{"record":{"id":"468ce237f635d283","repo":"quarkusio/quarkus","slug":"quarkus-did-not-detect","errorCode":null,"errorMessage":"Quarkus did not detect ","messagePattern":"Quarkus did not detect ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/websockets-next/deployment/src/main/java/io/quarkus/websockets/next/deployment/WebSocketProcessor.java","lineNumber":900,"sourceCode":"        }\n    }\n\n    @BuildStep\n    @Record(STATIC_INIT)\n    void supportSecurityIdentityUpdate(BeanDiscoveryFinishedBuildItem beanDiscoveryFinishedBuildItem,\n            WebSocketServerRecorder recorder, Capabilities capabilities, CombinedIndexBuildItem indexBuildItem,\n            BuildProducer<SyntheticBeanBuildItem> syntheticBeanProducer) {\n        if (capabilities.isMissing(Capability.SECURITY)) {\n            return;\n        }\n        boolean isWsSecurityInjected = beanDiscoveryFinishedBuildItem.getInjectionPoints().stream()\n                .map(InjectionPointInfo::getType)\n                .filter(Objects::nonNull)\n                .map(Type::name)\n                .anyMatch(WEBSOCKET_SECURITY_NAME::equals);\n        if (isWsSecurityInjected) {\n            if (identityUpdateNotSupported(indexBuildItem.getIndex())) {\n                throw new IllegalStateException(\"Quarkus did not detect \" + WEBSOCKET_SECURITY_NAME\n                        + \" injection, please report this issue to Quarkus project\");\n            }\n            syntheticBeanProducer.produce(SyntheticBeanBuildItem\n                    .configure(WEBSOCKET_SECURITY_NAME)\n                    .addInjectionPoint(ClassType.create(IdentityProviderManager.class))\n                    // Instance<IdentityProvider<?>>\n                    .addInjectionPoint(ParameterizedType.create(Instance.class,\n                            ParameterizedType.create(DotName.createSimple(IdentityProvider.class), WildcardType.UNBOUNDED)))\n                    .createWith(recorder.createWebSocketSecurity())\n                    .scope(ApplicationScoped.class)\n                    .done());\n        }\n    }\n\n    @BuildStep\n    void createSecurityIdentityAssociation(Capabilities capabilities,\n            BuildProducer<AdditionalBeanBuildItem> additionalBeanProducer) {\n        if (capabilities.isPresent(Capability.SECURITY)) {","sourceCodeStart":882,"sourceCodeEnd":918,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/websockets-next/deployment/src/main/java/io/quarkus/websockets/next/deployment/WebSocketProcessor.java#L882-L918","documentation":"This is an internal consistency check in the websockets-next security integration. When a WebSocket endpoint injects the WebSocket security bean, the processor expects the security infrastructure (identity/IdentityProviderManager support) to be present in the application index; if not, it fails the build rather than producing a broken synthetic bean. It almost always indicates a Quarkus bug or an inconsistent extension/version combination, not a user coding mistake.","triggerScenarios":"Building an app where an injection point of type WebSocketSecurity (io.quarkus.websockets.next.security.WebSocketSecurity) is detected, but identityUpdateNotSupported(index) returns true — i.e. the Jandex index lacks the classes/annotations that indicate identity-update support (e.g. the security identity update machinery is absent due to mismatched extension versions).","commonSituations":"Mixing Quarkus versions on the classpath (e.g. stale quarkus-security or websockets-next artifacts from a different release train); a custom platform/BOM pinning an older quarkus-security; a Quarkus regression after upgrading; exotic packaging that excludes security classes from the index.","solutions":["Report the issue to the Quarkus project with a minimal reproducer, as the message instructs.","Check that all io.quarkus artifacts resolve to the same version (mvn dependency:tree | grep io.quarkus) and remove stale/pinned versions.","Run ./mvnw clean and rebuild the extension modules if building Quarkus itself, so the index is regenerated.","Temporarily remove WebSocketSecurity injection to confirm it is the trigger, then re-add after upgrading Quarkus."],"exampleFix":"// before (mixed versions)\n<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-security</artifactId><version>3.8.0</version></dependency>\n// after (align with BOM)\n<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-security</artifactId></dependency>","handlingStrategy":"validation","validationCode":"// Before relying on WebSocketSecurity, confirm a consistent Quarkus stack:\n// mvn dependency:tree | grep 'io.quarkus'  -> all quarkus-* artifacts must share one version\nboolean injected = project.getDependencies().stream()\n    .anyMatch(d -> d.getArtifactId().equals(\"quarkus-websockets-next\"));\nif (injected) { /* ensure quarkus-security is managed by the Quarkus BOM */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Import the Quarkus BOM so all io.quarkus artifacts share one version","Avoid pinning individual quarkus-security/websockets-next versions","After upgrading Quarkus, run a clean full rebuild","Keep WebSocketSecurity usage minimal and report mismatches upstream early"],"tags":["quarkus","websockets-next","security","build-time","internal-error"],"backgroundTag":"quarkus-internal-consistency-check","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}