|
| 1 | +--- |
| 2 | +layout: post |
| 3 | +title: "Support for Java 24, collect Liberty audit logs with OpenTelemetry and more in 25.0.0.4" |
| 4 | +# Do NOT change the categories section |
| 5 | +categories: blog |
| 6 | +author_picture: https://avatars3.githubusercontent.com/navaneethsnair1 |
| 7 | +author_github: https://github.com/navaneethsnair1 |
| 8 | +seo-title: Support for Java 24, collect Liberty audit logs with OpenTelemetry and more in 25.0.0.4 - OpenLiberty.io |
| 9 | +seo-description: The 25.0.0.4 release introduces support for Java 24 and expands InstantOn capabilities to include J2EEManagement, AppClientSupport, and WsSecurity. It also enables Liberty audit logs to be exported to OpenTelemetry using MicroProfile Telemetry 2.0 for unified observability. |
| 10 | +blog_description: The 25.0.0.4 release introduces support for Java 24 and expands InstantOn capabilities to include J2EEManagement, AppClientSupport, and WsSecurity. It also enables Liberty audit logs to be exported to OpenTelemetry using MicroProfile Telemetry 2.0 for unified observability. |
| 11 | +open-graph-image: https://openliberty.io/img/twitter_card.jpg |
| 12 | +open-graph-image-alt: Open Liberty Logo |
| 13 | +--- |
| 14 | += Support for Java 24, collect Liberty audit logs with OpenTelemetry and more in 25.0.0.4 |
| 15 | +Navaneeth S Nair <https://github.com/navaneethsnair1> |
| 16 | +:imagesdir: / |
| 17 | +:url-prefix: |
| 18 | +:url-about: / |
| 19 | +//Blank line here is necessary before starting the body of the post. |
| 20 | + |
| 21 | +// // // // // // // // |
| 22 | +// In the preceding section: |
| 23 | +// Do not insert any blank lines between any of the lines. |
| 24 | +// Do not remove or edit the variables on the lines beneath the author name. |
| 25 | +// |
| 26 | +// "open-graph-image" is set to OL logo. Whenever possible update this to a more appropriate/specific image (For example if present a image that is being used in the post). However, it |
| 27 | +// can be left empty which will set it to the default |
| 28 | +// |
| 29 | +// "open-graph-image-alt" is a description of what is in the image (not a caption). When changing "open-graph-image" to |
| 30 | +// a custom picture, you must provide a custom string for "open-graph-image-alt". |
| 31 | +// |
| 32 | +// Replace TITLE with the blog post title eg: MicroProfile 3.3 is now available on Open Liberty 20.0.0.4 |
| 33 | +// Replace navaneethsnair1 with your GitHub username eg: lauracowen |
| 34 | +// Replace DESCRIPTION with a short summary (~60 words) of the release (a more succinct version of the first paragraph of the post). |
| 35 | +// Replace Navaneeth S Nair with your name as you'd like it to be displayed, eg: Laura Cowen |
| 36 | +// |
| 37 | +// Example post: 2020-04-09-microprofile-3-3-open-liberty-20004.adoc |
| 38 | +// |
| 39 | +// If adding image into the post add : |
| 40 | +// ------------------------- |
| 41 | +// [.img_border_light] |
| 42 | +// image::img/blog/FILE_NAME[IMAGE CAPTION ,width=70%,align="center"] |
| 43 | +// ------------------------- |
| 44 | +// "[.img_border_light]" = This adds a faint grey border around the image to make its edges sharper. Use it around screenshots but not |
| 45 | +// around diagrams. Then double check how it looks. |
| 46 | +// There is also a "[.img_border_dark]" class which tends to work best with screenshots that are taken on dark |
| 47 | +// backgrounds. |
| 48 | +// Change "FILE_NAME" to the name of the image file. Also make sure to put the image into the right folder which is: img/blog |
| 49 | +// change the "IMAGE CAPTION" to a couple words of what the image is |
| 50 | +// // // // // // // // |
| 51 | +The 25.0.0.4 release introduces support for Java 24 and expands InstantOn capabilities to include J2EEManagement, AppClientSupport, and WsSecurity. It also enables Liberty audit logs to be exported to OpenTelemetry using MicroProfile Telemetry 2.0 for unified observability. |
| 52 | + |
| 53 | +In link:{url-about}[Open Liberty] 25.0.0.4: |
