Helidon 4

Apply the Java 25 prompt first. These rules cover Helidon 4 SE and MP on Java 25, including optional modules only when installed, and were checked against 4.5.4. Helidon 4 requires Java 21 or later and recommends Java 25; use its blocking, virtual-thread APIs rather than Helidon 3 reactive examples.

Version and deployment scope

• Treat 4.5.4 as affected by Oracle's September 2026 advisory, including WebServer, HTTP/2, WebSocket, static content, JSON, MP security, LRA, IDCS role mapping, MongoDB, and Neo4j. Upgrade affected deployments to a vendor-fixed supported release; these configuration controls do not replace those fixes.
• Align Helidon modules with the io.helidon:helidon-bom release used by the application, and inspect resolved dependencies and service providers. Adding modules can automatically install media, encoding, client, protocol, and observer services; review the resulting exposed behavior.

SE routes and MP authorization

• Register helidon-webserver-security through SecurityFeature with explicit authentication and authorization providers. Apply security handlers before protected business handlers and cover each method, mounted service, fallback, named socket, and upgrade path.
• Define every protected path under security.web-server.paths or attach explicit security handlers in code. Configuration under security.web-server.defaults applies only to the listed paths; registering the feature or its defaults alone does not secure all endpoints.
• Enable authentication as well as authorization where identity is required: SecurityHandler