkusPackageDecompilerVersion(ConfigSourceIntercep
 
     private static List<String> quarkusPackageDecompilerEnabled(ConfigSourceInterceptorContext ctxt, NameIterator ni) {
         // simple mapping to a new name
-        return List.of("quarkus.package.decompiler.enabled");
+        return List.of("quarkus.package.jar.decompiler.enabled");
     }
 
     private static List<String> quarkusPackageDecompilerJarDirectory(ConfigSourceInterceptorContext ctxt, NameIterator ni) {
         // simple mapping to a new name
-        return List.of("quarkus.package.decompiler.jar-directory");
+        return List.of("quarkus.package.jar.decompiler.jar-directory");
     }
 
     private static List<String> quarkusPackageManifestAttributes(ConfigSourceInterceptorContext ctxt, NameIterator ni) {

core/deployment/src/main/java/io/quarkus/deployment/dev/IsolatedRemoteDevModeMain.java

@@ -253,14 +253,19 @@ private Closeable doConnect() {
                     @Override
                     public Map<String, byte[]> apply(Set<String> fileNames) {
                         Map<String, byte[]> ret = new HashMap<>();
-                        for (String i : fileNames) {
+                        for (String filename : fileNames) {
                             try {
-                                Path resolvedPath = appRoot.resolve(i);
+                                Path resolvedPath = appRoot.resolve(filename);
+                                // Ensure that path stays inside appRoot
+                                if (!resolvedPath.startsWith(appRoot)) {
+                                    log.errorf("Attempted to access %s outside of %s", resolvedPath, appRoot);
+                                    continue;
+                                }
                                 if (!Files.isDirectory(resolvedPath)) {
-                                    ret.put(i, Files.readAllBytes(resolvedPath));
+                                    ret.put(filename, Files.readAllBytes(resolvedPath));
                                 }
                             } catch (IOException e) {
-                                log.error("Failed to read file " + i, e);
+                                log.error("Failed to read file " + filename, e);
                             }
                         }
                         return ret;

devtools/maven/src/main/java/io/quarkus/maven/DevMojo.java

@@ -25,7 +25,6 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedHashSet;
@@ -746,15 +745,15 @@ private void executeGoal(PluginExec pluginExec, String goal, Map<String, String>
 
     private List<String> readAnnotationProcessors(Xpp3Dom pluginConfig) {
         if (pluginConfig == null) {
-            return Collections.emptyList();
+            return List.of();
         }
         Xpp3Dom annotationProcessors = pluginConfig.getChild("annotationProcessors");
         if (annotationProcessors == null) {
-            return Collections.emptyList();
+            return List.of();
         }
         Xpp3Dom[] processors = annotationProcessors.getChildren("annotationProcessor");
         if (processors.length == 0) {
-            return Collections.emptyList();
+            return List.of();
         }
         List<String> ret = new ArrayList<>(processors.length);
         for (Xpp3Dom processor : processors) {
@@ -765,21 +764,18 @@ private List<String> readAnnotationProcessors(Xpp3Dom pluginConfig) {
 
     private Set<File> readAnnotationProcessorPaths(Xpp3Dom pluginConfig) throws MojoExecutionException {
         if (pluginConfig == null) {
-            return Collections.emptySet();
+            return Set.of();
         }
         Xpp3Dom annotationProcessorPaths = pluginConfig.getChild("annotationProcessorPaths");
         if (annotationProcessorPaths == null) {
-            return Collections.emptySet();
+            return Set.of();
         }
+        var versionConstraints = getAnnotationProcessorPathsDepMgmt(pluginConfig);
         Xpp3Dom[] paths = annotationProcessorPaths.getChildren("path");
         Set<File> elements = new LinkedHashSet<>();
         try {
             List<org.eclipse.aether.graph.Dependency> dependencies = convertToDependencies(paths);
-            // NOTE: The Maven Compiler Plugin also supports a flag (disabled by default) for applying managed dependencies to
-            // the dependencies of the APT plugins (not them directly), which we don't support yet here
-            // you can find the implementation at https://github.com/apache/maven-compiler-plugin/pull/180/files#diff-d4bac42d8f4c68d397ddbaa05c1cbbed7984ef6dc0bb9ea60739df78997e99eeR1610
-            // when/if we need it
-            CollectRequest collectRequest = new CollectRequest(dependencies, Collections.emptyList(),
+            CollectRequest collectRequest = new CollectRequest(dependencies, versionConstraints,
                     project.getRemoteProjectRepositories());
             DependencyRequest dependencyRequest = new DependencyRequest();
             dependencyRequest.setCollectRequest(collectRequest);
@@ -796,6 +792,18 @@ private Set<File> readAnnotationProcessorPaths(Xpp3Dom pluginConfig) throws Mojo
         }
     }
 