| 54 | + |
| 55 | +* <<support, InstantOn Support for J2EEManagement, AppClientSupport and WsSecurity>> |
| 56 | +* <<java, Support for Java 24 in Open Liberty>> |
| 57 | +* <<telemetry, Providing Liberty audit logs to OpenTelemetry using MicroProfile Telemetry 2.0>> |
| 58 | +* <<CVEs, Security Vulnerability (CVE) Fixes>> |
| 59 | + |
| 60 | + |
| 61 | +// // // // // // // // |
| 62 | +// If there were updates to guides since last release, keep the following, otherwise remove section. |
| 63 | +// // // // // // // // |
| 64 | +Along with the new features and functions added to the runtime, we’ve also made <<guides, updates to our guides>>. |
| 65 | + |
| 66 | +// // // // // // // // |
| 67 | +// In the preceding section: |
| 68 | +// Replace the TAG_X with a short label for the feature in lower-case, eg: mp3 |
| 69 | +// Replace the FEATURE_1_HEADING with heading the feature section, eg: MicroProfile 3.3 |
| 70 | +// Where the updates are grouped as sub-headings under a single heading |
| 71 | +// (eg all the features in a MicroProfile release), provide sub-entries in the list; |
| 72 | +// eg replace SUB_TAG_1 with mpr, and SUB_FEATURE_1_HEADING with |
| 73 | +// Easily determine HTTP headers on outgoing requests (MicroProfile Rest Client 1.4) |
| 74 | +// // // // // // // // |
| 75 | + |
| 76 | +View the list of fixed bugs in link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A25004+label%3A%22release+bug%22[25.0.0.4]. |
| 77 | + |
| 78 | +Check out link:{url-prefix}/blog/?search=release&search!=beta[previous Open Liberty GA release blog posts]. |
| 79 | + |
| 80 | +[#run] |
| 81 | + |
| 82 | +// // // // // // // // |
| 83 | +// LINKS |
| 84 | +// |
| 85 | +// OpenLiberty.io site links: |
| 86 | +// link:{url-prefix}/guides/maven-intro.html[Maven] |
| 87 | +// |
| 88 | +// Off-site links: |
| 89 | +//link:https://openapi-generator.tech/docs/installation#jar[Download Instructions] |
| 90 | +// |
| 91 | +// IMAGES |
| 92 | +// |
| 93 | +// Place images in ./img/blog/ |
| 94 | +// Use the syntax: |
| 95 | +// image::/img/blog/log4j-rhocp-diagrams/current-problem.png[Logging problem diagram,width=70%,align="center"] |
| 96 | +// // // // // // // // |
| 97 | + |
| 98 | +== Develop and run your apps using 25.0.0.4 |
| 99 | + |
| 100 | +If you're using link:{url-prefix}/guides/maven-intro.html[Maven], include the following in your `pom.xml` file: |
| 101 | + |
| 102 | +[source,xml] |
| 103 | +---- |
| 104 | +<plugin> |
| 105 | + <groupId>io.openliberty.tools</groupId> |
| 106 | + <artifactId>liberty-maven-plugin</artifactId> |
| 107 | + <version>3.11.3</version> |
| 108 | +</plugin> |
| 109 | +---- |
| 110 | + |
| 111 | +Or for link:{url-prefix}/guides/gradle-intro.html[Gradle], include the following in your `build.gradle` file: |
| 112 | + |
| 113 | +[source,gradle] |
| 114 | +---- |
| 115 | +buildscript { |
| 116 | + repositories { |
| 117 | + mavenCentral() |
| 118 | + } |
| 119 | + dependencies { |
| 120 | + classpath 'io.openliberty.tools:liberty-gradle-plugin:3.9.3' |
| 121 | + } |
| 122 | +} |
| 123 | +apply plugin: 'liberty' |
| 124 | +---- |
| 125 | + |
| 126 | +Or if you're using link:{url-prefix}/docs/latest/container-images.html[container images]: |
| 127 | + |
| 128 | +[source] |
| 129 | +---- |
| 130 | +FROM icr.io/appcafe/open-liberty |
| 131 | +---- |
| 132 | + |
| 133 | +Or take a look at our link:{url-prefix}/start/[Downloads page]. |
| 134 | + |
| 135 | +If you're using link:https://plugins.jetbrains.com/plugin/14856-liberty-tools[IntelliJ IDEA], link:https://marketplace.visualstudio.com/items?itemName=Open-Liberty.liberty-dev-vscode-ext[Visual Studio Code] or link:https://marketplace.eclipse.org/content/liberty-tools[Eclipse IDE], you can also take advantage of our open source link:https://openliberty.io/docs/latest/develop-liberty-tools.html[Liberty developer tools] to enable effective development, testing, debugging and application management all from within your IDE. |
| 136 | + |
