|
| 1 | +--- |
| 2 | +layout: post |
| 3 | +title: "Support for Java 24, collect Liberty audit logs with OpenTelemetry and more in 25.0.0.4" |
| 4 | +categories: blog |
| 5 | +author_picture: https://avatars3.githubusercontent.com/navaneethsnair1 |
| 6 | +author_github: https://github.com/navaneethsnair1 |
| 7 | +seo-title: Support for Java 24, collect Liberty audit logs with OpenTelemetry and more in 25.0.0.4 - OpenLiberty.io |
| 8 | +seo-description: The 25.0.0.4 release introduces support for Java 24 and expands InstantOn capabilities to include J2EEManagement, AppClientSupport, and WsSecurity. It also enables Liberty audit logs to be exported to OpenTelemetry using MicroProfile Telemetry 2.0 for unified observability. |
| 9 | +blog_description: The 25.0.0.4 release introduces support for Java 24 and expands InstantOn capabilities to include J2EEManagement, AppClientSupport, and WsSecurity. It also enables Liberty audit logs to be exported to OpenTelemetry using MicroProfile Telemetry 2.0 for unified observability. |
| 10 | +open-graph-image: https://openliberty.io/img/twitter_card.jpg |
| 11 | +open-graph-image-alt: Open Liberty Logo |
| 12 | +--- |
| 13 | += Support for Java 24, collect Liberty audit logs with OpenTelemetry and more in 25.0.0.4 |
| 14 | +Navaneeth S Nair <https://github.com/navaneethsnair1> |
| 15 | +:imagesdir: / |
| 16 | +:url-prefix: |
| 17 | +:url-about: / |
| 18 | + |
| 19 | +The 25.0.0.4 release introduces support for Java 24 and expands InstantOn capabilities to include J2EEManagement, AppClientSupport, and WsSecurity. It also enables Liberty audit logs to be exported to OpenTelemetry using MicroProfile Telemetry 2.0 for unified observability. |
| 20 | + |
| 21 | +In link:{url-about}[Open Liberty] 25.0.0.4: |
| 22 | + |
| 23 | +* <<support, InstantOn Support for J2EEManagement, AppClientSupport and WsSecurity>> |
| 24 | +* <<java, Support for Java 24 in Open Liberty>> |
| 25 | +* <<telemetry, Providing Liberty audit logs to OpenTelemetry using MicroProfile Telemetry 2.0>> |
| 26 | +* <<CVEs, Security Vulnerability (CVE) Fixes>> |
| 27 | + |
| 28 | +View the list of fixed bugs in link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A25004+label%3A%22release+bug%22[25.0.0.4]. |
| 29 | + |
| 30 | +Check out link:{url-prefix}/blog/?search=release&search!=beta[previous Open Liberty GA release blog posts]. |
| 31 | + |
| 32 | +[#run] |
| 33 | + |
| 34 | +== Develop and run your apps using 25.0.0.4 |
| 35 | + |
| 36 | +If you're using link:{url-prefix}/guides/maven-intro.html[Maven], include the following in your `pom.xml` file: |
| 37 | + |
| 38 | +[source,xml] |
| 39 | +---- |
| 40 | +<plugin> |
| 41 | + <groupId>io.openliberty.tools</groupId> |
| 42 | + <artifactId>liberty-maven-plugin</artifactId> |
| 43 | + <version>3.11.3</version> |
| 44 | +</plugin> |
| 45 | +---- |
| 46 | + |
| 47 | +Or for link:{url-prefix}/guides/gradle-intro.html[Gradle], include the following in your `build.gradle` file: |
| 48 | + |
| 49 | +[source,gradle] |
| 50 | +---- |
| 51 | +buildscript { |
| 52 | + repositories { |
| 53 | + mavenCentral() |
| 54 | + } |
| 55 | + dependencies { |
| 56 | + classpath 'io.openliberty.tools:liberty-gradle-plugin:3.9.3' |
| 57 | + } |
| 58 | +} |
| 59 | +apply plugin: 'liberty' |
| 60 | +---- |
| 61 | + |
| 62 | +Or if you're using link:{url-prefix}/docs/latest/container-images.html[container images]: |
| 63 | + |
| 64 | +[source] |
| 65 | +---- |
| 66 | +FROM icr.io/appcafe/open-liberty |
| 67 | +---- |
| 68 | + |
| 69 | +Or take a look at our link:{url-prefix}/start/[Downloads page]. |
| 70 | + |
