Quarkus CredentialsProvider Missing @Unremovable
ID |
java.quarkus_credentials_provider_unremovable |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
quarkus, reliability |
Description
Reports a CDI-scoped implementation of Quarkus’s CredentialsProvider interface that is missing @Unremovable. CredentialsProvider is matched by simple name; an unrelated interface sharing that name is an accepted, rare false positive.
Rationale
Quarkus’s build-time dead-code elimination removes CDI beans it cannot prove are used. A custom CredentialsProvider is picked up at runtime through the framework’s service-provider mechanism, not through an injection point the container can see, so the analysis has nothing to go on and may strip the bean out entirely. The application still builds and starts; the failure only appears the first time something tries to authenticate with the now-missing provider.
@ApplicationScoped
public class VaultCredentialsProvider implements CredentialsProvider {
// no injection point references this bean — the container may remove it at build time
}