WASdev · miuponn · Nov 4, 2025 · Nov 4, 2025 · Dec 3, 2025 · Dec 3, 2025
diff --git a/README.md b/README.md
@@ -179,40 +179,71 @@ The Liberty session caching feature builds on top of an existing technology call
 
     *  **Setup Infinispan Service** - Configuring Liberty session caching with Infinispan depends on an Infinispan service being available in your Kubernetes environment. It is preferable to create your Infinispan service by utilizing the [Infinispan Operator](https://infinispan.org/docs/infinispan-operator/main/operator.html). The [Infinispan Operator Tutorial](https://github.com/infinispan/infinispan-simple-tutorials/tree/main/infinispan-remote/operator/openshift) provides a good example of getting started with Infinispan in OpenShift.
 
-    *  **Install Client Jars and Set INFINISPAN_SERVICE_NAME** - To enable Infinispan functionality in Liberty, the container image author can use the Dockerfile provided below. This Dockerfile assumes an Infinispan service name of `example-infinispan`, which is the default used in the [Infinispan Operator Tutorial](https://github.com/infinispan/infinispan-simple-tutorials/tree/main/infinispan-remote/operator/openshift). To customize your Infinispan service see [Creating Infinispan Clusters](https://infinispan.org/docs/infinispan-operator/main/operator.html#creating-clusters). The `INFINISPAN_SERVICE_NAME` environment variable must be set at build time as shown in the example Dockerfile, or overridden at image deploy time.
-        *  **TIP** - If your Infinispan deployment and Liberty deployment are in different namespaces/projects, you will need to set the `INFINISPAN_HOST`, `INFINISPAN_PORT`, `INFINISPAN_USER`, and `INFINISPAN_PASS` environment variables in addition to the `INFINISPAN_SERVICE_NAME` environment variable. This is due to the Liberty deployment not having the access to the Infinispan service environment variables it requires.
-
-    ```dockerfile
-    ### Infinispan Session Caching ###
-    FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi AS infinispan-client
-
-    # Install Infinispan client jars
-    USER root
-    RUN infinispan-client-setup.sh
-    USER 1001
-
-    FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi AS open-liberty-infinispan
-
-    # Copy Infinispan client jars to Open Liberty shared resources
-    COPY --chown=1001:0 --from=infinispan-client /opt/ibm/wlp/usr/shared/resources/infinispan /opt/ibm/wlp/usr/shared/resources/infinispan
-
-    # Instruct configure.sh to use Infinispan for session caching.
-    # This should be set to the Infinispan service name.
-    # TIP - Run the following oc/kubectl command with admin permissions to determine this value:
-    #       oc get infinispan -o jsonpath={.items[0].metadata.name}
-    ENV INFINISPAN_SERVICE_NAME=example-infinispan
-
-    # Uncomment and set to override auto detected values.
-    # These are normally not needed if running in a Kubernetes environment.
-    # One such scenario would be when the Infinispan and Liberty deployments are in different namespaces/projects.
-    #ENV INFINISPAN_HOST=
-    #ENV INFINISPAN_PORT=
-    #ENV INFINISPAN_USER=
-    #ENV INFINISPAN_PASS=
-
-    # This script will add the requested XML snippets and grow image to be fit-for-purpose
-    RUN configure.sh
-    ```
+    *  **Install Client Jars and Set INFINISPAN_SERVICE_NAME** - The [infinispan-client-setup.sh](ga/latest/kernel/helpers/build/infinispan-client-setup.sh) script automates the retrieval of client libraries. To ensure compatibility between your Liberty features and the Infinispan client, the following variables can be configured during image build time:
+        * `INFINISPAN_CLIENT_VERSION`  
+          - Description: Sets the Infinispan client version. Refer to [Infinispan Release Notes](https://infinispan.org/release-notes) for major version and compatibility details.  
+          - Default: `"15.2.6.Final"`
+        * `INFINISPAN_USE_LATEST_PATCH`  
+          - Description: When set to "true", `INFINISPAN_CLIENT_VERSION` will resolve to the latest patch update within its specified major-minor.  
+          - Default: `"false"`  
+          - Note: This will resolve the highest version string found in [Maven Central](https://mvnrepository.com/artifact/org.infinispan/infinispan-jcache), which may include non-final releases (e.g., .Dev01, .Beta, or .RC versions) if they are newer than the current .Final release.