| 137 | +[link=https://stackoverflow.com/tags/open-liberty] |
| 138 | +image::img/blog/blog_btn_stack.svg[Ask a question on Stack Overflow, align="center"] |
| 139 | + |
| 140 | +// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // // |
| 141 | +// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/31256 |
| 142 | +// Contact/Reviewer: SmithaSubbarao |
| 143 | +// // // // // // // // |
| 144 | +[#support] |
| 145 | +== InstantOn Support for J2EEManagement, AppClientSupport and WsSecurity |
| 146 | + |
| 147 | +Open Liberty link:{url-prefix}/docs/latest/instanton.html[InstantOn] provides fast startup times for MicroProfile and Jakarta EE applications. With InstantOn, your applications can start in milliseconds, without compromising on throughput, memory, development-production parity, or Java language features. InstantOn uses the Checkpoint/Restore In Userspace (link:https://criu.org/[CRIU]) feature of the Linux kernel to take a checkpoint of the JVM that can be restored later. InstantOn supports link:{url-prefix}/docs/latest/instanton.html#supported-features[a subset of Open Liberty features]. Any public features that are enabled outside of the supported set of features for InstantOn cause the checkpoint to fail with an error message. As of the 25.0.0.4 release, the following features are enhanced to support InstantOn. |
| 148 | + |
| 149 | +- link:{url-prefix}/docs/latest/reference/feature/j2eeManagement-1.1.html[J2EE Management 1.1 (j2eeManagement-1.1)] |
| 150 | +- link:{url-prefix}/docs/latest/reference/feature/appClientSupport-1.0.html[Application Client Support for Server 1.0 (appClientSupport-1.0)] |
| 151 | +- link:{url-prefix}/docs/latest/reference/feature/appClientSupport-2.0.html[Jakarta Application Client Support for Server 2.0 (appClientSupport-2.0)] |
| 152 | +- link:{url-prefix}/docs/latest/reference/feature/wsSecurity-1.1.html[Web Service Security 1.1 (wsSecurity-1.1)] |
| 153 | + |
| 154 | +// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC> |
| 155 | + |
| 156 | +// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // // |
| 157 | +// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/31244 |
| 158 | +// Contact/Reviewer: gjwatts |
| 159 | +// // // // // // // // |
| 160 | +[#java] |
| 161 | +== Support for Java 24 in Open Liberty |
| 162 | + |
| 163 | +Released on 18 March 2025, Java 24 introduces many new features and enhancements over previous versions of Java. However, since Java 24 is not a Long-Term Support (LTS) release, support for it will end when the next version of Java is supported. It offers many features worth checking out. |
| 164 | + |
| 165 | +Here are the link:https://openjdk.org/projects/jdk/24/[JEP changes in Java 24]: |
| 166 | + |
| 167 | +* 404: link:https://openjdk.org/jeps/404[Generational Shenandoah (Experimental)] |
| 168 | +* 450: link:https://openjdk.org/jeps/450[Compact Object Headers (Experimental)] |
| 169 | +* 472: link:https://openjdk.org/jeps/472[Prepare to Restrict the Use of JNI] |
| 170 | +* 475: link:https://openjdk.org/jeps/475[Late Barrier Expansion for G1] |
| 171 | +* 478: link:https://openjdk.org/jeps/478[Key Derivation Function API (Preview)] |
| 172 | +* 479: link:https://openjdk.org/jeps/479[Remove the Windows 32-bit x86 Port] |
| 173 | +* 483: link:https://openjdk.org/jeps/483[Ahead-of-Time Class Loading & Linking] |
| 174 | +* 484: link:https://openjdk.org/jeps/484[Class-File API] |
| 175 | +* 485: link:https://openjdk.org/jeps/485[Stream Gatherers] |
| 176 | +* 486: link:https://openjdk.org/jeps/486[Permanently Disable the Security Manager] |
| 177 | +* 487: link:https://openjdk.org/jeps/487[Scoped Values (Fourth Preview)] |
| 178 | +* 488: link:https://openjdk.org/jeps/488[Primitive Types in Patterns, instanceof, and switch (Second Preview)] |
| 179 | +* 489: link:https://openjdk.org/jeps/489[Vector API (Ninth Incubator)] |
| 180 | +* 490: link:https://openjdk.org/jeps/490[ZGC: Remove the Non-Generational Mode] |