+    private List<org.eclipse.aether.graph.Dependency> getAnnotationProcessorPathsDepMgmt(Xpp3Dom pluginConfig) {
+        final Xpp3Dom useDepMgmt = pluginConfig.getChild("annotationProcessorPathsUseDepMgmt");
+        if (useDepMgmt == null || !Boolean.parseBoolean(useDepMgmt.getValue())) {
+            return List.of();
+        }
+        var dm = project.getDependencyManagement();
+        if (dm == null) {
+            return List.of();
+        }
+        return getProjectAetherDependencyManagement();
+    }
+
     private List<org.eclipse.aether.graph.Dependency> convertToDependencies(Xpp3Dom[] paths) throws MojoExecutionException {
         List<org.eclipse.aether.graph.Dependency> dependencies = new ArrayList<>();
         for (Xpp3Dom path : paths) {
@@ -848,7 +856,7 @@ private String toNullIfEmpty(String value) {
     private List<Dependency> getProjectManagedDependencies() {
         DependencyManagement dependencyManagement = project.getDependencyManagement();
         if (dependencyManagement == null || dependencyManagement.getDependencies() == null) {
-            return Collections.emptyList();
+            return List.of();
         }
         return dependencyManagement.getDependencies();
     }
@@ -864,7 +872,7 @@ private String getValue(Xpp3Dom path, String element, String defaultValue) {
 
     private Set<org.eclipse.aether.graph.Exclusion> convertToAetherExclusions(Xpp3Dom exclusions) {
         if (exclusions == null) {
-            return Collections.emptySet();
+            return Set.of();
         }
         Set<Exclusion> aetherExclusions = new HashSet<>();
         for (Xpp3Dom exclusion : exclusions.getChildren("exclusion")) {
@@ -1489,21 +1497,6 @@ private void addQuarkusDevModeDeps(MavenDevModeLauncher.Builder builder, Applica
             throw new MojoExecutionException("Classpath resource " + pomPropsPath + " is missing version");
         }
 
-        final List<org.eclipse.aether.graph.Dependency> managed = new ArrayList<>(
-                project.getDependencyManagement().getDependencies().size());
-        project.getDependencyManagement().getDependencies().forEach(d -> {
-            final List<Exclusion> exclusions;
-            if (!d.getExclusions().isEmpty()) {
-                exclusions = new ArrayList<>(d.getExclusions().size());
-                d.getExclusions().forEach(e -> exclusions.add(new Exclusion(e.getGroupId(), e.getArtifactId(), "*", "*")));
-            } else {
-                exclusions = List.of();
-            }
-            managed.add(new org.eclipse.aether.graph.Dependency(
-                    new DefaultArtifact(d.getGroupId(), d.getArtifactId(), d.getClassifier(), d.getType(), d.getVersion()),
-                    d.getScope(), d.isOptional(), exclusions));
-        });
-
         final DefaultArtifact devModeJar = new DefaultArtifact(devModeGroupId, devModeArtifactId, ArtifactCoords.TYPE_JAR,
                 devModeVersion);
         final DependencyResult cpRes = repoSystem.resolveDependencies(repoSession,
@@ -1513,7 +1506,7 @@ private void addQuarkusDevModeDeps(MavenDevModeLauncher.Builder builder, Applica
                                         // it doesn't matter what the root artifact is, it's an alias
                                         .setRootArtifact(new DefaultArtifact(IO_QUARKUS, "quarkus-devmode-alias",
                                                 ArtifactCoords.TYPE_JAR, "1.0"))
-                                        .setManagedDependencies(managed)
+                                        .setManagedDependencies(getProjectAetherDependencyManagement())
                                         .setDependencies(List.of(
                                                 new org.eclipse.aether.graph.Dependency(devModeJar, JavaScopes.RUNTIME),
                                                 new org.eclipse.aether.graph.Dependency(new DefaultArtifact(
@@ -1539,6 +1532,24 @@ private void addQuarkusDevModeDeps(MavenDevModeLauncher.Builder builder, Applica
         }
     }
 