+        * `INFINISPAN_ENABLE_REACTIVE_STREAMS`  
+          - Description: Enables the inclusion of Reactive Streams and RxJava transitive dependencies.  
+          - Default: `"true"`  
+          - Note: This is required for Infinispan 12+ to prevent runtime errors during Liberty session cache initialization but can be disabled for EOL (<12.0) client versions.      
+        * **TIP** - Liberty enforces specific API namespaces based on the Java EE / Jakarta EE specification level of your enabled features. When using Jakarta EE 10 features, the runtime environment is strictly `jakarta.*`, necessitating an Infinispan client that aligns with that specification. For further details on lifecycle and Java baseline requirements, refer to the [Infinispan Release Posts](https://infinispan.org/blog/tag/release/) and official [Download pages](https://infinispan.org/download/).
+
+        <details>
+        <summary><b>Infinispan Client Compatibility Table</b></summary>
+
+        | Major Version | Java Baseline | Namespace | Support Until | Notes |
+        | :--- | :--- | :--- | :--- | :--- |
+        | **16.0** | Java 17+ | **jakarta.* (EE 10+)** | 6 months after 17.0 (Full) | Release versions no longer end with .Final |
+        | **15.2** | Java 17+ | **jakarta.* (EE 10+)** | May 2026 (Full) | |
+        | **14.0** | Java 11+ | **javax.* / jakarta.*** | October 2027 (Limited) | |
+        | **13.0** | Java 8+ | **javax.*** | November 2026 (Limited) | |
+        | **10.x - 12.0**| Java 8 | **javax.*** | End of life | Unsupported |
+
+        </details>
+
+    * **Dockerfile Example** - An example Dockerfilethat can be used for enabling Infinispan functionality in Liberty is provided below. This Dockerfile assumes an Infinispan service name of `example-infinispan`, which is the default used in the [Infinispan Operator Tutorial](https://github.com/infinispan/infinispan-simple-tutorials/tree/main/infinispan-remote/operator/openshift). To customize your Infinispan service see [Creating Infinispan Clusters](https://infinispan.org/docs/infinispan-operator/main/operator.html#creating-clusters). The `INFINISPAN_SERVICE_NAME` environment variable must be set at build time as shown in the example Dockerfile, or overridden at image deploy time.
+
+        * **TIP** - If your Infinispan deployment and Liberty deployment are in different namespaces/projects, you will need to set the `INFINISPAN_HOST`, `INFINISPAN_PORT`, `INFINISPAN_USER`, and `INFINISPAN_PASS` environment variables in addition to the `INFINISPAN_SERVICE_NAME` environment variable. This is due to the Liberty deployment not having the access to the Infinispan service environment variables it requires.
+
+        ```dockerfile
+            ### Infinispan Session Caching ###
+            FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi AS infinispan-client
+
+            # Install Infinispan client jars
+            USER root
+
+            # Set 15.2.6.Final as client version for Jakarta EE 10 with latest security patches
+            ARG INFINISPAN_CLIENT_VERSION=15.2.6.Final
+            RUN infinispan-client-setup.sh
+            USER 1001
+
+            FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi AS open-liberty-infinispan
+
+            # Copy Infinispan client jars to Open Liberty shared resources
+            COPY --chown=1001:0 --from=infinispan-client /opt/ibm/wlp/usr/shared/resources/infinispan /opt/ibm/wlp/usr/shared/resources/infinispan
+
+            # Instruct configure.sh to use Infinispan for session caching.
+            # This should be set to the Infinispan service name.
+            # TIP - Run the following oc/kubectl command with admin permissions to determine this value:
+            #       oc get infinispan -o jsonpath={.items[0].metadata.name}
+            ENV INFINISPAN_SERVICE_NAME=example-infinispan
+
+            # Uncomment and set to override auto detected values.
+            # These are normally not needed if running in a Kubernetes environment.
+            # One such scenario would be when the Infinispan and Liberty deployments are in different namespaces/projects.
+            #ENV INFINISPAN_HOST=
+            #ENV INFINISPAN_PORT=
+            #ENV INFINISPAN_USER=
+            #ENV INFINISPAN_PASS=
+
+            # This script will add the requested XML snippets and grow image to be fit-for-purpose
+            RUN configure.sh
+        ```
 
