3.39.3

Complete changelog

• #42976 - Quarkus REST in NATIVE - abstract resources with @Path requires impl. to be CDI beans while RESTEasy does not
• #45257 - update guide on writing extension regarding docs generation
• #45791 - Range response status reset when using a @ServerResponseFilter
• #55119 - Use branch instead of version to avoid dead link on main guides
• #55674 - context propagation not working correctly
• #55739 - Fix race in AeshLauncherImpl causing flaky test timeouts
• #55835 - Quarkus 3.38 in dev mode - WARNING: java.lang.foreign.Linker::downcallHandle has been called by org.aesh.terminal.tty.impl.LibC in an unnamed module
• #55962 - Enable WebSocket traffic logging in aesh websocket tests
• #55999 - [Docs]: Lift and Shift review of Deploying to OpenShift guide
• #56018 - Aesh: fix flaky WebSocket tests on Semeru by closing WebSocketClient
• #56103 - Mention the quarkus-config-doc-maven-plugin
• #56106 - Add licenses for generic file components in SBOMs
• #56120 - Move SSH enabled config to build time and gate all processor build steps
• #56129 - Fix wrapWithSpan context propagation
• #56153 - Keep the 206 status of Range responses when the JAX-RS response has been materialized
• #56222 - Make sure the callouts follow the Asciidoc syntax
• #56240 - Update redirect instructions for Roq
• #56279 - Security overview guide style review (3.40)
• #56301 - Upgrade aesh to 3.17.5 and improve AeshLauncher test framework
• #56336 - [3.39] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
• #56340 - Add a packaging overview guide
• #56346 - Manage projectreactor in the bom, update to 3.8.7
• #56348 - Update building-docs skill and docs-preview.sh for Roq migration
• #56354 - Upgrade hibernate ORM from 7.4.5.Final to 7.4.7.Final
• #56357 - [3.39] backport of doc improvement
• #56359 - Check Keycloak token type on the OIDC server-less verification path
• #56365 - [3.39] Upgrade RESTEasy to 6.2.18.Final
• #56374 - Remove warning from PeriodicMetricReader
• #56386 - Style and syntax violations in docs callouts
• #56389 - Do not use attributes in guide title to work around Roq/Yupiik limitation
• #56391 - Fix numbered callout lists in documentation examples
• #56393 - ReactiveRedisDataSource.withConnection leaks pool permit when cancelled before connection is acquired
• #56395 - Suppress PeriodicMetricReader exporter warnings
• #56400 - rest-jackson: ContextResolver result cached by entity class, dropping the media type from the key
• #56402 - rest-jackson: SecurityCustomSerialization caches its ObjectWriter in a JVM-wide static field, dropping the ObjectMapper from the key
• #56408 - Update the logging guide for supported APIs
• #56413 - Redis client: fix connection leaks caused by cancellation during acquisition
• #56424 - Quarkus REST: fix native mode when abstract resource with path is extended by a subclass without paths
• #56425 - Doc - place callout lists after source listings
• #56429 - Typo fixes in websockets-next guides
• #56430 - Ensure FullyFeaturedServerJacksonMessageBodyWriter uses media type properly
• #56431 - Ensure SecurityCustomSerialization uses ContextResolver
• #56432 - Remove orphaned callout markers with missing explanations
• #56444 - Drop steps for discarded toc plugin in docs preview
• #56449 - Fix remaining callout list placement issues in docs
• #56470 - [3.39] Decouple types discovery and generation of reflection-free Jackson serializers
• #56480 - fix: align docs-preview.sh default port to 8042
• #56487 - Update to Avro 1.12.2, auto-trust Avro-generated classes, add properties to configure additional Avro-trusted classes
• #56489 - SBOM component to product attribution
• #56493 - Certificate reload skips restored certificates by comparing against startup snapshot
• #56497 - [3.39] SBOM CPE attribution
• #56498 - Ensure restoring certificate to original works

