[3.11] 3.11.2 backports 1

.mvn/extensions.xml

@@ -12,7 +12,7 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>quarkus-build-caching-extension</artifactId>
-        <version>1.1</version>
+        <version>1.2</version>
     </extension>
     <extension>
         <groupId>io.quarkus.develocity</groupId>

core/deployment/src/main/java/io/quarkus/deployment/dev/QuarkusDevModeLauncher.java

@@ -85,12 +85,6 @@ public B debug(String debug) {
             return (B) this;
         }
 
-        @SuppressWarnings("unchecked")
-        public B debugPortOk(Boolean debugPortOk) {
-            QuarkusDevModeLauncher.this.debugPortOk = debugPortOk;
-            return (B) this;
-        }
-
         @SuppressWarnings("unchecked")
         public B suspend(String suspend) {
             QuarkusDevModeLauncher.this.suspend = suspend;
@@ -303,10 +297,10 @@ public R build() throws Exception {
 
     private List<String> args = new ArrayList<>(0);
     private String debug;
-    private Boolean debugPortOk;
     private String suspend;
     private String debugHost = "localhost";
     private String debugPort = "5005";
+    private String actualDebugPort;
     private File projectDir;
     private File buildDir;
     private File outputDir;
@@ -390,12 +384,13 @@ protected void prepare() throws Exception {
 
         if (debug != null && debug.equalsIgnoreCase("client")) {
             args.add("-agentlib:jdwp=transport=dt_socket,address=" + debugHost + ":" + port + ",server=n,suspend=" + suspend);
+            actualDebugPort = String.valueOf(port);
         } else if (debug == null || !debug.equalsIgnoreCase("false")) {
             // if the debug port is used, we want to make an effort to pick another one
             // if we can't find an open port, we don't fail the process launch, we just don't enable debugging
             // Furthermore, we don't check this on restarts, as the previous process is still running
             boolean warnAboutChange = false;
-            if (debugPortOk == null) {
+            if (actualDebugPort == null) {
                 int tries = 0;
                 while (true) {
                     boolean isPortUsed;
@@ -408,20 +403,19 @@ protected void prepare() throws Exception {
                         isPortUsed = false;
                     }
                     if (!isPortUsed) {
-                        debugPortOk = true;
+                        actualDebugPort = String.valueOf(port);
                         break;
                     }
                     if (++tries >= 5) {
-                        debugPortOk = false;
                         break;
                     } else {
                         port = getRandomPort();
                     }
                 }
             }
-            if (debugPortOk) {
+            if (actualDebugPort != null) {
                 if (warnAboutChange) {
-                    warn("Changed debug port to " + port + " because of a port conflict");
+                    warn("Changed debug port to " + actualDebugPort + " because of a port conflict");
                 }
                 args.add("-agentlib:jdwp=transport=dt_socket,address=" + debugHost + ":" + port + ",server=y,suspend="
                         + suspend);
@@ -547,8 +541,8 @@ public List<String> args() {
         return args;
     }
 
-    public Boolean getDebugPortOk() {
-        return debugPortOk;
+    public String getActualDebugPort() {
+        return actualDebugPort;
     }
 
     protected abstract boolean isDebugEnabled();

core/runtime/src/main/java/io/quarkus/runtime/ApplicationLifecycleManager.java

@@ -183,7 +183,7 @@ public static void run(Application application, Class<? extends QuarkusApplicati
                     } else {
                         for (Integer port : ports) {
                             applicationLogger
-                                    .warnf("Use 'ss -anop | grep %d' or 'netstat -anop | grep %d' to identify the process occupying the port.",
+                                    .warnf("Use 'ss -anop | grep %1$d' or 'netstat -anop | grep %1$d' to identify the process occupying the port.",
                                             port);
                         }
                         applicationLogger.warn("You can try to kill it with 'kill -9 <pid>'.");

devtools/gradle/gradle-model/src/main/java/io/quarkus/gradle/dependency/ApplicationDeploymentClasspathBuilder.java