| 181 | +* 491: link:https://openjdk.org/jeps/491[Synchronize Virtual Threads without Pinning] |
| 182 | +* 492: link:https://openjdk.org/jeps/492[Flexible Constructor Bodies (Third Preview)] |
| 183 | +* 493: link:https://openjdk.org/jeps/493[Linking Run-Time Images without JMODs] |
| 184 | +* 494: link:https://openjdk.org/jeps/494[Module Import Declarations (Second Preview)] |
| 185 | +* 495: link:https://openjdk.org/jeps/495[Simple Source Files and Instance Main Methods (Fourth Preview)] |
| 186 | +* 496: link:https://openjdk.org/jeps/496[Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism] |
| 187 | +* 497: link:https://openjdk.org/jeps/497[Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm] |
| 188 | +* 498: link:https://openjdk.org/jeps/498[Warn upon Use of Memory-Access Methods in sun.misc.Unsafe] |
| 189 | +* 499: link:https://openjdk.org/jeps/499[Structured Concurrency (Fourth Preview)] |
| 190 | +* 501: link:https://openjdk.org/jeps/501[Deprecate the 32-bit x86 Port for Removal] |
| 191 | + |
| 192 | +**With the disabling of the Security Manager, you can no longer attempt to start Java with a Security Manager, install one during runtime nor use `AccessController::checkPermission`, `Policy::setPolicy`, `SecurityManager::check*` or `Subject::getSubject`**. Make sure to fully test your applications for this big change and refer to link:https://openjdk.org/jeps/486#Description[the description section of JEP 486] for more information. |
| 193 | + |
| 194 | +Take advantage of the changes in Java 24 in Open Liberty now and get more time to review your applications, microservices, and runtime environments on your favorite server runtime! |
| 195 | + |
| 196 | +To start using Java 24 with Open Liberty, just link:https://adoptium.net/temurin/releases/?version=24[download the latest release of Java 24], download and install the link:https://openliberty.io/start/#runtime_releases[25.0.0.4] or later version of Open Liberty. Then edit your Liberty server's link:https://openliberty.io/docs/latest/reference/config/server-configuration-overview.html#server-env[server.env file] and set JAVA_HOME to your Java 24 installation and start testing! |
| 197 | + |
| 198 | +For more information on Java 24, please visit the Java 24 link:https://jdk.java.net/24/release-notes[release notes page], link:https://docs.oracle.com/en/java/javase/24/docs/api/index.html[API Javadoc page] or link:https://adoptium.net/temurin/releases/?version=24[download page]. |
| 199 | +For more information on Open Liberty, please visit our link:https://openliberty.io/docs[documentation page]. |
| 200 | + |
| 201 | + |
| 202 | +// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC> |
| 203 | + |
| 204 | +// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // // |
| 205 | +// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/31143 |
| 206 | +// Contact/Reviewer: pgunapal |
| 207 | +// // // // // // // // |
| 208 | +[#telemetry] |
| 209 | +== Providing Liberty audit logs to OpenTelemetry using MicroProfile Telemetry 2.0 |
| 210 | + |
| 211 | +MicroProfile Telemetry 2.0 delivers the latest OpenTelemetry technology, enabling the collection and export of metrics and logs in addition to distributed tracing. |
| 212 | + |
| 213 | +The Open Liberty link:{url-prefix}/docs/latest/reference/feature/audit-2.0.html[Audit] feature captures security-related events from the runtime environment and emits human-readable audit records to a file-based log. You can now collect Liberty audit logs and send them to your configured OpenTelemetry exporter by using the link:{url-prefix}/docs/latest/reference/feature/mpTelemetry-2.0.html[MicroProfile Telemetry 2.0] feature (`mpTelemetry-2.0`) with the Audit feature (`audit-1.0` or `audit-2.0`). This update builds on existing capabilities for other Open Liberty runtime log sources (message, trace, and ffdc) and application logs generated by the `java.util.logging` (JUL) component. |
| 214 | + |
