Quarkus: OpenAPI annotation @SecurityRequirements makes Quarkus crash

[enbohm]

@SecurityRequirements-annotation makes Quarkus crash

The following code prevents Quarkus to start and generates an java.lang.ExceptionInInitializerError exception (see stacktrace below). Removing the OpenAPI annotation org.eclipse.microprofile.openapi.annotations.security.SecurityRequirements make the application run as expected.

This code was tested on macOS Mojave and OpenJDK Runtime Environment 18.9 (build 11+28)

@Path("/")
@SecuritySchemes(
    value = {@SecurityScheme(securitySchemeName = "mySecurityReq", type = SecuritySchemeType.HTTP,
        scheme = "bearer", apiKeyName = "Authorization: Bearer", bearerFormat = "jwt")})
public class GreetingEndpoint {

  @GET
  @SecurityRequirements(value = {@SecurityRequirement(name = "mySecurityReq")})
  @Operation(summary = "Say Hello World")
  @Path("/hello/")
  public String greeting() {
    return "Hello world!";
  }
}

2019-03-21 08:11:05,487 ERROR [io.qua.dev.DevModeMain] (XNIO-1 task-1) Failed to start quarkus: java.lang.ExceptionInInitializerError
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
    at java.base/java.lang.Class.newInstance(Class.java:584)
    at io.quarkus.runner.RuntimeRunner.run(RuntimeRunner.java:118)
    at io.quarkus.dev.DevModeMain.doStart(DevModeMain.java:121)
    at io.quarkus.dev.DevModeMain.restartApp(DevModeMain.java:148)
    at io.quarkus.dev.RuntimeUpdatesProcessor.doScan(RuntimeUpdatesProcessor.java:87)
    at io.quarkus.undertow.deployment.devmode.UndertowHotReplacementSetup.handleHotDeploymentRequest(UndertowHotReplacementSetup.java:54)
    at io.quarkus.undertow.deployment.devmode.UndertowHotReplacementSetup$1$1.handleRequest(UndertowHotReplacementSetup.java:35)
    at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364)
    at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
    at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
    at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1998)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1525)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1416)
    at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: java.lang.RuntimeException: Failed to start quarkus
    at io.quarkus.runner.ApplicationImpl2.<clinit>(Unknown Source)
    ... 18 more
Caused by: java.lang.IllegalAccessError: failed to access class java.util.Collections$EmptyList from class io.quarkus.deployment.steps.SmallRyeOpenApiProcessor$build20 (java.util.Collections$EmptyList is in module java.base of loader 'bootstrap'; io.quarkus.deployment.steps.SmallRyeOpenApiProcessor$build20 is in unnamed module of loader io.quarkus.runner.RuntimeClassLoader @176bc294)
    at io.quarkus.deployment.steps.SmallRyeOpenApiProcessor$build20.deploy(Unknown Source)
    ... 19 more

[enbohm]

Does anyone know if there are any workaround for this bug? I've tried various Java module cmd line options but without any success unfortunately.

[ekans]

@enbohm I encountered the same problem : you must set a value for the scopes attribute. It seems that the default is ignored.

@SecurityRequirements(value = {@SecurityRequirement(name = "mySecurityReq", scopes = {})})

[enbohm]

@ekans thx - now it works for me as well! :)