3.39.4
- #35814 -
Quarkus Security with Jakarta Persistenceguide doesn't mentionsecurity-jpa-reactiveextension - #37745 - Docs: security-oauth2 and security-oauth2-quickstart Guide
- #41734 - Probable bug in CognitoPrincipal lines 62 70
- #53739 - ConfigDiagnostic.configFiles() crashes with AccessDeniedException on Windows when CWD is system32
- #54925 - Formatting fails with a
NullPointerExceptionand the log record is dropped - #54926 - Fix JSON logging with null formatter keys
- #55111 - [quarkus-info] Allow hiding the quarkus version
- #55763 - Make the OIDC token JWE decryption algorithm configurable
- #55910 - Remove unreachable duplicate Claims.groups branch in CognitoPrincipal
- #55916 - DPoPNonceProvider should accept DPoP proof jti
- #56160 - JBang integration fails on Java 24+ with IllegalAccessError: module java.base does not open java.lang
- #56287 - Add forgotten extension-status includes – and remove extension status from guides for stable extensions
- #56303 - OIDC: make
DPoPNonceProvideraccept DPoP proofjti - #56453 - Allow TEST_TO_MAIN_MAPPINGS to be set as a system property
- #56514 - Restore the third callout entry in the Hibernate ORM interceptor example
- #56515 - Add the missing callout entry in the Infinispan client Greeting example
- #56517 - Keep the Keycloak Dev Services resource-mapping callout list together
- #56518 - Use a callout list for the generated resources extension example
- #56519 - Add the two missing callout entries in the Vert.x OIDC migration guide
- #56523 - Bootstrap Maven command from Getting started guide fails
- #56527 - Fix reproducibility issue in Avro
- #56529 - Strip quotes from extension names in Maven create command
- #56537 - Bump GraalVM SDK version to 25.0.4.1
- #56540 - NPE in getEffectiveMapper when response entity is an anonymous class (e.g. Stream)
- #56541 - Fix NPE in getEffectiveMapper when response entity is an anonymous class
- #56552 - the --debug-port or -DdebugPort parameter doesn't seem to work properly, always binding to port 5005
- #56556 - Upgrade Apache HttpClient5 to 5.6.4
- #56559 - Fix custom debug port being ignored in dev mode
- #56560 - [3.39] Bump to Vert.x 4.5.34
- #56561 - Remove empty RemoveableLateBoundSpanProcessor and LateBoundSpanProcessor files
- #56562 - Customize OIDC token decryption algorithm
- #56563 - [Keycloak dev service] - Make dev service access token lifespan configurable
- #56583 - Avoid an internal error when a bean parameter field is not a class type
- #56584 - docs: remove duplicate 'the' in OpenTelemetry logging guide
- #56585 - docs: remove duplicate 'the' in Dev UI Patterns note
- #56586 - Fix 'allows to' grammar in Config programmatic access docs
- #56587 - Fix 'allows to storage' grammar in MongoDB guide
- #56590 - Skip configuration directories that cannot be read when looking for unknown config files
- #56593 - docs: remove duplicate 'the' in OIDC application-type note
- #56604 - Keycloak Dev Service: make default realm's token lifespan configurable
- #56613 - Compare Cognito claim names with strings instead of Claims enum constants
- #56617 - Run the effective command of quarkus:update, with the local repository property
- #56623 - Pass the add-opens requirements to JBang
- #56626 - Fix the imports of the resource examples in the OAuth2 guide
- #56627 - Mention the reactive extension in the Jakarta Persistence security guide
- #56628 - Cache generated Jackson deserializers
- #56630 - cyclonedx guide doesn't list quarkus.cyclonedx.endpoint.* configuration options in reference section
- #56631 - Additional test coverage for CycloneDX
- #56635 - Info - Allow disabling Quarkus version
- #56637 - Add missing CycloneDX endpoint configuration to guide
- #56654 - Flaky test: io.quarkus.micrometer.deployment.binder.VertxTcpMetricsTest.testTcpMetrics
- #56656 - Flaky test: io.quarkus.quartz.test.PausedSchedulerTest.testSchedulerPauseResume
- #56657 - Flaky test: io.quarkus.redis.datasource.PubSubCommandsTest.subscribeToSingleWithMultiAsMessages
- #56667 - Update outdated native SSL guide summary
- #56669 - Fix flaky test DevMojoIT.testResourcesFromClasspath on Windows
- #56671 - Fix flaky PubSubCommandsTest by awaiting reactive subscriptions
- #56708 - Fix flaky PausedSchedulerTest
- #56749 - Drop testEmbeddedSbomUncompressed as quarkus.cyclonedx.embedded.compress was repurposed for the SBOM endpoint
- #56754 - Prevent leakage between Micrometer tests
3.39.3
- #42976 - Quarkus REST in NATIVE - abstract resources with
@Pathrequires impl. to be CDI beans while RESTEasy does not - #45257 - update guide on writing extension regarding docs generation
- #45791 - Range response status reset when using a
