3.9.0.CR1

Major changes

• #34493 - Add CLI command for Config
• #37680 - index.html (welcome page) now dynamic
• #38541 - Support OIDC Client JWT Bearer authentication
• #38603 - Introduce @ClientBasicAuth annotation
• #38608 - Allow TLS certificate reloading for the HTTP server
• #39142 - Initial version of the new declarative WebSocket server API
• #39159 - Big Quarkus REST rename
• #39206 - Improve graceful shutdown
• #39301 - Rename SmallRye Reactive Messaging extensions to Messaging

Complete changelog

• #1120 - Panache - Sort properties injected in the query should be escaped somehow
• #1499 - Improve index.html welcome page
• #5236 - Move handling of NotFound http code from resteasy to the vertx-http extension
• #7963 - test Fault Tolerance in dev mode
• #8392 - Hyperlink Rest Resources on 404 page
• #15926 - Hot Reload for TLS Keystore
• #16833 - quarkus scheduler does not await termination of scheduledExecutor
• #20024 - Support Multi<Byte> and Multi<byte[]> for octet stream in Rest Client Reactive
• #21248 - Clean up JDK 18 workarounds
• #25453 - Mutiny is not compatible with quarkus opentelemetry
• #26308 - Panache - load page with join fetch
• #29172 - Integrate FileVault Utils with Quarkus CLI
• #31157 - websocket extension should implement ping/pong
• #31414 - Exclude banned dependency commons-logging in the BOM
• #31497 - Enabled micrometer.binder.http-server should also capture parameterized sub-resources
• #33173 - Quarkus Gradle Plugin: tests with encrypted configuration
• #33495 - OIDC tenant resolution policy
• #34435 - Upload schema to backup cluster in cross site
• #34493 - Add CLI command for Config
• #35410 - Regression 3.3.0 config quarkus.config.locations with vault
• #35812 - Quarkus 3 -> PanacheRepoqueries SemanticException
• #36102 - Clarify quarkus.config.locations and multiple profiles documentation
• #36458 - Enhance OIDC token propagation filters to select named OIDC clients
• #36496 - Panache simplfied query + CTE with
• #36581 - Support of Embedded and ManyToOne nested object projection + Support of @ProjectedFieldName on class fields
• #36594 - Support of Embedded and XXXToOne nested object projection + Support of @ProjectedFieldName on class fields
• #36836 - Re-enable MP Tracing TCK
• #36994 - OIDC AccessToken can lead to AmbiguousResolutionException
• #37285 - Path-matching HTTP Security policy should secure exact path matches for both present and missing ending path separator
• #37485 - OIDC multi-tenancy @Tenant annotation not selecting tenant
• #37488 - Quarkus Maven Plugin doc parameters are broken
• #37622 - Enable caching for quarkus:build and declare dependencies as inputs
• #37645 - Docs: security-authentication-mechanisms Guide
• #37680 - index.html (welcome page) now dynamic
• #37782 - ExtensionDescriptorMojoTest fails on a pristine computer
• #37809 - [Quarkus main] integration test 'main' fails in native mode: QuarkusTestCallbacksITCase.testCallbackContextIsNotFailed
• #37901 - OpenAPI filters run twice when storing
• #37920 - Fixes create and update goals docs
• #38008 - Export security events as OTel Events
• #38070 - Avoid executing OpenAPI build filters twice on build
• #38071 - Bump com.google.api.grpc:proto-google-common-protos from 2.28.0 to 2.30.0
• #38118 - Rename reflection-config.json into reflect-config.json and resources-config.json into resource-config.json
• #38127 - Reset junit test's extension failed state for each test class
• #38166 - Bump grpc.version from 1.59.1 to 1.61.0
• #38186 - Update native configuration file best practices
• #38217 - JAXB - Ignore @XmlTransient fields/methods when marking hierarchy for reflection
• #38242 - Removed Panache marker and annotation processor in favour of Jandex use-site indexing
• #38248 - Infinispan, upload schemas on backup clusters
• #38258 - Fix typos and formatting in ADR-0002
• #38274 - Add details about relocations into README and/or CONTRIBUTING
• #38288 - Bump com.fasterxml:classmate from 1.6.0 to 1.7.0
• #38293 - Apply polish to REST Client read timeout handling
• #38294 - Remove Consul entry from MAINTAINERS.adoc
• #38309 - Dev UI wraps code viewer content in <!----> HTML comments (on Safari and Chrome, but not Firefox)
• #38312 - Bump com.google.errorprone:error_prone_annotations from 2.24.0 to 2.24.1
• #38313 - Bump de.flapdoodle.embed:de.flapdoodle.embed.mongo from 4.12.0 to 4.12.2
• #38321 - Configuration ignored when using config maps and the prefix conflicts with a "static" config group
• #38327 - Updated docs for Panache marker removal
• #38339 - Bump org.apache.groovy:groovy from 4.0.17 to 4.0.18
• #38341 - Building with relocations
• #38344 - Apply some more cleanup now that baseline is JDK 17
• #38345 - Documentation for quarkus.test.profile not mentioning multi-profile support?