@@ -234,7 +234,8 @@ private void setUpDeploymentConfiguration() {
     private void setUpCompileOnlyConfiguration() {
         if (!project.getConfigurations().getNames().contains(compileOnlyConfigurationName)) {
             project.getConfigurations().register(compileOnlyConfigurationName, config -> {
-                config.extendsFrom(project.getConfigurations().getByName(JavaPlugin.COMPILE_ONLY_CONFIGURATION_NAME));
+                config.extendsFrom(project.getConfigurations().getByName(platformConfigurationName),
+                        project.getConfigurations().getByName(JavaPlugin.COMPILE_ONLY_CONFIGURATION_NAME));
                 config.shouldResolveConsistentlyWith(getDeploymentConfiguration());
                 config.setCanBeConsumed(false);
             });

devtools/maven/src/main/java/io/quarkus/maven/DevMojo.java

@@ -478,15 +478,19 @@ public void close() throws IOException {
                     }
                     if (!changed.isEmpty()) {
                         getLog().info("Changes detected to " + changed + ", restarting dev mode");
+
+                        // stop the runner before we build the new one as the debug port being free
+                        // is tested when building the runner
+                        runner.stop();
+
                         final DevModeRunner newRunner;
                         try {
                             bootstrapId = handleAutoCompile();
-                            newRunner = new DevModeRunner(runner.launcher.getDebugPortOk(), bootstrapId);
+                            newRunner = new DevModeRunner(runner.launcher.getActualDebugPort(), bootstrapId);
                         } catch (Exception e) {
                             getLog().info("Could not load changed pom.xml file, changes not applied", e);
                             continue;
                         }
-                        runner.stop();
                         newRunner.run();
                         runner = newRunner;
                     }
@@ -1171,8 +1175,8 @@ private DevModeRunner(String bootstrapId) throws Exception {
             launcher = newLauncher(null, bootstrapId);
         }
 
-        private DevModeRunner(Boolean debugPortOk, String bootstrapId) throws Exception {
-            launcher = newLauncher(debugPortOk, bootstrapId);
+        private DevModeRunner(String actualDebugPort, String bootstrapId) throws Exception {
+            launcher = newLauncher(actualDebugPort, bootstrapId);
         }
 
         Collection<Path> pomFiles() {
@@ -1226,7 +1230,7 @@ void stop() throws InterruptedException {
         }
     }
 
-    private QuarkusDevModeLauncher newLauncher(Boolean debugPortOk, String bootstrapId) throws Exception {
+    private QuarkusDevModeLauncher newLauncher(String actualDebugPort, String bootstrapId) throws Exception {
         String java = null;
         // See if a toolchain is configured
         if (toolchainManager != null) {
@@ -1244,8 +1248,7 @@ private QuarkusDevModeLauncher newLauncher(Boolean debugPortOk, String bootstrap
                 .suspend(suspend)
                 .debug(debug)
                 .debugHost(debugHost)
-                .debugPort(debugPort)
-                .debugPortOk(debugPortOk)
+                .debugPort(actualDebugPort)
                 .deleteDevJar(deleteDevJar);
 
         setJvmArgs(builder);

docs/src/main/asciidoc/building-my-first-extension.adoc

@@ -29,9 +29,15 @@
 :prerequisites-no-graalvm:
 include::{includes}/prerequisites.adoc[]
 
+[CAUTION]
+====
+Writing extension with any other than Java and Maven has **not** been tested by the Quarkus team so your mileage may vary
+if you stray off this path
+====
+
 == Basic Concepts
 
 First things first, we will need to start with some basic concepts.
 
 * JVM mode vs Native mode
   ** Quarkus is first and foremost a Java framework, that means you can develop, package and run classic JAR applications, that's what we call *JVM mode*.

docs/src/main/asciidoc/datasource.adoc

@@ -531,7 +531,7 @@ would result in an exception similar to this:
 Caused by: java.sql.SQLException: Exception in association of connection to existing transaction
         at io.agroal.narayana.NarayanaTransactionIntegration.associate(NarayanaTransactionIntegration.java:130)
         ...
-Caused by: java.sql.SQLException: Unable to enlist connection to existing transaction
+Caused by: java.sql.SQLException: Failed to enlist. Check if a connection from another datasource is already enlisted to the same transaction
         at io.agroal.narayana.NarayanaTransactionIntegration.associate(NarayanaTransactionIntegration.java:121)
         ...
 ----

docs/src/main/asciidoc/deploying-to-kubernetes.adoc

@@ -1462,8 +1462,13 @@ spec:
           protocol: "TCP"
       serviceAccount: "kubernetes-quickstart"
 ----
+<1> The provided replicas,
+<2> labels and
+<3> environment variables were retained.
+<4> However, the image and
+<5> the container port were modified.
 
