quarkusio/quarkus · error · java.lang.IllegalStateException

Found %d DefaultSecurityCheckBuildItem items, please make su

Error message

Found %d DefaultSecurityCheckBuildItem items, please make sure the item is produced exactly once

What it means

DefaultSecurityCheckBuildItem is a singleton build item: the security build expects exactly zero or one producer so the default security check (e.g. deny-all/permit behavior) is unambiguous. When more than one DefaultSecurityCheckBuildItem is found during build, the build fails telling the producer to ensure it is produced exactly once.

Source

Thrown at extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java:991

            List<DefaultSecurityCheckBuildItem> defaultSecurityCheckBuildItem) {
        classPredicate.produce(new ApplicationClassPredicateBuildItem(new SecurityCheckStorageAppPredicate()));

        RuntimeValue<SecurityCheckStorageBuilder> builder = recorder.newBuilder();
        for (Map.Entry<MethodInfo, SecurityCheck> methodEntry : securityChecksItem.securityChecks.entrySet().stream()
                .sorted(Map.Entry.comparingByKey(Comparator.comparing(MethodInfo::toString))).toList()) {
            MethodInfo method = methodEntry.getKey();
            String[] params = new String[method.parametersCount()];
            for (int i = 0; i < method.parametersCount(); ++i) {
                params[i] = method.parameterType(i).name().toString();
            }
            recorder.addMethod(builder, method.declaringClass().name().toString(), method.name(), params,
                    methodEntry.getValue());
        }

        if (!defaultSecurityCheckBuildItem.isEmpty()) {
            if (defaultSecurityCheckBuildItem.size() > 1) {
                int itemCount = defaultSecurityCheckBuildItem.size();
                throw new IllegalStateException("Found %d DefaultSecurityCheckBuildItem items, ".formatted(itemCount)
                        + "please make sure the item is produced exactly once");
            }

            var roles = defaultSecurityCheckBuildItem.get(0).getRolesAllowed();
            if (roles == null) {
                recorder.registerDefaultSecurityCheck(builder, recorder.denyAll());
            } else {
                recorder.registerDefaultSecurityCheck(builder, recorder.rolesAllowed(roles.toArray(new String[0])));
            }
        }
        syntheticBeans.produce(
                SyntheticBeanBuildItem.configure(SecurityCheckStorage.class)
                        .scope(ApplicationScoped.class)
                        .unremovable()
                        .runtimeProxy(recorder.create(builder))
                        .done());
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Find all @BuildStep methods producing DefaultSecurityCheckBuildItem and keep only one.
2. Guard additional producers with a condition (e.g. only produce when none exists) or merge them into a single build step.
3. Remove any custom extension code that duplicates Quarkus's built-in default security check production.

Example fix

// before
@BuildItem
DefaultSecurityCheckBuildItem a() { ... } // in two extensions

// after
// produce it in exactly one build step, or make the second conditional:
@BuildStep(onlyIf = IsDefaultCheckMissing.class)
DefaultSecurityCheckBuildItem b() { ... }

// audit build steps producing the item before adding new ones
// search codebase: grep -rn "DefaultSecurityCheckBuildItem" extensions/ integration-tests/

When it happens

Trigger: Multiple @BuildStep methods (often across custom extensions or copy-pasted integration code) each produce a DefaultSecurityCheckBuildItem in the same application build.

Common situations: Adding a custom security extension that produces the item while another (or Quarkus itself) already produces it; copy-pasting a build step from another module; merging extensions that both install a default check.

Related errors

• Method %s#%s should not have been added as an additional sec
• Detected two @PermissionChecker annotations with same value
• A generic type is not allowed here; try creating a subclass
• Build item class must be leaf (final) types: %s
• Cannot construct empty build items

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/02dcd0adbbb94b59. Report an issue: GitHub.