• #38360 - Bump org.mockito:mockito-bom from 5.8.0 to 5.9.0
• #38377 - Migration path for the new HTTP semantic conventions
• #38379 - QuarkusComponentTest: support test method parameter injection
• #38380 - Bump org.assertj:assertj-core from 3.25.1 to 3.25.2 in /devtools/gradle
• #38382 - Fix documentation for profiles
• #38383 - Bump org.mockito:mockito-core from 5.9.0 to 5.10.0
• #38385 - Bump org.assertj:assertj-core from 3.25.1 to 3.25.2
• #38403 - Update Gizmo to 1.8.0
• #38408 - Remove an indent not to make it unnecessary section
• #38414 - Assorted JAX-RS security fixes - CVE-2023-6267 and CVE-2023-5675
• #38415 - Add com.gradle Maven extensions to Dependabot
• #38416 - Add build cache for formatter/impsort
• #38419 - Bump org.mockito:mockito-bom from 5.9.0 to 5.10.0
• #38423 - Simplify Netty unsafe build item configuration for the shaded JCTools queues
• #38425 - Make possible to reuse code flow scope calculation and initialized OIDC WebClient
• #38433 - Bump com.google.http-client:google-http-client-bom from 1.43.3 to 1.44.1
• #38453 - Arc - BeanManager#getEvent should be adding @Default qualifier
• #38454 - Arc - Add @Default qualifier to events fired through BM#getEvent() API
• #38457 - Improve logging of Spring Cloud Config extension
• #38478 - Vertx: use NoopShutdownExecutorService and DevModeExecutorService
• #38485 - Retry tests when they fail to fight flaky tests
• #38496 - Reduce ambiguity around RegisterForReflection's defaults
• #38508 - Custom authentication mechanism is not invoked when no identity providers are registered
• #38523 - RESTEasy Reactive and security: invalid response after challenge and exception mapper, two Location headers
• #38524 - Add Hibernate REST data codestart
• #38528 - Logging with Panache: better failure condition
• #38534 - Change default behavior of RegisterForReflection ignoreNested attribute to false
• #38541 - Support OIDC Client JWT Bearer authentication
• #38544 - Bump org.mvnpm:lit-element from 4.0.2 to 4.0.4
• #38554 - Only allow a single Location to be set in RESTEasy Reactive
• #38559 - Be a bit more consistent with OpenShift case
• #38560 - VertxCurrentContextFactory: support multiple CDI contexts
• #38561 - Provide a -Dno-build-cache shortcut do disable the build cache
• #38563 - The ImageMetricsITCase failing with RH Mandrel because postgres is bigger than expected
• #38565 - Add a dead simple way to do basic auth in REST Client
• #38566 - Add Develocity configuration to Quarkus GitHub Bot config
• #38578 - Upgrade DEV UI to codemirror 6
• #38586 - Extend scan for CustomResources to full index, instead of simply application index
• #38588 - Bump org.junit:junit-bom from 5.10.1 to 5.10.2 in /devtools/gradle
• #38589 - Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 in /devtools/gradle
• #38590 - Bump org.assertj:assertj-core from 3.25.2 to 3.25.3
• #38592 - Bump io.quarkus.bot:build-reporter-maven-extension from 3.3.3 to 3.4.4
• #38598 - Improve Dev Services for Infinispan
• #38599 - Bump Gradle version to 8.6
• #38603 - Introduce @ClientBasicAuth annotation
• #38608 - Allow TLS certificate reloading for the HTTP server
• #38609 - Support OIDC Client JWT Bearer authentication
• #38622 - Refactor RESTEasy Classic default JAX-RS security to make endpoint detection more robust
• #38627 - Bump elasticsearch-opensource-components.version from 8.11.4 to 8.12.1
• #38628 - Bump grpc.version from 1.61.0 to 1.61.1
• #38629 - Bump org.junit:junit-bom from 5.10.1 to 5.10.2
• #38630 - Bump artemis.version from 2.31.2 to 2.32.0
• #38635 - Add note about C2 compiler in dev-mode
• #38642 - Adds config file overload for devservices in Infinispan
