diff --git a/blog_tags.json b/blog_tags.json index 87be37b0e..877d5a787 100644 --- a/blog_tags.json +++ b/blog_tags.json @@ -2,7 +2,7 @@ "blog_tags": [ { "name": "announcements", - "posts": ["26.0.0.5", "26.0.0.5-beta", + "posts": ["26.0.0.6-beta", "26.0.0.5", "26.0.0.5-beta", "26.0.0.4", "26.0.0.4-beta", "26.0.0.3", "26.0.0.3-beta", "26.0.0.2", "26.0.0.2-beta", @@ -200,7 +200,7 @@ }, { "name": "release", - "posts": ["26.0.0.5", "26.0.0.5-beta", + "posts": ["26.0.0.6-beta", "26.0.0.5", "26.0.0.5-beta", "26.0.0.4", "26.0.0.4-beta", "26.0.0.3", "26.0.0.3-beta", "26.0.0.2", "26.0.0.2-beta", @@ -281,7 +281,7 @@ }, { "name": "beta", - "posts": ["26.0.0.5-beta", "26.0.0.4-beta", + "posts": ["26.0.0.6-beta", "26.0.0.5-beta", "26.0.0.4-beta", "26.0.0.3-beta", "26.0.0.2-beta", "26.0.0.1-beta", "mcp-standalone-blog", "25.0.0.12-beta", "25.0.0.11-beta", @@ -542,7 +542,7 @@ }, { "name": "developer-experience", - "posts": ["25.0.0.12-beta", "25.0.0.11-beta", "open-liberty-cloud-hosted-guides-multi-languages", + "posts": ["26.0.0.6-beta", "25.0.0.12-beta", "25.0.0.11-beta", "open-liberty-cloud-hosted-guides-multi-languages", "25.0.0.3", "zero-migration", "liberty-tools-eclipse-ide", "liberty-tools-intellij-idea", "liberty-tools-visual-studio-code", "why-cloud-native-java-devs-love-liberty", @@ -635,7 +635,7 @@ }, { "name": "performance-enhancements", - "posts": ["26.0.0.3", "25.0.0.12-beta", "25.0.0.11-beta", + "posts": ["26.0.0.6-beta", "26.0.0.3", "25.0.0.12-beta", "25.0.0.11-beta", "25.0.0.1", "25.0.0.1-beta", "24.0.0.11", "24.0.0.11-beta", "five-java-dev-musthaves-fast-startup", "rapid-startup-without-compromise", diff --git a/posts/2026-06-16-26.0.0.6.adoc b/posts/2026-06-16-26.0.0.6.adoc new file mode 100644 index 000000000..6980b2b70 --- /dev/null +++ b/posts/2026-06-16-26.0.0.6.adoc @@ -0,0 +1,299 @@ +--- +layout: post +title: "Notable bug fixes in 26.0.0.6" +# Do NOT change the categories section +categories: blog +author_picture: https://avatars3.githubusercontent.com/navaneethsnair1 +author_github: https://github.com/navaneethsnair1 +seo-title: Notable bug fixes in 26.0.0.6 - OpenLiberty.io +seo-description: This GA release includes significant bug fixes that improve stability, enhance performance, and deliver a smoother user experience. Additionally, we have introduced new guides to help users get the most out of the platform. +blog_description: This GA release includes significant bug fixes that improve stability, enhance performance, and deliver a smoother user experience. Additionally, we have introduced new guides to help users get the most out of the platform. +open-graph-image: https://openliberty.io/img/twitter_card.jpg +open-graph-image-alt: Open Liberty Logo +--- += Notable bug fixes in 26.0.0.6 +Navaneeth S Nair +:imagesdir: / +:url-prefix: +:url-about: / +//Blank line here is necessary before starting the body of the post. + +// // // // // // // // +// In the preceding section: +// Do not insert any blank lines between any of the lines. +// Do not remove or edit the variables on the lines beneath the author name. +// +// "open-graph-image" is set to OL logo. Whenever possible update this to a more appropriate/specific image (For example if present a image that is being used in the post). However, it +// can be left empty which will set it to the default +// +// "open-graph-image-alt" is a description of what is in the image (not a caption). When changing "open-graph-image" to +// a custom picture, you must provide a custom string for "open-graph-image-alt". +// +// Replace TITLE with the blog post title eg: MicroProfile 3.3 is now available on Open Liberty 20.0.0.4 +// Replace GITHUB_USERNAME with your GitHub username eg: lauracowen +// Replace DESCRIPTION with a short summary (~60 words) of the release (a more succinct version of the first paragraph of the post). +// Replace AUTHOR_NAME with your name as you'd like it to be displayed, eg: Laura Cowen +// +// Example post: 