@ServerResponseFilter - #55119 - Use branch instead of version to avoid dead link on main guides
- #55674 - context propagation not working correctly
- #55739 - Fix race in AeshLauncherImpl causing flaky test timeouts
- #55835 - Quarkus 3.38 in dev mode - WARNING: java.lang.foreign.Linker::downcallHandle has been called by org.aesh.terminal.tty.impl.LibC in an unnamed module
- #55962 - Enable WebSocket traffic logging in aesh websocket tests
- #55999 - [Docs]: Lift and Shift review of Deploying to OpenShift guide
- #56018 - Aesh: fix flaky WebSocket tests on Semeru by closing WebSocketClient
- #56103 - Mention the quarkus-config-doc-maven-plugin
- #56106 - Add licenses for generic file components in SBOMs
- #56120 - Move SSH enabled config to build time and gate all processor build steps
- #56129 - Fix wrapWithSpan context propagation
- #56153 - Keep the 206 status of Range responses when the JAX-RS response has been materialized
- #56222 - Make sure the callouts follow the Asciidoc syntax
- #56240 - Update redirect instructions for Roq
- #56279 - Security overview guide style review (3.40)
- #56301 - Upgrade aesh to 3.17.5 and improve AeshLauncher test framework
- #56336 - [3.39] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
- #56340 - Add a packaging overview guide
- #56346 - Manage projectreactor in the bom, update to 3.8.7
- #56348 - Update building-docs skill and docs-preview.sh for Roq migration
- #56354 - Upgrade hibernate ORM from 7.4.5.Final to 7.4.7.Final
- #56357 - [3.39] backport of doc improvement
- #56359 - Check Keycloak token type on the OIDC server-less verification path
- #56365 - [3.39] Upgrade RESTEasy to 6.2.18.Final
- #56374 - Remove warning from PeriodicMetricReader
- #56386 - Style and syntax violations in docs callouts
- #56389 - Do not use attributes in guide title to work around Roq/Yupiik limitation
- #56391 - Fix numbered callout lists in documentation examples
- #56393 - ReactiveRedisDataSource.withConnection leaks pool permit when cancelled before connection is acquired
- #56395 - Suppress PeriodicMetricReader exporter warnings
- #56400 - rest-jackson: ContextResolver result cached by entity class, dropping the media type from the key
- #56402 - rest-jackson: SecurityCustomSerialization caches its ObjectWriter in a JVM-wide static field, dropping the ObjectMapper from the key
- #56408 - Update the logging guide for supported APIs
- #56413 - Redis client: fix connection leaks caused by cancellation during acquisition
- #56424 - Quarkus REST: fix native mode when abstract resource with path is extended by a subclass without paths
- #56425 - Doc - place callout lists after source listings
- #56429 - Typo fixes in websockets-next guides
- #56430 - Ensure
FullyFeaturedServerJacksonMessageBodyWriteruses media type properly - #56431 - Ensure
SecurityCustomSerializationusesContextResolver - #56432 - Remove orphaned callout markers with missing explanations
- #56444 - Drop steps for discarded toc plugin in docs preview
- #56449 - Fix remaining callout list placement issues in docs
- #56470 - [3.39] Decouple types discovery and generation of reflection-free Jackson serializers
- #56480 - fix: align docs-preview.sh default port to 8042
- #56487 - Update to Avro 1.12.2, auto-trust Avro-generated classes, add properties to configure additional Avro-trusted classes
- #56489 - SBOM component to product attribution
- #56493 - Certificate reload skips restored certificates by comparing against startup snapshot
- #56497 - [3.39] SBOM CPE attribution
- #56498 - Ensure restoring certificate to original works
3.39.2
- #55234 -
quarkuscli is missing theclassnameoption - #55239 - Add resource class name to CreateApp
- #55355 - Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1
- #55360 - quarkus-container-image-buildpack fails on Windows with UnsupportedOperationException when building container image
- #55545 - Support multiple colons in
@PermissionsAllowedvalue - #55665 - Update buildpack lib to 0.0.17
- #55907 - Quarkus 3.38 Date serialization issue
- #56016 - Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 in /bom/application
- #56030 - WriterInterceptor not called for response mapped from exception
- #56064 -
quarkus-rest-jackson: reflection-free (de)serializers treat aMapsubclass as a bean and drop every map entry - #56126 - Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2
- #56152 - Run writer interceptors for responses mapped from exceptions thrown before the interceptor handler
- #56161 - Allow multiple colons in
@PermissionsAllowed - #56165 - OIDC Redis TokenStateManager returns null instead of failing when the token state is missing, leading to an NPE and HTTP 500