• #38645 - Escape column names and paths in order by clause with backticks
• #38647 - Increase binary size baseline for postgresql IT with Mandrel 23.0
• #38651 - Update SmallRye Commons to 2.3.0
• #38668 - Bump org.liquibase:liquibase-core from 4.25.1 to 4.26.0
• #38679 - Add convenience methods mirroring ReflectiveClassBuildItem factory methods
• #38685 - Implement TLS Certificate Reload for the Management Interface
• #38701 - Fix boolean values getters for RegisterForReflection annotations
• #38707 - MicroProfile Telemetry compatibility
• #38731 - Switch Hibernate ORM/Reactive/Envers extensions to @ConfigMapping
• #38735 - Polish datasource config structure to get better generated documentation
• #38741 - Bump wildfly-elytron.version from 2.2.3.Final to 2.3.0.Final
• #38742 - Bump io.micrometer:micrometer-bom from 1.12.2 to 1.12.3
• #38745 - Add test for websocket ping/pong
• #38749 - ORM/HR+Panache: Remove FETCH from count queries
• #38751 - Updated MongoDB/Panache parser to latest ORM parser
• #38754 - JAX-RS default security is applied to annotated, inherited endpoints
• #38757 - Upgrade to Hibernate Search 7.1.0.CR1, bump Elasticsearch/OpenSearch version for tests/devservices to 8.12/2.11
• #38758 - Enable Develocity build cache by default and document it better
• #38759 - gRPC codegen fails for large file name like io.envoyproxy.controlplane:api on windows
• #38761 - Speedup ContextInstances if there are null instances
• #38762 - Update JDK to 17.0.10-tem for sdkman usages & ignore gitpod changes in incremental build (GIB)
• #38764 - ORM/HR/Panache: support with and where queries
• #38766 - SchedulerUtils Duration parsing breaks when using duration in days without explicit prefix
• #38772 - Fix HTTP Security policies when OIDC tenant is selected with the @Tenant annotation on Jakarta REST resources
• #38780 - Support more than one OidcEndpoint annotation on a filter with OidcEndpoints
• #38781 - @Scheduled not found when in parent classes
• #38787 - Bump com.google.api.grpc:proto-google-common-protos from 2.30.0 to 2.34.0
• #38789 - Allow setting the user agent programmatically
• #38790 - Use docker exec instead of docker cp to create run script for Kafka native DevService
• #38791 - Scheduler: inheritance of metadata
• #38792 - Make sure /..;/ isn't resolved as /
• #38793 - Update ibmcom/db2 image version
• #38794 - KafkaDevServicesDevModeTestCase instability fix : delete topic at app startup
• #38796 - ArC: improve validation of interceptor method signatures
• #38797 - Revive Podman Test Build workflow
• #38801 - Enhance RestMulti, configurable demand + distinct objects
• #38804 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-core from 1.7.3 to 1.8.0
• #38805 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-bom from 1.7.3 to 1.8.0
• #38806 - Bump com.amazonaws:aws-xray-recorder-sdk-aws-sdk-v2 from 2.15.0 to 2.15.1
• #38820 - Add tests to the TLS certificate reload
• #38822 - Add 'day' support for scheduler every and delayed
• #38825 - ManagedExecutorConfig does not seem to be working when using constructor injection
• #38826 - Bump com.google.errorprone:error_prone_annotations from 2.24.1 to 2.25.0
• #38829 - Bump org.wiremock:wiremock-standalone from 3.3.1 to 3.4.0
• #38832 - Perform security checks on inherited endpoints before payload deserialization in the RESTEasy Reactive
• #38834 - More build cache work
• #38835 - Use consistent versions of the maven-plugin-plugin
• #38840 - Default reactive route returns 404
• #38841 - Correct how we process injection point transformers for SR CP
• #38842 - Do not require IdentityProviders for HTTP Authentication mechanisms without credential types and fail if the required provider is missing