     *  **Mount Infinispan Secret** - Finally, the Infinispan generated secret must be mounted as a volume under the mount point of `/platform/bindings/infinispan/secret/` on Liberty containers. The default location, for versions latest and 20.0.0.6+, of `/platform/bindings/infinispan/secret/` can to be overridden by setting the `LIBERTY_INFINISPAN_SECRET_DIR` environment variable. When using the Infinispan Operator, this secret is automatically generated as part of the Infinispan service with the name of `<INFINISPAN_CLUSTER_NAME>-generated-secret`. For the mounting of this secret to succeed, the Infinispan Operator and Liberty must share the same namespace. If they do not share the same namespace, the `INFINISPAN_HOST`, `INFINISPAN_PORT`, `INFINISPAN_USER`, and `INFINISPAN_PASS` environment variables can be used instead(see the dockerfile example above). For an example of mounting this secret, review the `volumes` and `volumeMounts` portions of the YAML below.
 

diff --git a/docs/icr-images.md b/docs/icr-images.md
@@ -3,7 +3,7 @@
 
 WebSphere Liberty container images are available from the IBM Container Registry (ICR) at `icr.io/appcafe/websphere-liberty`. Our recommendation is to use ICR instead of Docker Hub since ICR doesn't impose rate limits on image pulls. Images can be pulled from ICR without authentication. Only images with Universal Base Image (UBI) as the Operating System are available in ICR.
 
-The images for the latest Liberty release and the last two quarterly releases (versions ending in _.3_, _.6_, _.9_ and _.12_) are available and are refreshed regularly (every 1-2 weeks) to include fixes for the operating system (OS) and Java.
+The images for the latest Liberty release and the last three quarterly releases (versions ending in _.3_, _.6_, _.9_ and _.12_) are available and are refreshed regularly (every 1-2 weeks) to include fixes for the operating system (OS) and Java.
 
 Available image tags are listed below. The tags use the following naming convention. For more information on tags, see [Container image naming conventions](https://www.ibm.com/docs/en/was-liberty/base?topic=images-liberty-container#cntr_r_images__imagename__title__1) documentation.
 ```
@@ -18,7 +18,7 @@ The `latest` tag simplifies pulling the full latest Open Liberty release with th
 
 Append a tag to `icr.io/appcafe/websphere-liberty` to pull a specific image. For example, 
 ```
-icr.io/appcafe/websphere-liberty:25.0.0.9-kernel-java17-openj9-ubi
+icr.io/appcafe/websphere-liberty:25.0.0.12-kernel-java25-openj9-ubi-minimal
 ```
 
 Available images can be listed using [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started). Log in with your IBMid prior to running the following commands. Note that authentication is only required to list the images. **Images can be pulled from ICR without authentication** : 
@@ -30,7 +30,7 @@ ibmcloud cr images --restrict appcafe/websphere-liberty
 
 ## Latest version
 
-The following tags include the most recent WebSphere Liberty version: `25.0.0.10` 
+The following tags include the most recent WebSphere Liberty version: `26.0.0.1` 
 
 ```
 kernel-java25-openj9-ubi-minimal
@@ -60,36 +60,61 @@ full-java8-ibmjava-ubi
 latest
 ```
 
-
-## 25.0.0.10
+## 26.0.0.1
 
