Release Notes

Multi-layer chaos assaults with per-request layer resolution (DATABASE → MESSAGING → SERVICE → HTTP_IN, HTTP_OUT rolled per outgoing call), one check-box per layer in the Dev UI, and service-layer assaults on business beans via a CDI interceptor that runs inside the Fault Tolerance machinery — so @Retry, @Fallback, @Timeout and @CircuitBreaker are exercised for real. The DATABASE layer fails or delays JDBC connection acquisition through an Agroal pool interceptor (JDBC, Hibernate ORM, Panache); the MESSAGING layer faults @Incoming consumers outside Fault Tolerance, each consumed message resolving its own layer (#54).

Each recorded assault carries its source (server, service, rest-client, webclient, database, messaging), exposed in the history, the counters, the metrics, the traces and the Markdown report; the Dev UI status bar counts the assaults per source.

The Markdown report describes the armed chaos layers and the client-side assaults.

Chaos no longer activates in test mode by default: set quarkus.goblin.test.enabled=true to assault your @QuarkusTest suite (or call AssaultEngine.setActive(true) from a test). Adding the extension therefore never slows down nor breaks an existing test suite.

The quarkus-goblin-metrics module now depends on the Micrometer API only (quarkus-micrometer): add the registry of your choice, e.g. quarkus-micrometer-registry-prometheus, to expose /q/metrics.

SERVICE-layer assaults are tagged service instead of server in the metrics and the traces.

Java API: the targeting rules moved from GoblinConfig.TargetConfig to GoblinTargetingConfig (the property names are unchanged), and AssaultEngine.setStaticConfig is removed.

Every configuration key except the quarkus.goblin.target.include-packages / exclude-packages / exclude-annotations targeting rules is now read at runtime and can be overridden when the application starts. The targeting rules stay fixed at build time and are applied by a single implementation shared by every layer.

No chaos wiring in production builds: the service and messaging interceptor bindings, the database hook and the Dev UI JSON-RPC are only registered in dev and test.

Configuration changes (profile switch, reset, import) are published atomically, and each assault hook reads one consistent snapshot per request. A Dev UI import is staged and applied at once: a rejected payload changes nothing, and values of the wrong type are converted or skipped with a warning.

The assault history records the latency actually endured, including a delay cut short by @Timeout, on every layer.

Latency is never applied on a Vert.x event-loop thread, and latency values are bounded to 0-300000 ms.

The Dev UI keeps its toggles and forms in sync with the server (changes made from another tab or a JSON-RPC client appear within 2 seconds) and validates response header names before saving.

The Dev UI state file is written as structured JSON; files written by earlier versions are still read.

Quarkus 3.38 and every later version are accepted by the build (including the ecosystem CI snapshot).

A decision left on a worker thread by a failed HTTP request no longer leaks into a later message consumer or scheduled job.

The Dev UI "client" counter counted nothing: assaults are now counted per source.

Saving response header rules with an invalid name no longer erases every rule.

A corrupted or legacy .goblin-state.json no longer prevents the application from starting.

Dev UI configuration persistence across restarts via .goblin-state.json (#22).

Assault parameter validation at startup and via the Dev UI (#24).

Thread-safe assault history (#23).

Extract per-assault-type classes into a dedicated assault package (#26).

Log a WARN when the configured exception class cannot be instantiated (#27).

Integration tests for package-based include/exclude targeting (#28).

Extension marked as preview status; minimum Java version aligned to 25 (#29).

Server-side assaults: latency, exception, HTTP status and dependency degradation (#1).

Dev UI dashboard with per-assault-type toggles (#10).

Factual markdown report export from the assault history (#13).

Adopt -dev naming for the dev-only extension modules (#14).

Migrate docs to the Antora structure for Quarkiverse publication (#6).

Add the Goblin icon to the extension list (#12).