• #38848 - Use new code block component for Dev UI Code displays
• #38852 - Add configuration option for resuming on 404
• #38861 - ArC: add covariant override of Instance.handlesStream() to InjectableInstance
• #38862 - Update OidcEndpoint annotation to support multiple values
• #38863 - Use new Vert.x gRPC server for code.quarkus.io
• #38867 - Bump to DB2 11.5.9.0
• #38870 - Bump wildfly-elytron.version from 2.3.0.Final to 2.3.1.Final
• #38871 - Upgrade codeblock dev ui lib to 1.0.12
• #38885 - Notify manovotn about scheduler-related issues
• #38896 - Remove checks that Elasticsearch dev service distribution/version matches Hibernate Search configuration
• #38903 - Bump org.wiremock:wiremock-standalone from 3.4.0 to 3.4.1
• #38906 - Bump io.fabric8:docker-maven-plugin from 0.43.4 to 0.44.0
• #38912 - Bump org.mvnpm:echarts from 5.4.3 to 5.5.0
• #38915 - Revert "Use new Vert.x gRPC server for code.quarkus.io"
• #38917 - Extend Kafka integration tests to verify JKS and PEM handling
• #38919 - ImageMetricsITCase.verifyImageMetrics failures in main
• #38929 - QuarkusComponentTest: support parameterized test methods
• #38933 - try it out in swagger configuration option
• #38936 - Update native reflection configuration file best practices
• #38937 - Option to warn about failures when loading workspace modules, instead of throwing errors
• #38941 - Bump org.mvnpm:es-module-shims from 1.8.2 to 1.8.3
• #38942 - Bump scala.version from 2.13.12 to 2.13.13
• #38945 - Bump org.apache.logging.log4j:log4j-api from 2.22.1 to 2.23.0
• #38946 - Bump io.quarkus.bot:build-reporter-maven-extension from 3.4.4 to 3.5.0
• #38954 - Qute: introduce RenderedResults assert API for tests
• #38956 - Add swagger try-it-out option
• #38967 - Make standard endpoint names in OidcConfigurationMetadata public
• #38972 - Bump elasticsearch-opensource-components.version from 8.12.1 to 8.12.2
• #38974 - Bump org.jboss.resteasy.spring:resteasy-spring-web from 3.1.1.Final to 3.1.2.Final
• #39002 - @Cache annotation not honored on reactive REST resource beans with separate interface
• #39005 - Hibernate Reactive: don't make transaction-related beans as unremovable and fail on unconfigured datasource
• #39007 - Add commons-compress to list of JOSDK/Fabric8 sensitive dependencies
• #39009 - Narayana update to 7.0.1.Final
• #39012 - Secure HTTP Permission exact paths both with/without ending path separator so that Jakarta REST endpoint paths are secured by default
• #39013 - Bump kafka3.version from 3.6.1 to 3.7.0
• #39014 - Bump com.google.cloud.tools:jib-core from 0.25.0 to 0.26.0
• #39026 - Address increased build time RSS caused by certificate hot reload
• #39030 - Fault Tolerance: add simple test for hot reload
• #39035 - Make OIDC scope separator configurable to support multiple Strava scopes
• #39044 - Fixes ImageMetricsTestCase
• #39047 - Reactive pg datasource with enabled health check opens more connections than configured
• #39050 - Add support for device flow grant type to oidc-client
• #39051 - Add useful links about the run-java script
• #39052 - Honor Cache and NoCache annotations on implementations of a JAX-RS interface
• #39054 - Add support for device grant type to token request
• #39056 - Increase JNI metrics values to account for (upcoming) 17.0.11+1 changes
• #39058 - Update SmallRye Config to 3.6.0
• #39060 - Revert "Fixes ImageMetricsTestCase"
• #39065 - Bump maven-model-helper to 28
• #39066 - Bump io.smallrye.config:smallrye-config-source-yaml from 3.5.4 to 3.6.0 in /devtools/gradle
• #39071 - Bump hibernate-search.version from 7.1.0.CR1 to 7.1.0.Final