-The provided replicas <1>, labels <2> and environment variables <3>  were retained. However, the image <4> and container port <5> were modified. Moreover, the default annotations have been added.
+Moreover, the default annotations have been added.
 
 [NOTE]
 ====

docs/src/main/asciidoc/hibernate-orm-panache.adoc

@@ -792,8 +792,8 @@ public class Person extends PanacheEntity {
 
 [WARNING]
 ====
-Named queries can only be defined inside your Jakarta Persistence entity classes (being the Panache entity class, or the repository parameterized type),
-or on one of its super classes.
+Named queries can only be defined inside your Jakarta Persistence entity classes,
+or on one of their super classes.
 ====
 
 === Query parameters

docs/src/main/asciidoc/hibernate-reactive-panache.adoc

@@ -553,8 +553,8 @@ public class Person extends PanacheEntity {
 
 [WARNING]
 ====
-Named queries can only be defined inside your Jakarta Persistence entity classes (being the Panache entity class, or the repository parameterized type),
-or on one of its super classes.
+Named queries can only be defined inside your Jakarta Persistence entity classes,
+or on one of their super classes.
 ====
 
 === Query parameters

docs/src/main/asciidoc/kafka.adoc

@@ -360,8 +360,10 @@
 If `checkpoint.unsynced-state-max-age.ms` is set to less than or equal to 0, it does not perform any health check verification.
 For more information, see <<stateful-processing-checkpointing>>
 
 - `latest` commits the record offset received by the Kafka consumer as soon as the associated message is acknowledged (if the offset is higher than the previously committed offset).
-This strategy provides at-least-once delivery if the channel processes the message without performing any asynchronous processing.
+This strategy provides at-least-once delivery if the channel processes the message without performing any asynchronous processing. Specifically, the offset of the most recent acknowledged 
+message will always be committed, even if older messages have not finished being processed. In case of an incident such as a crash, processing would restart after the last commit, leading 
+to older messages never being successfully and fully processed, which would appear as message loss.
 This strategy should not be used in high load environment, as offset commit is expensive. However, it reduces the risk of duplicates.
 
 - `ignore` performs no commit. This strategy is the default strategy when the consumer is explicitly configured with `enable.auto.commit` to true.

docs/src/main/asciidoc/mutiny-primer.adoc

@@ -3,7 +3,7 @@
 and pull requests should be submitted there:
 https://github.com/quarkusio/quarkus/tree/main/docs/src/main/asciidoc
 ////
-= Mutiny - Async for bare mortal
+= Mutiny - Async for mere mortals
 include::_attributes.adoc[]
 :categories: reactive
 :topics: mutiny,reactive

docs/src/main/asciidoc/stylesheet/config.css

@@ -22,15 +22,11 @@ table.configuration-reference.tableblock > tbody > tr:nth-child(even) > th {
 table.configuration-reference.tableblock > tbody > tr > th {
   background-color: transparent;
   font-size: 1rem;
-  height: 60px;
   border: none;
   border-bottom: 1px solid #4695eb;
   vertical-align: bottom;
 }
 
-table.configuration-reference.tableblock > tbody > tr:first-child > th {
-  height: 30px;
-}
 table.configuration-reference.tableblock > tbody > tr > th:nth-child(2),
 table.configuration-reference.tableblock > tbody > tr > th:nth-child(3),
 table.configuration-reference.tableblock > tbody > tr > td:nth-child(2),

docs/src/main/asciidoc/websockets-next-reference.adoc

@@ -16,6 +16,8 @@
 
 include::{includes}/extension-status.adoc[]
 
+The `quarkus-websockets-next` extension provides a modern declarative API to define WebSocket server and client endpoints.
+
 == The WebSocket protocol
 
 The _WebSocket_ protocol, documented in the https://datatracker.ietf.org/doc/html/rfc6455[RFC6455], establishes a standardized method for creating a bidirectional communication channel between a client and a server through a single TCP connection.
@@ -137,13 +139,13 @@
 
 [source, java]
 ----
-@WebSocket("/ws/v{version}")
+@WebSocket(path = "/ws/v{version}")
 public class MyPrimaryWebSocket {
 
     @OnTextMessage
     void consumePrimary(String s)    { ... }
 
-    @WebSocket("/products/{id}")
+    @WebSocket(path = "/products/{id}")
     public static class MyNestedWebSocket {
 