| 71 | +If you're using link:https://plugins.jetbrains.com/plugin/14856-liberty-tools[IntelliJ IDEA], link:https://marketplace.visualstudio.com/items?itemName=Open-Liberty.liberty-dev-vscode-ext[Visual Studio Code] or link:https://marketplace.eclipse.org/content/liberty-tools[Eclipse IDE], you can also take advantage of our open source link:https://openliberty.io/docs/latest/develop-liberty-tools.html[Liberty developer tools] to enable effective development, testing, debugging and application management all from within your IDE. |
| 72 | + |
| 73 | +[link=https://stackoverflow.com/tags/open-liberty] |
| 74 | +image::img/blog/blog_btn_stack.svg[Ask a question on Stack Overflow, align="center"] |
| 75 | + |
| 76 | +// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // // |
| 77 | +// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/31256 |
| 78 | +// Contact/Reviewer: SmithaSubbarao |
| 79 | +// // // // // // // // |
| 80 | +[#support] |
| 81 | +== InstantOn Support for J2EEManagement, AppClientSupport and WsSecurity |
| 82 | + |
| 83 | +Open Liberty link:{url-prefix}/docs/latest/instanton.html[InstantOn] provides fast startup times for MicroProfile and Jakarta EE applications. With InstantOn, your applications can start in milliseconds, without compromising on throughput, memory, development-production parity, or Java language features. InstantOn uses the Checkpoint/Restore In Userspace (link:https://criu.org/[CRIU]) feature of the Linux kernel to take a checkpoint of the JVM that can be restored later. InstantOn supports link:{url-prefix}/docs/latest/instanton.html#supported-features[a subset of Open Liberty features]. Any public features that are enabled outside of the supported set of features for InstantOn cause the checkpoint to fail with an error message. As of the 25.0.0.4 release, the following features are enhanced to support InstantOn. |
| 84 | + |
| 85 | +- link:{url-prefix}/docs/latest/reference/feature/j2eeManagement-1.1.html[J2EE Management 1.1 (j2eeManagement-1.1)] |
| 86 | +- link:{url-prefix}/docs/latest/reference/feature/appClientSupport-1.0.html[Application Client Support for Server 1.0 (appClientSupport-1.0)] |
| 87 | +- link:{url-prefix}/docs/latest/reference/feature/appClientSupport-2.0.html[Jakarta Application Client Support for Server 2.0 (appClientSupport-2.0)] |
| 88 | +- link:{url-prefix}/docs/latest/reference/feature/wsSecurity-1.1.html[Web Service Security 1.1 (wsSecurity-1.1)] |
| 89 | + |
| 90 | +// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC> |
| 91 | + |
| 92 | +// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // // |
| 93 | +// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/31244 |
| 94 | +// Contact/Reviewer: gjwatts |
| 95 | +// // // // // // // // |
| 96 | +[#java] |
| 97 | +== Support for Java 24 in Open Liberty |
| 98 | + |
| 99 | +Released on 18 March 2025, Java 24 introduces many new features and enhancements over previous versions of Java. However, since Java 24 is not a Long-Term Support (LTS) release, support for it will end when the next version of Java is supported. It offers many features worth checking out. |
| 100 | + |
| 101 | +Here are the link:https://openjdk.org/projects/jdk/24/[JEP changes in Java 24]: |
| 102 | + |
| 103 | +* 404: link:https://openjdk.org/jeps/404[Generational Shenandoah (Experimental)] |
| 104 | +* 450: link:https://openjdk.org/jeps/450[Compact Object Headers (Experimental)] |
| 105 | +* 472: link:https://openjdk.org/jeps/472[Prepare to Restrict the Use of JNI] |
| 106 | +* 475: link:https://openjdk.org/jeps/475[Late Barrier Expansion for G1] |
| 107 | +* 478: link:https://openjdk.org/jeps/478[Key Derivation Function API (Preview)] |
| 108 | +* 479: link:https://openjdk.org/jeps/479[Remove the Windows 32-bit x86 Port] |