3.33.3.2

Complete changelog

3.27.5.2

Complete changelog

3.39.2

Complete changelog

• #55234 - quarkus cli is missing the classname option
• #55239 - Add resource class name to CreateApp
• #55355 - Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1
• #55360 - quarkus-container-image-buildpack fails on Windows with UnsupportedOperationException when building container image
• #55545 - Support multiple colons in @PermissionsAllowed value
• #55665 - Update buildpack lib to 0.0.17
• #55907 - Quarkus 3.38 Date serialization issue
• #56016 - Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 in /bom/application
• #56030 - WriterInterceptor not called for response mapped from exception
• #56064 - quarkus-rest-jackson: reflection-free (de)serializers treat a Map subclass as a bean and drop every map entry
• #56126 - Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2
• #56152 - Run writer interceptors for responses mapped from exceptions thrown before the interceptor handler
• #56161 - Allow multiple colons in @PermissionsAllowed
• #56165 - OIDC Redis TokenStateManager returns null instead of failing when the token state is missing, leading to an NPE and HTTP 500
• #56173 - JarResource: cached toExternalForm() breaks relative URL resolution against CodeSource.getLocation()
• #56176 - Fix resolving sibling URL in JarResource
• #56182 - Issue using both Caffeine and Redis for caching
• #56206 - Fix dead link
• #56209 - Update preview workflow for Roq
• #56216 - Avoid early token acquisition for DeferredOidcClient
• #56223 - [3.39] Fix serialization of string-shaped dates without a pattern in reflection-free Jackson serializers
• #56224 - [3.39] Support reflection-free json serialization of a Map subtype
• #56234 - Force re-authentication when the OIDC session token state is no longer available
• #56237 - Bump org.asynchttpclient:async-http-client from 2.15.0 to 2.16.0 in /bom/application
• #56242 - Fix Redis cache backend type resolution
• #56244 - Fix docs preview: Drop invalid condition and unused mtime
• #56257 - Signals: docs - add comparison with CDI events and Vert.x EventBus
• #56278 - security-getting-started-tutorial guide style review (3.40)
• #56280 - security-authorize-web-endpoints-reference guide style review (3.40)
• #56281 - security-keycloak-authorization guide style review (3.40)
• #56282 - security-architecture guide style review (3.40)
• #56292 - Fix typo sytem -> system in the dev services databases guide
• #56293 - docs: fix typo exisits -> exists
• #56300 - Allow --path parameter on quarkus create app cli for parity with maven creation
• #56306 - Typo fixes in deploying-to-abc guides
• #56308 - [3.39] Fix reading headers in Spring Web - Quarkus REST
• #56320 - [3.39] Use composite key for token introspection and userinfo cache
• #56333 - [3.39] Upgrade SmallRye GraphQL to 2.18.5

3.39.1

Complete changelog

• #48943 - From Quarkus 3.22, Database dev services not reused if the unit test is using a @QuarkusTestResource
• #51130 - Remote Dev fails when using hibernate-reactive extension
• #55389 - Fix @RunOnVirtualThread annotation in combination with blocking endpoints
• #55907 - Quarkus 3.38 Date serialization issue
• #55958 - container-image-jib: no progress output while the image is pushed, because ProgressEvent is never subscribed to
• #55959 - Jib container push progress log
• #56009 - Dev UI Dev MCP endpoint hangs indefinitely (no response, no error) when a JSON-RPC request's id is a string
• #56064 - quarkus-rest-jackson: reflection-free (de)serializers treat a Map subclass as a bean and drop every map entry
• #56070 - quarkus-spring-security may not fail the build when @PostAuthorize, @PreFilter or @PostFilter are used
• #56079 - Skip Hibernate dev integrator in remote server-side dev mode
• #56080 - MongoDB Panache: Session-commit on transaction rollback
• #56086 - [3.39] Do not set an invalid country code when generating the Quarkus Dev CA
• #56087 - [3.39] Handle string JSON-RPC ids and always respond on the Dev MCP endpoint (3.39 backport)
• #56088 - Fail the build when unsupported Spring Security annotations are used
• #56092 - [3.39] Revert "Disable the Quarkus Dev CA generation test on Windows"
• #56101 - Document that CORS cannot be configured both programmatically and with properties
• #56104 - quarkus-config-doc-maven-plugin picks up things from git worktrees that it should ignore
• #56105 - Don't descend into nested git checkouts when scanning for config-doc target directories
• #56130 - Register terminal provider SPI and defer FFM init for native images
• #56131 - docs: clean up independently maintained CORS guide
• #56132 - Redis replication with topology=static does not respect host ordering - Set loses master/replica order
• #56158 - REST Client: @RestClient on the interface fails the build with a duplicate annotation since 3.32
• #56159 - Ignore a @RestClient qualifier placed on the REST Client interface
• #56166 - Fix MongoDB Panache committing sessions after a JTA transaction timeout
• #56177 - Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1
• #56183 - Redis: make sure the configured hosts are ordered
• #56192 - Do not rebuild the application for every launch of a QuarkusMainTest
• #56197 - Upgrade aesh, aesh-readline, fix ffm downcall and customizers
• #56204 - Switch to JavaParser for generating build items doc

3.39.0

Major changes

• #56072 - [3.39] Revert "Enable reflection-free Jackson serializers by default"