• #39079 - Add simple form base app in security-authentication-mechanisms guide
• #39081 - Remove remnants of dev-v1
• #39086 - Fix test assertion
• #39089 - Allow some test mojos to be resolved online
• #39091 - Enhance client-side gRPC TLS configuration
• #39106 - Allows the HTTP server to use PEM truststore
• #39109 - Correctly forward websocket errors in DevUIJsonRPCTest
• #39125 - Bump com.google.api.grpc:proto-google-common-protos from 2.34.0 to 2.36.0
• #39132 - OIDC token propagation: add option to select named OIDC client and token exchange per REST client with the @AccessToken annotation
• #39142 - Initial version of the new declarative WebSocket server API
• #39150 - Update resteasy-reactive-migration.adoc
• #39152 - Add debugging to resteasy / arc interactions
• #39153 - WebSockets Next: make it possible to write a ping frame to the connection
• #39154 - WebSockets Next: rename WebSocketServerConnection to WebSocketConnection
• #39157 - WebSockets Next: add test for filtering connected clients while broadcasting
• #39158 - Updates to Infinispan 15.0.0.CR1
• #39159 - Big Quarkus REST rename
• #39161 - Native quarkus-amazon-lambda-http -- runtime provided is no longer supported
• #39162 - Add mapping to a Map<String, ConfigObject> in the documentation
• #39163 - Update Runtime to provided.al2023 for amazon lambda http native
• #39164 - Improve error message when the keystore/truststore type cannot be detected from the file extension
• #39165 - Bump JUnit Pioneer to 2.2.0
• #39166 - Move junit-pioneer to build-parent
• #39171 - Bump io.quarkus.develocity:quarkus-project-develocity-extension from 1.0.5 to 1.0.6
• #39172 - Bump org.eclipse.angus:angus-activation from 2.0.1 to 2.0.2
• #39174 - Enable MP Telemetry TCK
• #39178 - Update grpc-service-implementation.adoc
• #39190 - Update kindcontainer to 1.4.5
• #39192 - Make HTTP templates for observability work with subresources
• #39193 - WebSockets Next: rename WebSocketServerConnection to WebSocketConnection
• #39196 - Deprecate HyphenateEnumConverter
• #39199 - Bump testcontainers.version from 1.19.6 to 1.19.7
• #39200 - Bump org.jetbrains.dokka:dokka-maven-plugin from 1.9.10 to 1.9.20
• #39202 - Bump grpc.version from 1.61.1 to 1.62.2
• #39204 - Update partial extension names to include full extension names
• #39206 - Improve graceful shutdown
• #39207 - Export security events as OpenTelemetry Span Events
• #39208 - Remove jdk*-workarounds from rest-client TCK
• #39210 - Overriding quarkus.package.output-directory can cause random native build failures
• #39211 - Bump Microsoft SQL Server JDBC driver to 12.6.1
• #39212 - Bump mssql-jdbc to 12.6.1
• #39213 - Ensure that regular jar is not created when a native binary is requested
• #39214 - Improve logging for IO utils and add thread info in build logs
• #39215 - No way to configure iat claim as optional in quarkus-oidc
• #39216 - Unwrap processing exception from REST Client when returning a Uni
• #39217 - Remove commented out code from ResteasyReactiveOutputStream
• #39223 - Fix WithSpan uni and multi
• #39225 - Upgrade to Mutiny 2.5.8
• #39226 - WebSockets Next: test for filtering connected clients while broadcasting
• #39227 - No SecurityScheme on OpenAPI when using openIdConnect and @PermissionsAllowed
• #39232 - Update docs as Quarkus no longer defautling keystore type to JKS
• #39236 - Resolve OIDC tenants with path-matching configuration as alternative to TenantResolver
• #39239 - Bump org.apache.groovy:groovy from 4.0.18 to 4.0.19
• #39243 - Detect .truststore and .keystore files as JKS
• #39245 - dev-ui shows wrong property for rest-client
• #39248 - WebSockets Next: attempt to fix/diagnose flaky tests [do not merge yet!]