2020-04-09-microprofile-3-3-open-liberty-20004.adoc +// +// If adding image into the post add : +// ------------------------- +// [.img_border_light] +// image::img/blog/FILE_NAME[IMAGE CAPTION ,width=70%,align="center"] +// ------------------------- +// "[.img_border_light]" = This adds a faint grey border around the image to make its edges sharper. Use it around screenshots but not +// around diagrams. Then double check how it looks. +// There is also a "[.img_border_dark]" class which tends to work best with screenshots that are taken on dark +// backgrounds. +// Change "FILE_NAME" to the name of the image file. Also make sure to put the image into the right folder which is: img/blog +// change the "IMAGE CAPTION" to a couple words of what the image is +// // // // // // // // + +This GA release includes significant bug fixes that improve stability, enhance performance, and deliver a smoother user experience. Additionally, we have introduced new guides to help users get the most out of the platform. + +// // // // // // // // +// In the preceding section: +// Leave any instances of `tag::xxxx[]` or `end:xxxx[]` as they are. +// +// Replace RELEASE_SUMMARY with a short paragraph that summarises the release. Start with the lead feature but also summarise what else is new in the release. You will agree which will be the lead feature with the reviewers so you can just leave a placeholder here until after the initial review. +// // // // // // // // + +// // // // // // // // +// Replace the following throughout the document: +// Replace RELEASE_VERSION with the version number of Open Liberty, eg: 22.0.0.2 +// Replace RELEASE_VERSION_NO_PERIODS with the version number of Open Liberty wihtout the periods, eg: 22002 +// // // // // // // // + +In link:{url-about}[Open Liberty] 26.0.0.6: + +* <> +* <> + +// // // // // // // // +// If there were updates to guides since last release, keep the following, otherwise remove section. +// // // // // // // // +Along with the new features and functions added to the runtime, we’ve also made <>. + +// // // // // // // // +// In the preceding section: +// Replace the TAG_X with a short label for the feature in lower-case, eg: mp3 +// Replace the FEATURE_1_HEADING with heading the feature section, eg: MicroProfile 3.3 +// Where the updates are grouped as sub-headings under a single heading +// (eg all the features in a MicroProfile release), provide sub-entries in the list; +// eg replace SUB_TAG_1 with mpr, and SUB_FEATURE_1_HEADING with +// Easily determine HTTP headers on outgoing requests (MicroProfile Rest Client 1.4) +// // // // // // // // + +View the list of fixed bugs in link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A26006+label%3A%22release+bug%22[26.0.0.6]. + +Check out link:{url-prefix}/blog/?search=release&search!=beta[previous Open Liberty GA release blog posts]. + + +[#run] + +// // // // // // // // +// LINKS +// +// OpenLiberty.io site links: +// link:{url-prefix}/guides/maven-intro.html[Maven] +// +// Off-site links: +//link:https://openapi-generator.tech/docs/installation#jar[Download Instructions] +// +// IMAGES +// +// Place images in ./img/blog/ +// Use the syntax: +// image::/img/blog/log4j-rhocp-diagrams/current-problem.png[Logging problem diagram,width=70%,align="center"] +// // // // // // // // + +== Develop and run your apps using 26.0.0.6 + +If you're using link:{url-prefix}/guides/maven-intro.html[Maven], include the following in your `pom.xml` file: + +[source,xml] +---- + + io.openliberty.tools + liberty-maven-plugin + 3.12.0 + +---- + +Or for link:{url-prefix}/guides/gradle-intro.html[Gradle], include the following in your `build.gradle` file: + +[source,gradle] +---- +buildscript { + repositories { + mavenCentral() + } + dependencies { + classpath 'io.openliberty.tools:liberty-gradle-plugin:4.0.0' + } +} +apply plugin: 'liberty' +---- +// // // // // // // // +// In the preceding section: +// Replace the Maven `3.11.5` with the latest version of the plugin: https://search.maven.org/artifact/io.openliberty.tools/liberty-maven-plugin +// Replace the Gradle `3.9.5` with the latest version of the plugin: https://search.maven.org/artifact/io.openliberty.tools/liberty-gradle-plugin +// TODO: Update GHA to automatically do the above. If the maven.org is problematic, then could fallback to using the GH Releases for the plugins +// // // // // // // // + +Or if you're using link:{url-prefix}/docs/latest/container-images.html[container images]: + +[source] +---- +FROM icr.io/appcafe/open-liberty +---- + +Or take a look at our link:{url-prefix}/start/[Downloads page]. + +If you're using link:https://plugins.jetbrains.com/plugin/14856-liberty-tools[IntelliJ IDEA], link:https://marketplace.visualstudio.com/items?itemName=Open-Liberty.liberty-dev-vscode-ext[Visual Studio Code] or link:https://marketplace.eclipse.org/content/liberty-tools[Eclipse IDE], you can also take advantage of our open source link:https://openliberty.io/docs/latest/develop-liberty-tools.html[Liberty developer tools] to enable effective development, testing, debugging and application management all from within your IDE. + +[link=https://stackoverflow.com/tags/open-liberty] +image::img/blog/blog_btn_stack.svg[Ask a question on Stack Overflow, align="center"] + + +// // // // // // // // +// In the preceding section: +// Replace TAG_X/SUB_TAG_X with the given tag of your secton from the contents list +// Replace SUB_FEATURE_TITLE/FEATURE_X_TITLE with the given title from the contents list +// Replace FEATURE with the feature name for the server.xml file e.g. mpHealth-1.4 +// Replace LINK with the link for extra information given for the feature +// Replace LINK_DESCRIPTION with a readable description of the information +// // // // // // // // + +[#CVEs] +== Security vulnerability (CVE) fixes in this release +There are no security vulnerability fixes in Open Liberty [26.0.0.6]. +// // // // // // // // +// In the preceding section: +// If there were any CVEs addressed in this release, fill out the table. For the information, reference https://github.com/OpenLiberty/docs/blob/draft/modules/ROOT/pages/security-vulnerabilities.adoc. If it has not been updated for this release, reach out to Kristen Clarke or Michal Broz. +// Note: When linking to features, use the +// `link:{url-prefix}/docs/latest/reference/feature/someFeature-1.0.html[Some Feature 1.0]` format and +// NOT what security-vulnerabilities.adoc does (feature:someFeature-1.0[]) +// +// If there are no CVEs fixed in this release, replace the table with: +// "There are no security vulnerability fixes in Open Liberty [RELEASE_VERSION]." +// // // // // // // // +For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list]. + + +[#bugs] +== Notable bugs fixed in this release + + +We’ve spent some time fixing bugs. The following sections describe the issues resolved in this release. If you’re interested, here’s the link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A26006+label%3A%22release+bug%22[full list of bugs fixed in 26.0.0.6]. + +* link:https://github.com/OpenLiberty/open-liberty/issues/34922[IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability (CVE-2026-5516)] ++ +IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability (CVE-2026-5516) ++ +See the full link:https://www.ibm.com/support/pages/node/7273425[documentation]. + +* link:https://github.com/OpenLiberty/open-liberty/issues/34863[featureUtility exits with return code of 0 with malformed server.xml] +* link:https://github.com/OpenLiberty/open-liberty/issues/34857[FFDC for AlreadyBound exception in EJBRemoteRuntimeImpl during application start] +* link:https://github.com/OpenLiberty/open-liberty/issues/34802[fix AES encryption issues with featureUtility] +* link:https://github.com/OpenLiberty/open-liberty/issues/34773[java9.options not loaded on Windows when JAVA_HOME not set] ++ +On Windows, the server.bat