Complete changelog

• #55738 - Make sure MicrometerRegistryProviderBuildItem has a stable collection order
• #55756 - Datasource guide style review (3.40)
• #55834 - @Scheduled method can run before @InjectMock is installed in @QuarkusTest
• #55891 - Scheduler: document halted start mode as a testing workaround
• #55902 - Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1
• #55911 - "ScheduledJobStarted" CDI Event for a scheduled job.
• #55914 - Fire StartedExecution CDI event for scheduled jobs
• #55947 - Update to Kotlin 2.4.10
• #55980 - Bump Gradle from 9.6.0 to 9.7.0
• #55988 - Embedding cyclone DX SBOM fails with minikube extension since 3.38.0.CR1 because of org.jline:jline-parent:4.0.0 dependency
• #55991 - Document implicit transactions for blocking SmallRye GraphQL resolvers when JTA is available
• #55995 - Bump org.bouncycastle:bc-jdk18on-bom from 1.85 to 1.85.2
• #55997 - Bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10
• #56001 - Document implicit transactions for blocking SmallRye GraphQL resolvers
• #56002 - Use testcontainers' oracle-free instead of oracle-xe
• #56008 - DevUI: use bean class as source for synthetic observers
• #56019 - Fix jline dependency
• #56020 - [3.39] Add quarkus-extension.json
• #56041 - Preserve the configured order of REST compression media types
• #56042 - Make sure JacksonDeserializerFactory#DeserializationData's constructorFields has a stable order
• #56043 - Record WebSocket endpoint security checks in a stable order
• #56051 - Do not use maps with unstable iteration order in OidcGraphQLClientIntegrationProcessor
• #56052 - Make sure map returned from WebSocketProcessor#collectEndpointSecurityChecks is stable and immutable
• #56053 - Make sure ctorFields in JacksonDeserializerFactory#deserializeObjectFields is immutable
• #56054 - [3.39] Backport doc categories work to 3.39
• #56072 - [3.39] Revert "Enable reflection-free Jackson serializers by default"

3.38.3

Complete changelog

• #34749 - Openshift manifest generator does not detect commit id in "detached HEAD" state
• #55437 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2 in /devtools/gradle
• #55875 - Tree shake break with liquibase extension, if no changelog file exists
• #55918 - Quarkus dev mode fails on macOS when GNU stty precedes BSD stty in PATH
• #55924 - Make sure liquibase extensions don't fail on missing change logs
• #55948 - Bump org.junit:junit-bom from 6.1.2 to 6.1.3
• #55954 - Bump org.junit:junit-bom from 6.1.2 to 6.1.3 in /devtools/gradle
• #55967 - Correct typo in catalog overrides
• #55983 - Avoid eagerly initializing the full map of System#getProperties when not necessary
• #55985 - Fall back to the basic console when terminal initialization fails in dev mode
• #55990 - [3.x] Bump dekorate to 4.1.11
• #56021 - quarkus-logging-json 3.36.x and above removes MDC information when choosing ECS format
• #56024 - Disable tree-shake in test mode
• #56033 - Keep MDC and NDC data in the ECS log format
• #56038 - [3.x] Fix native image build failure on aarch64 when using BC FIPS Poly1305-AES
• #56047 - [3.38] Revert "Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85"
• #56066 - Pass String array arguments of the invoked secured method to @PermissionChecker
• #56067 - Do not set an invalid country code when generating the Quarkus Dev CA
• #56077 - Apply CliSettings customizers in CliRunner single-command execution path

