What the tests found, and what is fixed — normal-scoped beans could not load outside Vauban, because the build weaves a constructor taking a vauban-api type that was provided (Knock, Heisenberg, Cervantes, Humboldt); Heisenberg keyed metric names and configuration overrides by Weld’s subclass; Humboldt’s span finalizer turned every exception, a 404 included, into a 500 and failed outright on RESTEasy; Dirac and Grimm kept what their extension discovered in static fields, so two containers in one JVM mixed their metrics or their OpenAPI documents, and Dirac failed a deployment on Open Liberty over server classes it could not load; Foy never activated the CDI request context, under any container.

A brick depends on APIs, its Vidocq extension picks the implementations — Jakarta platform APIs are now provided in the bricks, and each Vidocq runtime extension brings what its brick leaves out: the Rest Client extension brings Champollion’s JSON-B, so a Rest Client application without a REST server reads JSON again, and the Telemetry, Rest Client and OpenAPI extensions bring the Jakarta REST API their bricks now leave to the runtime.

Cassini and Foy on any CDI container — cassini-cdi, a new container-neutral module, resolves resources and providers as beans of the running container and activates the request context around each request; Foy does the same for servlets, filters and listeners when given any container’s BeanManager. The session scope stays Vauban-only in Foy for now.

Deploying on an application server — the page of each brick proven on Open Liberty says which server features to keep off and to enable, in a WARNING block its Open Liberty module tests.

The MicroProfile 7.2 specifications in the assembled runtime — JWT Authentication 2.2, OpenAPI 4.2 and Telemetry 2.2 — with their TCKs green on the release candidates; the 7.2 finals are still under ballot, and the runtime is re-run against them once they are on Maven Central.

@Inject @RestClient works, through a new Rest Client codegen bundle that checkpom now requires, and a Rest Client application links with jlink; a new example shows it end to end.

Packaging that says what is wrong — vidocq:docker refuses to build a Linux image around a macOS or Windows jlink image, the legacy package layout launches through the main class’s module, and an application left in the boot layer gets a message naming the exports to add.

Booting says what it is — version, commit, launch mode and debugger address — with readable console logs by default, and vidocq:run / vidocq:idea to run from Maven and IntelliJ.

A client proxy for a third-party produced type, without opening its package, through the Java SE launcher and the Vauban layer; boot-time opening stays opt-in.

Interception follows the specification more closely — @AroundInvoke no longer runs around lifecycle callbacks, inherited and interface default methods are intercepted and forwarded, and members Java source cannot override are generated as bytecode.

The build is reproducible and complete — vauban:generate pre-generates every subclass the container would wrap, in a stable order.

Module lookups for trusted extensions, so an extension such as Heisenberg reaches a managed class’s private members with no opens.

A client’s malformed request entity is the client’s fault. Malformed JSON, an empty body or a value of the wrong type now answers 400 Bad Request instead of 500, after the application’s own exception mappers, and no longer writes a stack trace at ERROR for every such request.

NoContentException becomes a BadRequestException, whatever reader throws it, as Jakarta REST §4.2.4 requires.

RS256 and ES256 both accepted when no algorithm is configured, PEM keys of either family, and a configured algorithm checked by family.

A bad configuration fails the start with a DeploymentException instead of failing every token at request time.

OpenAPI 4.2 features — unknown Schema properties as extensions, @Header examples, method-level @ExternalDocumentation, @Digits constraints.

The model sources combine in the order the specification sets, and every @Schema / @SchemaProperty attribute reaches the document; Grimm ships named Java modules.

OpenTelemetry 1.66, code.function.name on @WithSpan spans, and @WithSpan(inheritContext = false).

Nothing lost on export — exceptions, event names, structured values and double metric points — and the OTLP exporters work on the module path.

RestClientBuilder works on the module path and in a jlink image, listeners from other modules are found, and Reactive Streams is no longer forced on every client.

CompletionStage responses never run on the caller’s thread, and builder listeners run once per builder.

@Fallback(fallbackMethod = …​) works on a strict module path with nothing opened, through Vauban’s module lookup.

@Enumerated(ORDINAL) stores the index, STRING the name; an enum with no annotation keeps storing its name. The tooling API (EntityModels.of, JdqlExecutor) is public, and Mansart JPA has restarted.

Ravel — @Inject @ConfigProperty works under the Vauban annotation processor. What’s new in Ravel.

Champollion — proven on Weld and Open Liberty, where the server’s JSON-B must stay off; the Annotation API is no longer shipped. What’s new in Champollion.

Knock — the registry remembers the last result of each check, with a public CheckResult. What’s new in Knock.

Chappe — writeTimeout is actually applied (a behaviour change: a client that stalls while reading is cut after 30 s by default), and connections close gracefully so the last response survives. What’s new in Chappe.

Dirac — proven on Weld and Open Liberty; two containers in one JVM keep their metrics apart, and vauban-api is now a runtime dependency. What’s new in Dirac.

Foy — the CDI request context is active for each request, under any CDI 4 container, proven on Weld SE. What’s new in Foy.