- #56173 - JarResource: cached toExternalForm() breaks relative URL resolution against CodeSource.getLocation()
- #56176 - Fix resolving sibling URL in JarResource
- #56182 - Issue using both Caffeine and Redis for caching
- #56206 - Fix dead link
- #56209 - Update preview workflow for Roq
- #56216 - Avoid early token acquisition for DeferredOidcClient
- #56223 - [3.39] Fix serialization of string-shaped dates without a pattern in reflection-free Jackson serializers
- #56224 - [3.39] Support reflection-free json serialization of a Map subtype
- #56234 - Force re-authentication when the OIDC session token state is no longer available
- #56237 - Bump org.asynchttpclient:async-http-client from 2.15.0 to 2.16.0 in /bom/application
- #56242 - Fix Redis cache backend type resolution
- #56244 - Fix docs preview: Drop invalid condition and unused mtime
- #56257 - Signals: docs - add comparison with CDI events and Vert.x EventBus
- #56278 - security-getting-started-tutorial guide style review (3.40)
- #56280 - security-authorize-web-endpoints-reference guide style review (3.40)
- #56281 - security-keycloak-authorization guide style review (3.40)
- #56282 - security-architecture guide style review (3.40)
- #56292 - Fix typo sytem -> system in the dev services databases guide
- #56293 - docs: fix typo exisits -> exists
- #56300 - Allow --path parameter on quarkus create app cli for parity with maven creation
- #56306 - Typo fixes in deploying-to-abc guides
- #56308 - [3.39] Fix reading headers in Spring Web - Quarkus REST
- #56320 - [3.39] Use composite key for token introspection and userinfo cache
- #56333 - [3.39] Upgrade SmallRye GraphQL to 2.18.5
3.39.1
- #48943 - From Quarkus 3.22, Database dev services not reused if the unit test is using a
@QuarkusTestResource - #51130 - Remote Dev fails when using hibernate-reactive extension
- #55389 - Fix
@RunOnVirtualThreadannotation in combination with blocking endpoints - #55907 - Quarkus 3.38 Date serialization issue
- #55958 - container-image-jib: no progress output while the image is pushed, because ProgressEvent is never subscribed to
- #55959 - Jib container push progress log
- #56009 - Dev UI Dev MCP endpoint hangs indefinitely (no response, no error) when a JSON-RPC request's id is a string
- #56064 -
quarkus-rest-jackson: reflection-free (de)serializers treat aMapsubclass as a bean and drop every map entry - #56070 - quarkus-spring-security may not fail the build when
@PostAuthorize,@PreFilteror@PostFilterare used - #56079 - Skip Hibernate dev integrator in remote server-side dev mode
- #56080 - MongoDB Panache: Session-commit on transaction rollback
- #56086 - [3.39] Do not set an invalid country code when generating the Quarkus Dev CA
- #56087 - [3.39] Handle string JSON-RPC ids and always respond on the Dev MCP endpoint (3.39 backport)
- #56088 - Fail the build when unsupported Spring Security annotations are used
- #56092 - [3.39] Revert "Disable the Quarkus Dev CA generation test on Windows"
- #56101 - Document that CORS cannot be configured both programmatically and with properties
- #56104 - quarkus-config-doc-maven-plugin picks up things from git worktrees that it should ignore
- #56105 - Don't descend into nested git checkouts when scanning for config-doc target directories
- #56130 - Register terminal provider SPI and defer FFM init for native images
- #56131 - docs: clean up independently maintained CORS guide
- #56132 - Redis replication with topology=static does not respect host ordering - Set loses master/replica order
- #56158 - REST Client:
@RestClienton the interface fails the build with a duplicate annotation since 3.32 - #56159 - Ignore a
@RestClientqualifier placed on the REST Client interface - #56166 - Fix MongoDB Panache committing sessions after a JTA transaction timeout
- #56177 - Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1
- #56183 - Redis: make sure the configured hosts are ordered
- #56192 - Do not rebuild the application for every launch of a QuarkusMainTest
- #56197 - Upgrade aesh, aesh-readline, fix ffm downcall and customizers
- #56204 - Switch to JavaParser for generating build items doc
3.39.0
- #56072 - [3.39] Revert "Enable reflection-free Jackson serializers by default"
- #55738 - Make sure
MicrometerRegistryProviderBuildItemhas a stable collection order - #55756 - Datasource guide style review (3.40)
- #55834 -
@Scheduledmethod can run before@InjectMockis installed in@QuarkusTest - #55891 - Scheduler: document halted start mode as a testing workaround
- #55902 - Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1
- #55911 - "ScheduledJobStarted" CDI Event for a scheduled job.
