DefaultParameterNameProvider may return extra parameter names from BeanDefinition constructor causing Hibernate Validator IndexOutOfBoundsException

[nkwiatkowski]

Expected Behavior

Micronaut should always be able to run bean validation without crashing during metadata building.

More specifically, the ParameterNameProvider used by Hibernate Validator should return a list of parameter names whose size matches the number of parameters of the executable being validated.

Actual Behaviour

In some situations, Micronaut's DefaultParameterNameProvider returns more parameter names than the executable actually has.

This causes Hibernate Validator to fail while building metadata with:

java.lang.IndexOutOfBoundsException: Index X out of bounds for length Y at org.hibernate.validator.internal.properties.javabean.JavaBeanExecutable.getParameterName

From debugging, it appears that the parameter names returned by DefaultParameterNameProvider sometimes include internal Micronaut bean definition parameters, such as:

$beanResolutionContext $beanContext $qualifier $interceptors $interceptorRegistry

These correspond to the constructor of the generated bean definition rather than the actual class constructor.

For example:

Reflection reports:
Parameter count: 5
But the provider returns:
[client, restClient, elasticSearchIndicesService, elasticsearchConfig, queueService, $beanResolutionContext, $beanContext, $qualifier, $interceptors, $interceptorRegistry]

This results in a mismatch between the parameter count and the number of names returned.

Workaround

As a temporary workaround, trimming the returned list to the executable parameter count prevents the crash:

if (names.size() > executable.getParameterCount()) {
    return names.subList(0, executable.getParameterCount());
}

This keeps the real parameter names and discards the extra Micronaut internal ones.

I implemented this by wrapping/replacing the DefaultParameterNameProvider.

Steps To Reproduce

Unfortunately I was not able to produce a minimal standalone reproducer yet.

This occurs in a larger Micronaut application where:

• constructor-injected beans are used
• validation is enabled
• Micronaut AOP/interception is active

The issue appears during Hibernate Validator metadata building when constructor validation is inspected.

What helped diagnose it was replacing the ParameterNameProvider and logging the executable and parameter name list returned by the Micronaut provider.

Environment Information

• Java 25
• Micronaut 4.8.0
• Ubuntu 24.04 LTS

Example Application

No response

Version

4.8.0