 ```
-25.0.0.10-kernel-java25-openj9-ubi-minimal
-25.0.0.10-kernel-java21-openj9-ubi-minimal
-25.0.0.10-kernel-java17-openj9-ubi-minimal
-25.0.0.10-kernel-java11-openj9-ubi-minimal
-25.0.0.10-kernel-java8-openj9-ubi-minimal
-25.0.0.10-kernel-java8-ibmjava-ubi-minimal
-
-25.0.0.10-kernel-java17-openj9-ubi
-25.0.0.10-kernel-java11-openj9-ubi
-25.0.0.10-kernel-java8-openj9-ubi
-25.0.0.10-kernel-java8-ibmjava-ubi
-
-25.0.0.10-full-java25-openj9-ubi-minimal
-25.0.0.10-full-java21-openj9-ubi-minimal
-25.0.0.10-full-java17-openj9-ubi-minimal
-25.0.0.10-full-java11-openj9-ubi-minimal
-25.0.0.10-full-java8-openj9-ubi-minimal
-25.0.0.10-full-java8-ibmjava-ubi-minimal
-
-25.0.0.10-full-java17-openj9-ubi
-25.0.0.10-full-java11-openj9-ubi
-25.0.0.10-full-java8-openj9-ubi
-25.0.0.10-full-java8-ibmjava-ubi
+26.0.0.1-kernel-java25-openj9-ubi-minimal
+26.0.0.1-kernel-java21-openj9-ubi-minimal
+26.0.0.1-kernel-java17-openj9-ubi-minimal
+26.0.0.1-kernel-java11-openj9-ubi-minimal
+26.0.0.1-kernel-java8-openj9-ubi-minimal
+26.0.0.1-kernel-java8-ibmjava-ubi-minimal
+
+26.0.0.1-kernel-java17-openj9-ubi
+26.0.0.1-kernel-java11-openj9-ubi
+26.0.0.1-kernel-java8-openj9-ubi
+26.0.0.1-kernel-java8-ibmjava-ubi
+
+26.0.0.1-full-java25-openj9-ubi-minimal
+26.0.0.1-full-java21-openj9-ubi-minimal
+26.0.0.1-full-java17-openj9-ubi-minimal
+26.0.0.1-full-java11-openj9-ubi-minimal
+26.0.0.1-full-java8-openj9-ubi-minimal
+26.0.0.1-full-java8-ibmjava-ubi-minimal
+
+26.0.0.1-full-java17-openj9-ubi
+26.0.0.1-full-java11-openj9-ubi
+26.0.0.1-full-java8-openj9-ubi
+26.0.0.1-full-java8-ibmjava-ubi
 ```
 
+## 25.0.0.12
 
+```
+25.0.0.12-kernel-java25-openj9-ubi-minimal
+25.0.0.12-kernel-java21-openj9-ubi-minimal
+25.0.0.12-kernel-java17-openj9-ubi-minimal
+25.0.0.12-kernel-java11-openj9-ubi-minimal
+25.0.0.12-kernel-java8-openj9-ubi-minimal
+25.0.0.12-kernel-java8-ibmjava-ubi-minimal
+
+25.0.0.12-kernel-java17-openj9-ubi
+25.0.0.12-kernel-java11-openj9-ubi
+25.0.0.12-kernel-java8-openj9-ubi
+25.0.0.12-kernel-java8-ibmjava-ubi
+
+25.0.0.12-full-java25-openj9-ubi-minimal
+25.0.0.12-full-java21-openj9-ubi-minimal
+25.0.0.12-full-java17-openj9-ubi-minimal
+25.0.0.12-full-java11-openj9-ubi-minimal
+25.0.0.12-full-java8-openj9-ubi-minimal
+25.0.0.12-full-java8-ibmjava-ubi-minimal
+
+25.0.0.12-full-java17-openj9-ubi
+25.0.0.12-full-java11-openj9-ubi
+25.0.0.12-full-java8-openj9-ubi
+25.0.0.12-full-java8-ibmjava-ubi
+```
 
 ## 25.0.0.9
 

diff --git a/ga/latest/kernel/helpers/build/infinispan-client-setup.sh b/ga/latest/kernel/helpers/build/infinispan-client-setup.sh
@@ -16,6 +16,15 @@
 
 set -Eeo pipefail
 
+# Recommended stable baseline for Jakarta EE 10 / JDK 17+ environments.
+INFINISPAN_DEFAULT_VERSION="15.2.6.Final"
+INFINISPAN_CLIENT_VERSION=${INFINISPAN_CLIENT_VERSION:-$INFINISPAN_DEFAULT_VERSION}
+
+# Resolves the latest patch release (x.y.Z) within the specified major.minor version.
+INFINISPAN_USE_LATEST_PATCH=${INFINISPAN_USE_LATEST_PATCH:-false}
+# Required for Infinispan 11+ on Liberty. Hard dependency for Liberty sessionCache-1.0.
+INFINISPAN_ENABLE_REACTIVE_STREAMS=${INFINISPAN_ENABLE_REACTIVE_STREAMS:-true}
+
 pkgcmd=yum
 if ! command $pkgcmd
 then
@@ -24,17 +33,58 @@ fi
 
 $pkgcmd update -y
 $pkgcmd install -y maven
-mkdir -p /opt/ibm/wlp/usr/shared/resources/infinispan