| 109 | +* 483: link:https://openjdk.org/jeps/483[Ahead-of-Time Class Loading & Linking] |
| 110 | +* 484: link:https://openjdk.org/jeps/484[Class-File API] |
| 111 | +* 485: link:https://openjdk.org/jeps/485[Stream Gatherers] |
| 112 | +* 486: link:https://openjdk.org/jeps/486[Permanently Disable the Security Manager] |
| 113 | +* 487: link:https://openjdk.org/jeps/487[Scoped Values (Fourth Preview)] |
| 114 | +* 488: link:https://openjdk.org/jeps/488[Primitive Types in Patterns, instanceof, and switch (Second Preview)] |
| 115 | +* 489: link:https://openjdk.org/jeps/489[Vector API (Ninth Incubator)] |
| 116 | +* 490: link:https://openjdk.org/jeps/490[ZGC: Remove the Non-Generational Mode] |
| 117 | +* 491: link:https://openjdk.org/jeps/491[Synchronize Virtual Threads without Pinning] |
| 118 | +* 492: link:https://openjdk.org/jeps/492[Flexible Constructor Bodies (Third Preview)] |
| 119 | +* 493: link:https://openjdk.org/jeps/493[Linking Run-Time Images without JMODs] |
| 120 | +* 494: link:https://openjdk.org/jeps/494[Module Import Declarations (Second Preview)] |
| 121 | +* 495: link:https://openjdk.org/jeps/495[Simple Source Files and Instance Main Methods (Fourth Preview)] |
| 122 | +* 496: link:https://openjdk.org/jeps/496[Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism] |
| 123 | +* 497: link:https://openjdk.org/jeps/497[Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm] |
| 124 | +* 498: link:https://openjdk.org/jeps/498[Warn upon Use of Memory-Access Methods in sun.misc.Unsafe] |
| 125 | +* 499: link:https://openjdk.org/jeps/499[Structured Concurrency (Fourth Preview)] |
| 126 | +* 501: link:https://openjdk.org/jeps/501[Deprecate the 32-bit x86 Port for Removal] |
| 127 | + |
| 128 | +With the disabling of the Security Manager, you can no longer attempt to start Java with a Security Manager, install one during runtime nor use `AccessController::checkPermission`, `Policy::setPolicy`, `SecurityManager::check*` or `Subject::getSubject`. Make sure to fully test your applications for this big change and refer to link:https://openjdk.org/jeps/486#Description[the description section of JEP 486] for more information. |
| 129 | + |
| 130 | +Take advantage of the changes in Java 24 in Open Liberty now and get more time to review your applications, microservices, and runtime environments on your favorite server runtime! |
| 131 | + |
| 132 | +To start using Java 24 with Open Liberty, just link:https://adoptium.net/temurin/releases/?version=24[download the latest release of Java 24], download and install the link:https://openliberty.io/start/#runtime_releases[25.0.0.4] or later version of Open Liberty. Then edit your Liberty server's link:https://openliberty.io/docs/latest/reference/config/server-configuration-overview.html#server-env[server.env file] and set JAVA_HOME to your Java 24 installation and start testing! |
| 133 | + |
| 134 | +For more information on Java 24, please visit the Java 24 link:https://jdk.java.net/24/release-notes[release notes page], link:https://docs.oracle.com/en/java/javase/24/docs/api/index.html[API Javadoc page] or link:https://adoptium.net/temurin/releases/?version=24[download page]. |
| 135 | +For more information on Open Liberty, please visit our link:https://openliberty.io/docs[documentation page]. |
| 136 | + |
| 137 | + |
| 138 | +// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC> |
| 139 | + |
| 140 | +// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // // |
| 141 | +// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/31143 |
| 142 | +// Contact/Reviewer: pgunapal |
| 143 | +// // // // // // // // |
| 144 | +[#telemetry] |
