Multiple producers of item class io.quarkus.security.spi.DefaultSecurityCheckBuildItem error after upgrading to Quarkus 3.9.1

[serhiynovos]

I just updated my project to 3.9.1 and started seeing this crash, after reverted back to 3.8.3 it's working fine

2024-03-27 17:10:04,772 ERROR [io.qua.dep.dev.IsolatedDevModeMain] (main) Failed to start quarkus: java.lang.RuntimeException: io.quarkus.builder.ChainBuildException: Multiple producers of item class io.quarkus.security.spi.DefaultSecurityCheckBuildItem (io.quarkus.resteasy.reactive.common.deployment.ResteasyReactiveCommonProcessor#setUpDenyAllJaxRs)
at io.quarkus.runner.bootstrap.AugmentActionImpl.runAugment(AugmentActionImpl.java:334)
at io.quarkus.runner.bootstrap.AugmentActionImpl.createInitialRuntimeApplication(AugmentActionImpl.java:251)
at io.quarkus.runner.bootstrap.AugmentActionImpl.createInitialRuntimeApplication(AugmentActionImpl.java:60)
at io.quarkus.deployment.dev.IsolatedDevModeMain.firstStart(IsolatedDevModeMain.java:112)
at io.quarkus.deployment.dev.IsolatedDevModeMain.accept(IsolatedDevModeMain.java:433)
at io.quarkus.deployment.dev.IsolatedDevModeMain.accept(IsolatedDevModeMain.java:55)
at io.quarkus.bootstrap.app.CuratedApplication.runInCl(CuratedApplication.java:138)
at io.quarkus.bootstrap.app.CuratedApplication.runInAugmentClassLoader(CuratedApplication.java:93)
at io.quarkus.deployment.dev.DevModeMain.start(DevModeMain.java:131)
at io.quarkus.deployment.dev.DevModeMain.main(DevModeMain.java:62)
Caused by: io.quarkus.builder.ChainBuildException: Multiple producers of item class io.quarkus.security.spi.DefaultSecurityCheckBuildItem (io.quarkus.resteasy.reactive.common.deployment.ResteasyReactiveCommonProcessor#setUpDenyAllJaxRs)
Caused by: java.lang.Throwable: This is the location of the conflicting producer (io.quarkus.resteasy.deployment.ResteasyBuiltinsProcessor#setUpDenyAllJaxRs). Use -Dquarkus.builder.log-conflict-cause=true to see the full stacktrace.

[sberyozkin]

@michalvavrik It is probably related to #38622

[michalvavrik]

@michalvavrik It is probably related to #38622

@sberyozkin #38622 is fine. Look at the stacktrace it has both RESTEasy Classic ResteasyBuiltinsProcessor and RESTEasy Reactive (ResteasyReactiveCommonProcessor). I don't think this is valid state. You can't use these 2 together and there should be an exception raised. Can you share reproducer?

[sberyozkin]

@michalvavrik Right, the combination works in 3.8, maybe Dev mode is using the reactive one for its own endpoints ?
@serhiynovos Can you clarify please how do you have both Resteasy classic and reactive combined, share a pom or indeed a reproducer ?

[michalvavrik]

I have vague memory that all the DEV UIs contained reference to RESTeasy Reactive at one point (as I saw a PR that removed it), but that would cause a lot of problems. Not just security. Maybe I misunderstood that.

[serhiynovos]

Here is my deps

dependencies {
implementation(enforcedPlatform("${quarkusPlatformGroupId}:${quarkusPlatformArtifactId}:${quarkusPlatformVersion}"))
implementation("io.quarkus:quarkus-kotlin")
implementation("io.quarkus:quarkus-resteasy")
implementation("io.quarkus:quarkus-resteasy-jackson")
implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
implementation("io.quarkus:quarkus-arc")
implementation("io.quarkus:quarkus-hibernate-orm-panache-kotlin")
implementation("io.quarkus:quarkus-jdbc-mysql")
implementation("io.quarkus:quarkus-oidc")
implementation("io.quarkus:quarkus-keycloak-admin-client")
implementation("io.quarkus:quarkus-rest-client")
implementation("io.quarkus:quarkus-rest-client-jackson")
implementation("io.quarkus:quarkus-container-image-docker")
implementation("io.quarkus:quarkus-smallrye-health")
implementation("io.quarkus:quarkus-micrometer-registry-prometheus")
implementation("io.quarkus:quarkus-hibernate-validator")
implementation("io.quarkus:quarkus-smallrye-openapi")
implementation("io.quarkus:quarkus-opentelemetry")

testImplementation("io.quarkus:quarkus-junit5")
testImplementation("io.rest-assured:rest-assured")
}

[gsmet]

@serhiynovos I suspect you are mixing RESTEasy Classic and Quarkus REST.

My guess it that you didn't rename quarkus-rest-client to quarkus-resteasy-client when you updated to 3.7 and doing it should fix your issue.

Make sure you either use:

quarkus-rest
quarkus-rest-client

or

quarkus-resteasy
quarkus-resteasy-client

(Make sure the various subartifacts such as -jackson are consistent too)

[gsmet]

Seeing your answer above, the fix is:

implementation("io.quarkus:quarkus-rest-client")
implementation("io.quarkus:quarkus-rest-client-jackson")

->

implementation("io.quarkus:quarkus-resteasy-client")
implementation("io.quarkus:quarkus-resteasy-client-jackson")

You should have had relocations warnings when updating to 3.7 but I'm not sure Gradle shows them to you.

[gsmet]

See https://github.com/quarkusio/quarkus/wiki/Migration-Guide-3.7#rest-client

[serhiynovos]

@gsmet Yes it worked. Thanks You so much