-echo '<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">  <modelVersion>4.0.0</modelVersion>   <groupId>io.openliberty</groupId>  <artifactId>openliberty-infinispan-client</artifactId>  <version>1.0</version>  <!-- https://mvnrepository.com/artifact/org.infinispan/infinispan-jcache-remote -->  <dependencies>    <dependency>      <groupId>org.infinispan</groupId>      <artifactId>infinispan-jcache-remote</artifactId>      <version>10.1.3.Final</version>    </dependency>  </dependencies></project>' > /opt/ibm/wlp/usr/shared/resources/infinispan/pom.xml
-mvn -f /opt/ibm/wlp/usr/shared/resources/infinispan/pom.xml versions:use-latest-releases -DallowMajorUpdates=false
-mvn -f /opt/ibm/wlp/usr/shared/resources/infinispan/pom.xml dependency:copy-dependencies -DoutputDirectory=/opt/ibm/wlp/usr/shared/resources/infinispan
+
+CLIENT_JARS_DIR="/opt/ibm/wlp/usr/shared/resources/infinispan"
+mkdir -p "${CLIENT_JARS_DIR}"
+
+cat << EOF > ${CLIENT_JARS_DIR}/pom.xml
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>io.openliberty</groupId>
+  <artifactId>openliberty-infinispan-client</artifactId>
+  <version>1.0</version>
+
+  <!-- https://mvnrepository.com/artifact/org.infinispan/infinispan-jcache-remote -->
+  <dependencies>
+    <dependency>
+      <groupId>org.infinispan</groupId>
+      <artifactId>infinispan-jcache-remote</artifactId>
+      <version>${INFINISPAN_CLIENT_VERSION}</version>
+    </dependency>
+  </dependencies>
+</project>
+EOF
+
+if [ "${INFINISPAN_USE_LATEST_PATCH}" = "true" ]; then
+  echo "Resolving latest Infinispan client patch release (no major upgrades)..."
+  mvn -f "${CLIENT_JARS_DIR}/pom.xml" versions:use-latest-releases -DallowMajorUpdates=false -DallowMinorUpdates=false
+fi
+
+mvn -f "${CLIENT_JARS_DIR}/pom.xml" dependency:copy-dependencies -DoutputDirectory="${CLIENT_JARS_DIR}"
 # This fails with dependency errors using microdnf on ubi-minimal, but it is okay to let it fail
 yum remove -y maven || true
-rm -f /opt/ibm/wlp/usr/shared/resources/infinispan/pom.xml
-rm -f /opt/ibm/wlp/usr/shared/resources/infinispan/jboss-transaction-api*.jar
-rm -f /opt/ibm/wlp/usr/shared/resources/infinispan/reactive-streams-*.jar
-rm -f /opt/ibm/wlp/usr/shared/resources/infinispan/rxjava-*.jar
+rm -f "${CLIENT_JARS_DIR}/pom.xml"
+
+# Remove unnecessary spec jars
+rm -f "${CLIENT_JARS_DIR}"/jboss-transaction-api*.jar
+rm -f "${CLIENT_JARS_DIR}"/jakarta.transaction-api*.jar
+
+# Reactive streams are required for Infinispan 11+ on Liberty sessionCache-1.0
+# Only remove if explicitly disabled (default: enabled)
+if [ "${INFINISPAN_ENABLE_REACTIVE_STREAMS}" != "true" ]; then
+  echo "Removing reactive-streams and rxjava jars as INFINISPAN_ENABLE_REACTIVE_STREAMS is not set to true..."
+  rm -f "${CLIENT_JARS_DIR}"/reactive-streams-*.jar
+  rm -f "${CLIENT_JARS_DIR}"/rxjava-*.jar
+fi
+
 rm -rf ~/.m2
-chown -R 1001:0 /opt/ibm/wlp/usr/shared/resources/infinispan
-chmod -R g+rw /opt/ibm/wlp/usr/shared/resources/infinispan
+chown -R 1001:0 "${CLIENT_JARS_DIR}"
+chmod -R g+rw "${CLIENT_JARS_DIR}"
+
+INSTALLED_VERSION=$(find "${CLIENT_JARS_DIR}/" -name "infinispan-jcache-remote-*.jar" -printf "%f" | sed 's/infinispan-commons-\(.*\).jar/\1/')
 
+if [ -n "$INSTALLED_VERSION" ]; then
+  echo "Successfully installed Infinispan client version: ${INSTALLED_VERSION}"
+fi