script fails to load java9.options (and java24.options) when JAVA_HOME is not explicitly set, even though Java can be successfully located via JRE_HOME or WLP_DEFAULT_JAVA_HOME environment variables. The script uses these variables to find and execute the java binary, but never sets JAVA_HOME from them. Without JAVA_HOME set, the Java version detection logic (lines 768-795) cannot locate the release file or lib\modules directory, preventing java9.options from being loaded. ++ +This results in missing critical JVM options like --add-opens and --add-exports that are required for Java 9+ module system compatibility, potentially causing module access errors at runtime. + +* link:https://github.com/OpenLiberty/open-liberty/issues/34573[io.openliberty.mpTelemetry.2.0.thirdparty is missing metric APIs (and a few others). Similarly for the stable io.openliberty.io.opentelemetry.2.1 jar] ++ +The Bundle `io.openliberty.mpTelemetry.2.0.thirdparty` does not export metric APIs (and a few others packages) as defined by the `io.openliberty.mpTelemetry-2.0` feature file. ++ +During runtime, these are however, are loaded and made available via the `io.openliberty.io.opentelemetry.2.0` jar/bundle. ++ +The stable `io.openliberty.io.opentelemetry.2.1` jar is also impacted. + +* link:https://github.com/OpenLiberty/open-liberty/issues/34288[An NPE occurs in the TCP Channel Layer during Socket read due to a race condition seen in HTTP/2 connections] ++ +HTTP/2's multiplexing allows concurrent read operations on the same TCP connection. The NPE occurs due to a race condition in concurrent buffer management during HTTP/2 operations. ++ +Thread A gets buffer reference to do a TCP read. + +Thread B concurrently executes cleanup logic when an immediate read.returns 0 bytes and releases JIT-allocated buffers. + +Thread A proceeds to do a read with stale reference, causing NPE + +* link:https://github.com/OpenLiberty/open-liberty/issues/33515[A race condition in SocketRWChannelSelector causes CancelledKeyException] ++ +Unhandled CancelledKeyException occurs in `SocketRWChannelSelector.updateSelector()` when updating SelectionKey interest operations. ++ +java.nio.channels.CancelledKeyException ++ +** at java.base/sun.nio.ch.SelectionKeyImpl.ensureValid(SelectionKeyImpl.java:75) + +** at java.base/sun.nio.ch.SelectionKeyImpl.interestOps(SelectionKeyImpl.java:104) + +** at com.ibm.ws.tcpchannel.internal.SocketRWChannelSelector.updateSelector(SocketRWChannelSelector.java:258) + +** at com.ibm.ws.tcpchannel.internal.ChannelSelector.run(ChannelSelector.java:272) + +** at java.base/java.lang.Thread.run(Thread.java:1474) + +* link:https://github.com/OpenLiberty/open-liberty/issues/31630[HTTP/2 Intermittent server quiesce failure when the same connection stream is attempted to be closed multiple threads] ++ +Intermittent warnings are seen on the server during quiesce when multiple threads concurrently tries to close the same connection. ++ +Thread A: calls `close()` on a connection. + +Thread B: calls `close()` on the same connection. + +Thread A: executes `close()` and cleans up the connection and decrements the number of active connections. + +Thread B: executes `close()` but throws a 'Null Pointer Exception' because the connection was already closed but still decrements the active connections counter and as a result the counter decremented twice for same connection. ++ +The active connection not being 0 causes a prorblem during the quiesce operation and thus causes the warning we see: ++ +** CWWKE1102W: The quiesce operation did not complete. The server will now stop. + +** CWWKE1106W: 1 shutdown operations did not complete during the quiesce period. + + +* link:https://github.com/OpenLiberty/open-liberty/issues/30564[WINDOWS_SERVICE_STOP_TIMEOUT not used in stop command for Windows Service] ++ +On Windows, there is a 'server registerWinService ' command that adds the Liberty server to the registry along with commands to