+    private List<org.eclipse.aether.graph.Dependency> getProjectAetherDependencyManagement() {
+        final List<org.eclipse.aether.graph.Dependency> managed = new ArrayList<>(
+                project.getDependencyManagement().getDependencies().size());
+        project.getDependencyManagement().getDependencies().forEach(d -> {
+            final List<Exclusion> exclusions;
+            if (!d.getExclusions().isEmpty()) {
+                exclusions = new ArrayList<>(d.getExclusions().size());
+                d.getExclusions().forEach(e -> exclusions.add(new Exclusion(e.getGroupId(), e.getArtifactId(), "*", "*")));
+            } else {
+                exclusions = List.of();
+            }
+            managed.add(new org.eclipse.aether.graph.Dependency(
+                    new DefaultArtifact(d.getGroupId(), d.getArtifactId(), d.getClassifier(), d.getType(), d.getVersion()),
+                    d.getScope(), d.isOptional(), exclusions));
+        });
+        return managed;
+    }
+
     private void setKotlinSpecificFlags(MavenDevModeLauncher.Builder builder) {
         Plugin kotlinMavenPlugin = null;
         for (Plugin plugin : project.getBuildPlugins()) {

docs/pom.xml

@@ -39,8 +39,8 @@
         <vale.image>docker.io/jdkato/vale:v2.15.5</vale.image>
 
         <!-- Keep these in sync with the full versions in bom/application/pom.xml -->
-        <hibernate-orm.version-for-documentation>6.4</hibernate-orm.version-for-documentation>
-        <hibernate-search.version-for-documentation>7.0</hibernate-search.version-for-documentation>
+        <hibernate-orm.version-for-documentation>6.5</hibernate-orm.version-for-documentation>
+        <hibernate-search.version-for-documentation>7.1</hibernate-search.version-for-documentation>
     </properties>
 
     <name>Quarkus - Documentation</name>

docs/src/main/asciidoc/datasource.adoc

@@ -543,7 +543,7 @@ All <<extensions-and-database-drivers-reference,supported JDBC drivers do>>,
 but <<other-databases,other JDBC drivers>> might not.
 . Make sure your database server is configured to enable XA.
 . Enable XA support explicitly for each relevant datasource by setting
-<<quarkus-agroal_quarkus-datasource-jdbc-transactions,`quarkus.datasource[.optional name].transactions`>> to `xa`.
+<<quarkus-agroal_quarkus-datasource-jdbc-transactions,`quarkus.datasource[.optional name].jdbc.transactions`>> to `xa`.
 
 Using XA, a rollback in one datasource will trigger a rollback in every other datasource enrolled in the transaction.
 

docs/src/main/asciidoc/getting-started.adoc

@@ -481,7 +481,7 @@ but users can also choose to expose one that might present a security risk under
 
 If the application contains the `quarkus-info` extension, then Quarkus will by default expose the `/q/info` endpoint which provides information about the build, java version, version control, and operating system. The level of detail of the exposed information is configurable.
 
-All CDI beans implementing the `InfoContributor` will be picked up and their data will be append to the endpoint.
+All CDI beans implementing the `InfoContributor` will be picked up and their data will be appended to the endpoint.
 
 ==== Configuration Reference
 

docs/src/main/asciidoc/hibernate-reactive.adoc

@@ -191,7 +191,7 @@ and will have it use the default datasource.
 The configuration properties listed here allow you to override such defaults, and customize and tune various aspects.
 