• #39249 - OIDC make token iat claim optional via config property
• #39250 - Migrate from config classes to @ConfigMapping OIDC token propagation, OIDC GraphQL client and OIDC client filters
• #39251 - Make mutiny version of pool use the already configured vertx pool
• #39253 - Upgrade Smallrye Stork to 2.6.0
• #39255 - Fix config key for dev-ui
• #39257 - Quarkus 3.8.1: Use GraalVM sdk 23.1.2 over 23.0.1
• #39259 - Add handling of the annotation @PermissionsAllowed on methods or class for OpenAPI
• #39260 - Bump GraalVM SDK version to 23.1.2
• #39261 - Support programmatically created OidcClients in custom OIDC Client filters
• #39262 - Make it easy for custom OIDC filters to use programmaticatlly created OIDC Clients
• #39264 - Escape entity name in Panache queries
• #39265 - Properly support sending InputStream in REST Client
• #39266 - ./mvnw --file $(pwd)/./pom.xml broken since quarkus 3.7.1
• #39267 - Consolidate rerouted requests in access log
• #39270 - Update the title of dev-ui.adoc
• #39271 - Update the title of dev-ui.adoc and fix minor typos
• #39275 - Bump jaxb-runtime.version from 4.0.4 to 4.0.5
• #39276 - Bump org.mvnpm.at.mvnpm:vaadin-webcomponents from 24.3.5 to 24.3.7
• #39279 - Renaming reactive messaging to Quarkus messaging
• #39282 - Add missing headers configuration for InputStream handling
• #39285 - Support sending Multi<io.vertx.mutiny.core.buffer.Buffer> in REST Client
• #39287 - Enhance TLS certificate alias and SNI handling (HTTP & gRPC)
• #39288 - WebSockets Next: ping/pong and callbacks API refactoring
• #39289 - Validate that http and https are not on the same port
• #39291 - Enable gRPC code generation to utilize argument file
• #39301 - Rename SmallRye Reactive Messaging extensions to Messaging
• #39303 - Update native configuration best practices for proxies
• #39308 - Update SmallRye Config to 3.6.1
• #39309 - Normalize POM path
• #39311 - Be more consistent with extension names in datasource.adoc
• #39312 - Refine extension search to allow searching on "rest"
• #39316 - Empty container-group not allowed in Quarkus 3.8.2
• #39317 - Update SmallRye GraphQL to 2.8.0
• #39318 - Fail to deploy application when http and https ports are the same
• #39319 - org.graalvm.js:js was renamed to org.graalvm.polyglot:js-community
• #39320 - Quarkus OIDC Client: OidcRequestFilter is missing OIDC client name information
• #39326 - Updates Infinispan to Protostream 5.0.1.Final
• #39328 - Pass the client and tenant id to OIDC request filters
• #39335 - Various small tweaks for the REST extensions
• #39337 - Fix rest-client-mutiny mention in the docs
• #39340 - Bump com.gradle:common-custom-user-data-maven-extension from 1.12.5 to 1.13
• #39341 - Bump org.eclipse.jgit:org.eclipse.jgit from 6.8.0.202311291450-r to 6.9.0.202403050737-r
• #39342 - Migrate Keycloak Admin Client from config classes to the @ConfigMapping
• #39346 - Document the types of allowed large payloads in REST Client
• #39349 - Update gitflow-incremental-builder to 4.5.3
• #39353 - Allow config empty values in the Gradle worker
• #39354 - Add note about pre-matching filters execution model
• #39357 - Migrate Security WebAuth config classes to @ConfigMapping
• #39366 - Update Kotlin to 1.9.23
• #39370 - Do not return on exact match when searching extensions
• #39373 - Add some guide metadata for REST extensions
• #39377 - Small doc adjustments for the Mailer guides
• #39378 - Do not skip docs for snapshot deployment
• #39379 - Bump org.apache.commons:commons-compress from 1.26.0 to 1.26.1
• #39380 - Bump apicurio-registry.version from 2.5.8.Final to 2.5.9.Final
• #39381 - Bump io.micrometer:micrometer-bom from 1.12.3 to 1.12.4
• #39383 - Typo at OIDC Client Mutual TLS config properties