- #55914 - Fire
StartedExecutionCDI event for scheduled jobs - #55947 - Update to Kotlin 2.4.10
- #55980 - Bump Gradle from 9.6.0 to 9.7.0
- #55988 - Embedding cyclone DX SBOM fails with minikube extension since 3.38.0.CR1 because of org.jline:jline-parent:4.0.0 dependency
- #55991 - Document implicit transactions for blocking SmallRye GraphQL resolvers when JTA is available
- #55995 - Bump org.bouncycastle:bc-jdk18on-bom from 1.85 to 1.85.2
- #55997 - Bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10
- #56001 - Document implicit transactions for blocking SmallRye GraphQL resolvers
- #56002 - Use testcontainers' oracle-free instead of oracle-xe
- #56008 - DevUI: use bean class as source for synthetic observers
- #56019 - Fix jline dependency
- #56020 - [3.39] Add quarkus-extension.json
- #56041 - Preserve the configured order of REST compression media types
- #56042 - Make sure
JacksonDeserializerFactory#DeserializationData'sconstructorFieldshas a stable order - #56043 - Record WebSocket endpoint security checks in a stable order
- #56051 - Do not use maps with unstable iteration order in
OidcGraphQLClientIntegrationProcessor - #56052 - Make sure map returned from
WebSocketProcessor#collectEndpointSecurityChecksis stable and immutable - #56053 - Make sure
ctorFieldsinJacksonDeserializerFactory#deserializeObjectFieldsis immutable - #56054 - [3.39] Backport doc categories work to 3.39
- #56072 - [3.39] Revert "Enable reflection-free Jackson serializers by default"
3.38.3
- #34749 - Openshift manifest generator does not detect commit id in "detached HEAD" state
- #55437 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2 in /devtools/gradle
- #55875 - Tree shake break with liquibase extension, if no changelog file exists
- #55918 - Quarkus dev mode fails on macOS when GNU stty precedes BSD stty in PATH
- #55924 - Make sure liquibase extensions don't fail on missing change logs
- #55948 - Bump org.junit:junit-bom from 6.1.2 to 6.1.3
- #55954 - Bump org.junit:junit-bom from 6.1.2 to 6.1.3 in /devtools/gradle
- #55967 - Correct typo in catalog overrides
- #55983 - Avoid eagerly initializing the full map of System#getProperties when not necessary
- #55985 - Fall back to the basic console when terminal initialization fails in dev mode
- #55990 - [3.x] Bump dekorate to 4.1.11
- #56021 - quarkus-logging-json 3.36.x and above removes MDC information when choosing ECS format
- #56024 - Disable tree-shake in test mode
- #56033 - Keep MDC and NDC data in the ECS log format
- #56038 - [3.x] Fix native image build failure on aarch64 when using BC FIPS Poly1305-AES
- #56047 - [3.38] Revert "Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85"
- #56066 - Pass String array arguments of the invoked secured method to
@PermissionChecker - #56067 - Do not set an invalid country code when generating the Quarkus Dev CA
- #56077 - Apply CliSettings customizers in CliRunner single-command execution path
3.38.2
- #55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
- #55169 - Changing how connection closure is handled to avoid a race condition
- #55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
- #55298 - Fix test selection for nested test classes
- #55554 - Bump to Vert.x 4.5.31
- #55560 - [3.x] maven native integration tests fail after #55461
- #55584 - Qute localization breaks with too many entries
- #55587 - Add presence checks on substituted Netty classes
- #55653 - Fix VerifyError for large Qute message bundles
- #55675 - Serialization issue in rest endpoints when class has empty constructor
- #55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
- #55760 - Upgrade Yasson from 3.0.4 to 3.0.5
- #55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
- #55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
- #55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
- #55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
- #55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
- #55849 - Merge isPublicConstructors() when a reflective class is registered twice
- #55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
- #55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
- #55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
- #55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
- #55867 - ArC: fix client proxy name collision for producers
- #55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
- #55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
- #55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
- #55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
- #55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
- #55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
- #55912 - Tree Shaker breaks hibernate filters
- #55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
- #55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
- #55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
- #55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change