| 145 | +== Providing Liberty audit logs to OpenTelemetry using MicroProfile Telemetry 2.0 |
| 146 | + |
| 147 | +MicroProfile Telemetry 2.0 delivers the latest OpenTelemetry technology, enabling the collection and export of metrics and logs in addition to distributed tracing. |
| 148 | + |
| 149 | +The Open Liberty link:{url-prefix}/docs/latest/reference/feature/audit-2.0.html[Audit] feature captures security-related events from the runtime environment and emits human-readable audit records to a file-based log. You can now collect Liberty audit logs and send them to your configured OpenTelemetry exporter by using the link:{url-prefix}/docs/latest/reference/feature/mpTelemetry-2.0.html[MicroProfile Telemetry 2.0] feature (`mpTelemetry-2.0`) with the Audit feature (`audit-1.0` or `audit-2.0`). This update builds on existing capabilities for other Open Liberty runtime log sources (message, trace, and ffdc) and application logs generated by the `java.util.logging` (JUL) component. |
| 150 | + |
| 151 | +To collect audit logs, add either the `audit-1.0` or `audit-2.0` feature and the `mpTelemetry-2.0` feature to your `server.xml` file. Configure the new `audit` log source to the `source` attribute for the `mpTelemetry` server configuration element, as shown in the following example: |
| 152 | + |
| 153 | +[source,xml] |
| 154 | +---- |
| 155 | +<featureManager> |
| 156 | + <feature>audit-2.0</feature> |
| 157 | + <feature>mpTelemetry-2.0</feature> |
| 158 | +</featureManager> |
| 159 | +
|
| 160 | +<mpTelemetry source="audit"/> |
| 161 | +---- |
| 162 | + |
| 163 | +You can also configure which audit events are captured and routed to OpenTelemetry by specifying audit events and outcomes in the `auditFileHandler` element, as shown in the following example: |
| 164 | + |
| 165 | +[source,xml] |
| 166 | +---- |
| 167 | +<auditFileHandler maxFiles="5" maxFileSize="20" compact="true"> |
| 168 | + <events name="AuditEvent_1" eventName="SECURITY_AUTHN" outcome="SUCCESS"/> |
| 169 | + <events name="AuditEvent_2" eventName="SECURITY_AUTHN" outcome="REDIRECT"/> |
| 170 | + <events name="AuditEvent_3" eventName="SECURITY_AUTHN" outcome="FAILURE"/> |
| 171 | + <events name="AuditEvent_4" eventName="SECURITY_AUTHZ"/> |
| 172 | +</auditFileHandler> |
| 173 | +---- |
| 174 | + |
| 175 | +For more information about the Audit feature, see the link:{url-prefix}/docs/latest/reference/feature/audit-1.0.html[feature documentation]. For more information about using OpenTelemetry as a comprehensive observability solution, see link:{url-prefix}/docs/latest/microprofile-telemetry.html[Collect logs, metrics, and traces with OpenTelemetry]. |
| 176 | + |
| 177 | + |
| 178 | +// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC> |
| 179 | + |
| 180 | +[#CVEs] |
| 181 | +== Security vulnerability (CVE) fixes in this release |
| 182 | +[cols="5*"] |
| 183 | +|=== |
| 184 | +|CVE |CVSS Score |Vulnerability Assessment |Versions Affected |Notes |
| 185 | + |
| 186 | +|https://www.cve.org/CVERecord?id=CVE-2025-25193[CVE-2025-25193] |
| 187 | +|5.5 |
| 188 | +|Denial of service |
| 189 | +|21.0.0.2 - 25.0.0.3 |
| 190 | +|Affects the `grpc-1.0` and `grpcClient-1.0` features |
| 191 | + |
| 192 | +|https://www.cve.org/CVERecord?id=CVE-2025-23184[CVE-2025-23184] |
| 193 | +|5.9 |
| 194 | +|Denial of service |
| 195 | +|17.0.0.3 - 25.0.0.3 |
| 196 | +|Affects the `jaxws-2.2`, `xmlWS-3.0` and `xmlWS-4.0` features |
| 197 | +|=== |
| 198 | + |
| 199 | +For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list]. |
| 200 | + |
| 201 | +== Get Open Liberty 25.0.0.4 now |
| 202 | + |
| 203 | +Available through <<run,Maven, Gradle, Docker, and as a downloadable archive>>. |
0 commit comments