| 215 | +To collect audit logs, add either the `audit-1.0` or `audit-2.0` feature and the `mpTelemetry-2.0` feature to your `server.xml` file. Configure the new `audit` log source to the source attribute for the `mpTelemetry` server configuration element, as shown in the following example: |
| 216 | + |
| 217 | +[source,xml] |
| 218 | +---- |
| 219 | +<featureManager> |
| 220 | + <feature>audit-2.0</feature> |
| 221 | + <feature>mpTelemetry-2.0</feature> |
| 222 | +</featureManager> |
| 223 | +
|
| 224 | +<mpTelemetry source="audit"/> |
| 225 | +---- |
| 226 | + |
| 227 | +You can also configure which audit events are captured and routed to OpenTelemetry by specifying audit events and outcomes in the `auditFileHandler` element, as shown in the following example: |
| 228 | + |
| 229 | +[source,xml] |
| 230 | +---- |
| 231 | +<auditFileHandler maxFiles="5" maxFileSize="20" compact="true"> |
| 232 | + <events name="AuditEvent_1" eventName="SECURITY_AUTHN" outcome="SUCCESS"/> |
| 233 | + <events name="AuditEvent_2" eventName="SECURITY_AUTHN" outcome="REDIRECT"/> |
| 234 | + <events name="AuditEvent_3" eventName="SECURITY_AUTHN" outcome="FAILURE"/> |
| 235 | + <events name="AuditEvent_4" eventName="SECURITY_AUTHZ"/> |
| 236 | +</auditFileHandler> |
| 237 | +---- |
| 238 | + |
| 239 | +For more information about the Audit feature, see the link:{url-prefix}/docs/latest/reference/feature/audit-1.0.html[feature documentation]. For more information about using OpenTelemetry as a comprehensive observability solution, see link:{url-prefix}/docs/latest/microprofile-telemetry.html[Collect logs, metrics, and traces with OpenTelemetry]. |
| 240 | + |
| 241 | + |
| 242 | +// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC> |
| 243 | + |
| 244 | +For more details, check the LINK[LINK_DESCRIPTION]. |
| 245 | + |
| 246 | +[#CVEs] |
| 247 | +== Security vulnerability (CVE) fixes in this release |
| 248 | +[cols="5*"] |
| 249 | +|=== |
| 250 | +|CVE |CVSS Score |Vulnerability Assessment |Versions Affected |Notes |
| 251 | + |
| 252 | +|https://www.cve.org/CVERecord?id=CVE-2025-25193[CVE-2025-25193] |
| 253 | +|5.5 |
| 254 | +|Denial of service |
| 255 | +|21.0.0.2 - 25.0.0.3 |
| 256 | +|Affects the `grpc-1.0` and `grpcClient-1.0` features |
| 257 | + |
| 258 | +|https://www.cve.org/CVERecord?id=CVE-2025-23184[CVE-2025-23184] |
| 259 | +|5.9 |
| 260 | +|Denial of service |
| 261 | +|17.0.0.3 - 25.0.0.3 |
| 262 | +|Affects the `jaxws-2.2`, `xmlWS-3.0` and `xmlWS-4.0` features |
| 263 | +|=== |
| 264 | +// // // // // // // // |
| 265 | +// In the preceding section: |
| 266 | +// If there were any CVEs addressed in this release, fill out the table. For the information, reference https://github.com/OpenLiberty/docs/blob/draft/modules/ROOT/pages/security-vulnerabilities.adoc. If it has not been updated for this release, reach out to Kristen Clarke or Michal Broz. |
| 267 | +// Note: When linking to features, use the |
| 268 | +// `link:{url-prefix}/docs/latest/reference/feature/someFeature-1.0.html[Some Feature 1.0]` format and |
| 269 | +// NOT what security-vulnerabilities.adoc does (feature:someFeature-1.0[]) |
| 270 | +// |
| 271 | +// If there are no CVEs fixed in this release, replace the table with: |
| 272 | +// "There are no security vulnerability fixes in Open Liberty [25.0.0.4]." |
| 273 | +// // // // // // // // |
| 274 | +For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list]. |
| 275 | + |
| 276 | +// // // // // // // // |
| 277 | +// In the following section, list any new guides, or changes/updates to existing guides. |
| 278 | +// The following is an example of how the list can be structured (similar to the bugs section): |
| 279 | +// * link:{url-prefix}/guides/[new/updated guide].html[Guide Title] |
| 280 | +// ** Description of the guide or the changes made to the guide. |
| 281 | +// // // // // // // // |
| 282 | + |
| 283 | + |
| 284 | +== Get Open Liberty 25.0.0.4 now |
| 285 | + |
| 286 | +Available through <<run,Maven, Gradle, Docker, and as a downloadable archive>>. |
0 commit comments