start and stop the server. The registered "server stop" command does not have the --timeout option, which means it always uses the default timeout of 30 seconds. This problem only applies to stopping the services using Windows Services interface. If stopping the service using the "server stopWinService" command, the server script polls, correctly waiting for the server to stop using the environment variable, WINDOWS_SERVICE_STOP_TIMEOUT. ++ +So even though there is a --timeout option on the server stop command, allowing you to set a longer wait for the server to stop, that option was omitted from the windows service registration. If you use Windows Services interface to stop the server, the option is not available to you. + +// // // // // // // // +// In the preceding section: +// For this section ask either Michal Broz or Tom Evans or the #openliberty-release-blog channel for Notable bug fixes in this release. +// Present them as a list in the order as provided, linking to the issue and providing a short description of the bug and the resolution. +// If the issue on Github is missing any information, leave a comment in the issue along the lines of: +// "@[issue_owner(s)] please update the description of this `release bug` using the [bug report template](https://github.com/OpenLiberty/open-liberty/issues/new?assignees=&labels=release+bug&template=bug_report.md&title=)" +// Feel free to message the owner(s) directly as well, especially if no action has been taken by them. +// For inspiration about how to write this section look at previous blogs e.g- 20.0.0.10 or 21.0.0.12 (https://openliberty.io/blog/2021/11/26/jakarta-ee-9.1.html#bugs) +// // // // // // // // + + +// // // // // // // // +// If there were updates to guides since last release, keep the following, otherwise remove section. +// Check with Gilbert Kwan, otherwise Michal Broz or YK Chang +// // // // // // // // +[#guides] +== New and updated guides since the previous release +As Open Liberty features and functionality continue to grow, we continue to add link:https://openliberty.io/guides/?search=new&key=tag[new guides to openliberty.io] on those topics to make their adoption as easy as possible. Existing guides also receive updates to address any reported bugs/issues, keep their content current, and expand what their topic covers. + +* link:https://openliberty.io/guides/microprofile-telemetry-grafana-automatic.html[Enabling observability in microservices with traces, metrics, and logs using OpenTelemetry and Grafana] ++ +Learn how to enable the collection of traces, metrics, and logs from microservices by using MicroProfile Telemetry and the Grafana stack. + +* link:https://openliberty.io/guides/microprofile-telemetry-grafana-custom.html[Adding custom tracing and metrics for microservice observability using OpenTelemetry and Grafana] ++ +Learn how to add manual instrumentation to collect custom spans in traces and custom metrics from microservices by using MicroProfile Telemetry and the Grafana stack. + +* link:https://openliberty.io/guides/jakarta-faces.html[Building a dynamic web application with integrated user interface and backend logic] ++ +Learn how to build a dynamic web application using Jakarta Faces, Jakarta Contexts and Dependency Injection, and Jakarta Expression Language. + +* link:https://openliberty.io/guides/gradle-multimodules.html[Creating a multi-module application with Gradle] ++ +You will learn how to build an application with multiple modules with Gradle and Open Liberty. + +// // // // // // // // +// In the following section, list any new guides, or changes/updates to existing guides. +// The following is an example of how the list can be structured (similar to the bugs section): +// * link:{url-prefix}/guides/[new/updated guide].html[Guide Title] +// ** Description of the guide or the changes made to the guide. +// // // // // // // // + + +== Get Open Liberty 26.0.0.6 now + +Available through <>.