3.39.0.CR1

Major changes

• #55629 - [3.x] Add post-quantum cryptography (PQC) support to TLS registry

Complete changelog

• #47598 - Quarkus REST issue with UriInfo and matrix parameters
• #48889 - Introduce another Qute escape expression for built items
• #48940 - @RunOnVirtualThread is not working properly with use-separate-server=false
• #50123 - 3.26.2 with gradle doesn't see sources generated by quarkus-openapi-generator
• #51205 - Fine grained reactive/blocking property for specific persistence Units
• #52765 - Document how an extension can be marked as deprecated in quarkus-extension.yaml
• #53855 - Extension can be marked as deprecated in quarkus extension
• #54539 - Quarkus Data: order/sort tweaks
• #54610 - Quarkus data rename package and types
• #54694 - Move Order/Sort to PanacheQuery.sort() in quarkus-data-hibernate
• #54822 - Version Gradle file dependencies by content hash instead of lastModified
• #54826 - Startup regression SmallRyeOpenApiProcessor.prepareDocuments
• #55004 - Enable new inliner for native mode?
• #55041 - Fix gRPC @RunOnVirtualThread half-close race under load
• #55194 - Fix UriInfo matrix parameter handling in RESTEasy Reactive
• #55226 - container image deplolyment group - getEffectiveGroup does not account for a @ character
• #55242 - Bump kubernetes-client-bom from 7.7.0 to 7.8.0
• #55250 - Sanitize derived group name in container image build
• #55312 - [3.x] Upgrade pulsar client 4.2.3
• #55358 - Quickstarts compilation: test against 3.x branch instead
• #55382 - Allow per-persistence-unit control of blocking/reactive Hibernate ORM bootstrap
• #55390 - Add conditional test execution based on application properties
• #55398 - Upgrade sshd to 2.19.0
• #55435 - HibernateProcessorUtil: Add removed method to avoid API breakage
• #55439 - librariesOnly option to include only library components in generated SBOMs
• #55457 - Support build-time-only configuration to disable all runtime config source loading
• #55465 - Add quarkus.config.fixed-at-build-time to freeze all config at build time
• #55482 - Enable native mode SingleCallsiteInliner by default
• #55507 - Clear/reset integration-test boot failure state after class change and failed start
• #55511 - Correct test to tolerate containers being shut down at the end of a test
• #55532 - Fix Gradle compilation against code generated by custom providers
• #55538 - Skip building the OpenAPI document eagerly on startup
• #55541 - Fix typos and duplicated text in guide summaries
• #55563 - Bump MINIMUM GraalVM version to 25.0
• #55596 - Hibernate ORM entity enhancement fails for AdditionalPersistenceUnitBuildItem entities not on the augmentation classloader
• #55597 - Hibernate ORM: fallback to TCCL when loading entities from additional persistence units
• #55598 - [3.x] SmallRye GraphQL 2.18.4 + test for max query depth
• #55606 - Keyclok Admin link works only in the DevUI OIDC card
• #55607 - ArC: use thread-safe list for synthetic injection points
• #55612 - Add support for setting Agroal readOnly on pool config
• #55613 - Add JDBC read only config option
• #55619 - Gradle: local-projects in the serialized application model is nondeterministic across Gradle JVMs, busting the build cache
• #55626 - [3.x] Fix native image regression caused by Netty 4.1.136 SslContext API change
• #55629 - [3.x] Add post-quantum cryptography (PQC) support to TLS registry
• #55635 - DEV UI: fix sub-menu link from dynamic URL method
• #55645 - Hibernate ORM: allow to configure dialect for additional PUs
• #55647 - Serialize application model set-valued fields in a deterministic order
• #55656 - Harden aesh tests for Windows and slow CI environments
• #55663 - Optional access to application host ports from Keycloak Container
• #55667 - Update DB2 image from 12.1.0.0 to 12.1.5.0
• #55668 - Enhancements around build time dependencies in CycloneDX SBOMs
• #55704 - Enforce that only a single OIDC authentication mechanism is configured
• #55720 - Use dev services and implicit schema-management more broadly in h2-based tests
• #55725 - CI - Reuse build artifacts in PQC CI
• #55749 - Deprecate quarkus.hibernate-orm.blocking in favor of per-PU jdbc.enabled/reactive.enabled
• #55755 - Logging guide style review (3.40)
• #55791 - [3.x] Quarkus REST - Fix unbounded multipart part-header accumulation
• #55797 - [3.x] Fix path normalization
• #55877 - OIDC: KubernetesServiceClientAssertionProvider does not proactively refresh a Kubernetes client assertion
• #55885 - OIDC: fix periodic bearer token refresh from filesystem
• #55921 - Qute: support multi-pipe CDATA delimiters
• #55938 - [3.x] Bump smallrye-reactive-messaging.version from 4.36.0 to 4.37.0

3.38.2

Complete changelog

• #55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
• #55169 - Changing how connection closure is handled to avoid a race condition
• #55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
• #55298 - Fix test selection for nested test classes
• #55554 - Bump to Vert.x 4.5.31
• #55560 - [3.x] maven native integration tests fail after #55461
• #55584 - Qute localization breaks with too many entries
• #55587 - Add presence checks on substituted Netty classes
• #55653 - Fix VerifyError for large Qute message bundles
• #55675 - Serialization issue in rest endpoints when class has empty constructor
• #55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
• #55760 - Upgrade Yasson from 3.0.4 to 3.0.5
• #55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
• #55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
• #55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
• #55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
• #55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
• #55849 - Merge isPublicConstructors() when a reflective class is registered twice
• #55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
• #55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
• #55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
• #55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
• #55867 - ArC: fix client proxy name collision for producers
• #55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
• #55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
• #55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
• #55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
• #55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
• #55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
• #55912 - Tree Shaker breaks hibernate filters
• #55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
• #55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
• #55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
• #55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change