       @OnTextMessage
@@ -161,12 +163,12 @@
 
 [source,java]
 ----
-@WebSocket("/ws")
+@WebSocket(path = "/ws")
 public class MyWebSocket {
     // Singleton scoped bean
 }
 
-@WebSocket("/ws")
+@WebSocket(path = "/ws")
 @ApplicationScoped
 public class MyRequestScopedWebSocket {
   // Application scoped.
@@ -418,7 +420,7 @@
 
 [source, java]
 ----
-@WebSocket("/foo")
+@WebSocket(path = "/foo")
 @OnOpen
 public Multi<Integer> streaming() {
     return Multi.createFrom().ticks().every(Duration.ofSecond(1))
@@ -455,8 +457,12 @@
 However, each method must declare a different error parameter.
 The method that declares a most-specific supertype of the actual exception is selected.
 
 NOTE: The `@io.quarkus.websockets.next.OnError` annotation can be also used to declare a global error handler, i.e. a method that is not declared on a WebSocket endpoint. Such a method may not accept `@PathParam` paremeters. Error handlers declared on an endpoint take precedence over the global error handlers.
 
+When an error occurs but no error handler can handle the failure, Quarkus uses the strategy specified by `quarkus.websockets-next.server.unhandled-failure-strategy` and `quarkus.websockets-next.client.unhandled-failure-strategy`, respectively.
+By default, the connection is closed.
+Alternatively, an error message can be logged or no operation performed.
+
 == Access to the WebSocketConnection
 
 The `io.quarkus.websockets.next.WebSocketConnection` object represents the WebSocket connection.
@@ -633,8 +639,10 @@
 quarkus.http.auth.permission.secured.policy=authenticated
 ----
 
 Other options for securing HTTP upgrade requests, such as using the security annotations, will be explored in the future.
 
+NOTE: When OpenID Connect extension is used and token expires, Quarkus automatically closes connection.
+
 [[websocket-next-configuration-reference]]
 == Configuration reference
 

extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java

@@ -642,7 +642,10 @@ public enum Strategy {
          * either `quarkus.oidc.credentials.secret` or `quarkus.oidc.credentials.client-secret.value` is checked.
          * Finally, `quarkus.oidc.credentials.jwt.secret` which can be used for `client_jwt_secret` authentication is
          * checked.
-         * The secret is auto-generated if it remains uninitialized after checking all of these properties.
+         * The secret is auto-generated every time an application starts if it remains uninitialized after checking all of these
+         * properties.
+         * Generated secret can not decrypt the session cookie encrypted before the restart, therefore a user re-authentication
+         * will be required.
          * <p>
          * The length of the secret used to encrypt the tokens should be at least 32 characters long.
          * A warning is logged if the secret length is less than 16 characters.

extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java

@@ -119,7 +119,12 @@ private static SecretKey createTokenEncSecretKey(OidcTenantConfig config) {
             }
             try {
                 if (encSecret == null) {
-                    LOG.warn("Secret key for encrypting tokens in a session cookie is missing, auto-generating it");
+                    LOG.warn(
+                            "Secret key for encrypting OIDC authorization code flow tokens in a session cookie is not configured, auto-generating it."
+                                    + " Note that a new secret will be generated after a restart, thus making it impossible to decrypt the session cookie and requiring a user re-authentication."
+                                    + " Use 'quarkus.oidc.token-state-manager.encryption-secret' to configure an encryption secret."
+                                    + " Alternatively, disable session cookie encryption with 'quarkus.oidc.token-state-manager.encryption-required=false'"
+                                    + " but only if it is considered to be safe in your application's network.");
                     return generateSecretKey();
                 }
                 byte[] secretBytes = encSecret.getBytes(StandardCharsets.UTF_8);

extensions/qute/deployment/src/main/java/io/quarkus/qute/deployment/QuteProcessor.java

@@ -1001,7 +1001,7 @@ public String apply(String id) {
             // Register all param declarations as targets of implicit value resolvers
             for (ParameterDeclaration paramDeclaration : templateAnalysis.parameterDeclarations) {
                 Type type = TypeInfos.resolveTypeFromTypeInfo(paramDeclaration.getTypeInfo());
-                if (type != null) {
+                if (type != null && !implicitClassToMembersUsed.containsKey(type.name())) {
                     implicitClassToMembersUsed.put(type.name(), new HashSet<>());
                 }
             }