 Hibernate Reactive uses the same properties you would use for Hibernate ORM. You will notice that some properties
-contain `jdbc` in the name but there is not JDBC in Hibernate Reactive, these are simply legacy property names.
+contain `jdbc` in the name but there is no JDBC in Hibernate Reactive, these are simply legacy property names.
 
 include::{generated-dir}/config/quarkus-hibernate-orm.adoc[opts=optional, leveloffset=+2]
 

docs/src/main/asciidoc/javascript/config.js

@@ -24,7 +24,7 @@ if(tables){
                 const decoration = td.firstElementChild.lastElementChild.firstElementChild;
                 const iconDecoration = decoration.children.item(0);
                 const collapsibleSpan = decoration.children.item(1);
-                const descDiv = td.firstElementChild.children.item(1);
+                const descDiv = td.firstElementChild.querySelector(".description");
                 const collapsibleHandler = makeCollapsibleHandler(descDiv, td, row, collapsibleSpan, iconDecoration);
                 row.addEventListener('click', collapsibleHandler);
             }

docs/src/main/asciidoc/opentelemetry.adoc

@@ -177,7 +177,7 @@ We have 2 options:
 
 * Take a look at: xref:observability-devservices-lgtm.adoc[Getting Started with Grafana-OTel-LGTM].
 
-This features a Quarkus Dev service including a Grafana for visualizing data, Loky to store logs, Tempo to store traces and Prometheus to store metrics. Also provides and OTel collector to receive the data.
+This features a Quarkus Dev service including a Grafana for visualizing data, Loki to store logs, Tempo to store traces and Prometheus to store metrics. Also provides and OTel collector to receive the data.
 
 === Jaeger to see traces option
 

docs/src/main/asciidoc/podman.adoc

@@ -73,7 +73,7 @@ With the above rootless setup on Linux, you will need to configure clients, such
 
 [source,bash]
 ----
-export DOCKER_HOST=$(podman info --format '{{.Host.RemoteSocket.Path}}')
+export DOCKER_HOST=unix://$(podman info --format '{{.Host.RemoteSocket.Path}}')
 ----
 
 == Other Linux settings

docs/src/main/asciidoc/security-customization.adoc

@@ -74,7 +74,7 @@ public class CustomAwareJWTAuthMechanism implements HttpAuthenticationMechanism
 
 TIP: The `HttpAuthenticationMechanism` should transform incoming HTTP request with suitable authentication credentials
 into an `io.quarkus.security.identity.request.AuthenticationRequest` instance and delegate the authentication to the `io.quarkus.security.identity.IdentityProviderManager`.
-Leaving authentication to the `io.quarkus.security.identity.IdentityProvider`s gives you more options for credentials verifications,
+Leaving authentication to the ``io.quarkus.security.identity.IdentityProvider``s gives you more options for credentials verifications,
 as well as convenient way to perform blocking tasks.
 Nevertheless, the `io.quarkus.security.identity.IdentityProvider` can be omitted and the `HttpAuthenticationMechanism` is free to authenticate request on its own in trivial use cases.
 
@@ -744,4 +744,4 @@ For that reason, asynchronous processing can have positive effect on performance
 * xref:security-overview.adoc[Quarkus Security overview]
 * xref:security-architecture.adoc[Quarkus Security architecture]
 * xref:security-authentication-mechanisms.adoc#other-supported-authentication-mechanisms[Authentication mechanisms in Quarkus]
-* xref:security-identity-providers.adoc[Identity providers]
+* xref:security-identity-providers.adoc[Identity providers]

docs/src/main/asciidoc/writing-extensions.adoc

@@ -2252,7 +2252,7 @@ The only particular aspect of writing Quarkus extensions in Eclipse is that APT
 Quarkus generates a lot of classes during the build phase and in many cases also transforms existing classes.
 It is often extremely useful to see the generated bytecode and transformed classes during the development of an extension.
 
-If you set the `quarkus.package.decompiler.enabled` property to `true` then Quarkus will download and invoke the https://github.com/Vineflower/vineflower[Vineflower decompiler] and dump the result in the `decompiled` directory of the build tool output (`target/decompiled` for Maven for example).
+If you set the `quarkus.package.jar.decompiler.enabled` property to `true` then Quarkus will download and invoke the https://github.com/Vineflower/vineflower[Vineflower decompiler] and dump the result in the `decompiled` directory of the build tool output (`target/decompiled` for Maven for example).
 
 NOTE: This property only works during a normal production build (i.e. not for dev mode/tests) and when `fast-jar` packaging type is used (the default behavior).