quarkusio/quarkus · error · IllegalStateException

Quarkus did not detect

Error message

Quarkus did not detect 

What it means

This is an internal consistency check in the websockets-next security integration. When a WebSocket endpoint injects the WebSocket security bean, the processor expects the security infrastructure (identity/IdentityProviderManager support) to be present in the application index; if not, it fails the build rather than producing a broken synthetic bean. It almost always indicates a Quarkus bug or an inconsistent extension/version combination, not a user coding mistake.

Source

Thrown at extensions/websockets-next/deployment/src/main/java/io/quarkus/websockets/next/deployment/WebSocketProcessor.java:900

        }
    }

    @BuildStep
    @Record(STATIC_INIT)
    void supportSecurityIdentityUpdate(BeanDiscoveryFinishedBuildItem beanDiscoveryFinishedBuildItem,
            WebSocketServerRecorder recorder, Capabilities capabilities, CombinedIndexBuildItem indexBuildItem,
            BuildProducer<SyntheticBeanBuildItem> syntheticBeanProducer) {
        if (capabilities.isMissing(Capability.SECURITY)) {
            return;
        }
        boolean isWsSecurityInjected = beanDiscoveryFinishedBuildItem.getInjectionPoints().stream()
                .map(InjectionPointInfo::getType)
                .filter(Objects::nonNull)
                .map(Type::name)
                .anyMatch(WEBSOCKET_SECURITY_NAME::equals);
        if (isWsSecurityInjected) {
            if (identityUpdateNotSupported(indexBuildItem.getIndex())) {
                throw new IllegalStateException("Quarkus did not detect " + WEBSOCKET_SECURITY_NAME
                        + " injection, please report this issue to Quarkus project");
            }
            syntheticBeanProducer.produce(SyntheticBeanBuildItem
                    .configure(WEBSOCKET_SECURITY_NAME)
                    .addInjectionPoint(ClassType.create(IdentityProviderManager.class))
                    // Instance<IdentityProvider<?>>
                    .addInjectionPoint(ParameterizedType.create(Instance.class,
                            ParameterizedType.create(DotName.createSimple(IdentityProvider.class), WildcardType.UNBOUNDED)))
                    .createWith(recorder.createWebSocketSecurity())
                    .scope(ApplicationScoped.class)
                    .done());
        }
    }

    @BuildStep
    void createSecurityIdentityAssociation(Capabilities capabilities,
            BuildProducer<AdditionalBeanBuildItem> additionalBeanProducer) {
        if (capabilities.isPresent(Capability.SECURITY)) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Report the issue to the Quarkus project with a minimal reproducer, as the message instructs.
2. Check that all io.quarkus artifacts resolve to the same version (mvn dependency:tree | grep io.quarkus) and remove stale/pinned versions.
3. Run ./mvnw clean and rebuild the extension modules if building Quarkus itself, so the index is regenerated.
4. Temporarily remove WebSocketSecurity injection to confirm it is the trigger, then re-add after upgrading Quarkus.

Example fix

// before (mixed versions)
<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-security</artifactId><version>3.8.0</version></dependency>
// after (align with BOM)
<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-security</artifactId></dependency>

// Before relying on WebSocketSecurity, confirm a consistent Quarkus stack:
// mvn dependency:tree | grep 'io.quarkus'  -> all quarkus-* artifacts must share one version
boolean injected = project.getDependencies().stream()
    .anyMatch(d -> d.getArtifactId().equals("quarkus-websockets-next"));
if (injected) { /* ensure quarkus-security is managed by the Quarkus BOM */ }

When it happens

Trigger: Building an app where an injection point of type WebSocketSecurity (io.quarkus.websockets.next.security.WebSocketSecurity) is detected, but identityUpdateNotSupported(index) returns true — i.e. the Jandex index lacks the classes/annotations that indicate identity-update support (e.g. the security identity update machinery is absent due to mismatched extension versions).

Common situations: Mixing Quarkus versions on the classpath (e.g. stale quarkus-security or websockets-next artifacts from a different release train); a custom platform/BOM pinning an older quarkus-security; a Quarkus regression after upgrading; exotic packaging that excludes security classes from the index.

Related errors

• WebSocket endpoint '%s' requires secured HTTP upgrade but Qu
• WebSocket endpoint '%s' superclass '%s' is secured with the
• WebSocket endpoint '%s' has method '%s' secured with the '%s
• Unknown node type ${type}
• @PermissionChecker annotation placed on the '%s' attribute '

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/468ce237f635d283. Report an issue: GitHub.