3.38.1

Complete changelog

• #54725 - Improve Basic authentication how-to
• #54781 - Vert.x's FileSystemOptions contains constants getting defined at build time
• #54885 - Tests do not start
• #55023 - Support management interface dynamic port in integration tests
• #55062 - REST Client: Content-Type header not set when provided via jakarta.ws.rs.client.Entity
• #55138 - Overwrite content-type header provided via the variant of the entity
• #55267 - Initialize Vert.x FileSystemOptions at runtime for native image
• #55317 - @QuarkusTest bootstrap deadlocks during parallel deployment-dependency resolution
• #55345 - Pre-init Maven resolver HTTP transport classes to avoid class loading deadlock
• #55405 - Bump smallrye-open-api.version from 4.3.3 to 4.3.5
• #55498 - Remove the CI job that runs k8s tests on Windows
• #55520 - JaCoCo: also instrument classes for dev mode tests
• #55525 - JaCoCo: QuarkusExtensionTest does not contribute to coverage report
• #55549 - Copy executionMaxDelay and description in CompositeScheduler
• #55564 - Bump keycloak-client.version from 26.0.10 to 26.0.11
• #55578 - Kotlin 2.4.0: overriding a generic suspend fun in a JAX-RS resource breaks endpoint scanning
• #55588 - Bump io.rest-assured:rest-assured from 6.0.0 to 6.0.1
• #55595 - Ignore synthetic methods in RESTEasy Reactive sub-resource scan
• #55618 - Limit of 18 OpenAPI Profiles
• #55620 - Fix EnumMap ClassCastException in bytecode recorder on method split
• #55633 - Bump com.google.cloud.tools:jib-core from 0.28.1 to 0.28.2
• #55636 - Fix JaCoCo coverage for QuarkusExtensionTest
• #55640 - Enforce managed versions on direct dependencies of an application artifact provided as a JAR
• #55643 - Access log cookie masking bypassed for cookies not first in the header
• #55644 - Fix access log cookie masking to check all cookie pairs
• #55652 - quarkus-rest-jackson Reflection-free-serializers fails on deserializing JsonAlias with same value as fieldname
• #55655 - Remove value registry, not used
• #55678 - @JsonFormat(pattern = "...") on a java.util.Date field is ignored by Reflection-free Jackson serializers
• #55686 - GraphQL+OIDC issue with default configuration and native
• #55687 - quarkus-rest-jackson Reflection-free-serializers serializes @Transient annotated methods
• #55691 - OIDC GraphQL client: fix NPE when default OIDC client is configured and native mode
• #55694 - [3.x] In reflection-free Jackson serializers skip deserialization of a JsonAlias having the same name of the field
• #55701 - @TestHTTPEndpoint not propagated to @Nested subclasses.
• #55702 - reflection-free serializers ignore @JsonValue declared on a superinterface method (multi-level)
• #55703 - Make sure @TestHTTPEndpoint works with nested classes
• #55706 - [3.x] Fix serialization of formatted date in reflection-free Jackson serializers
• #55707 - Treat @Transient as @JsonIgnore in reflection-free Jackson serializers
• #55713 - Fix multi-level @JsonValue inheritance in reflection-free serializers
• #55714 - REST Client hangs forever on any 3xx response without a Location header (e.g. 304 Not Modified) when followRedirects is enabled and an HttpClientRequest customizer is registered
• #55717 - [3.x] Fix REST Client hang when a 3xx response has no Location header
• #55719 - Remove nonsensical configuration from Hibernate Search AI skill
• #55728 - Bump org.hibernate.validator:hibernate-validator from 9.1.2.Final to 9.1.3.Final
• #55737 - Fix reproducibility checks for quarkus-rest-deployment
• #55746 - REST Client silently drops @MatrixParam / @RestMatrix parameters
• #55751 - Send @MatrixParam and @RestMatrix from the REST Client
• #55778 - quarkus-rest-jackson: reflection-free deserializer erases nested type arguments (Map<String, List<Foo>> elements become LinkedHashMap)
• #55779 - Preserve nested type arguments in reflection-free Jackson deserializers
• #55794 - [3.38] Quarkus REST - Fix unbounded multipart part-header accumulation
• #55798 - [3.38] Fix path normalization
• #55800 - Upgrade aesh to 3.16.6 and register MetadataRegistry for native image