quarkusio/quarkus 3.9.0.CR1 on GitHub

Major changes

#34493 - Add CLI command for Config
#37680 - index.html (welcome page) now dynamic
#38541 - Support OIDC Client JWT Bearer authentication
#38603 - Introduce @ClientBasicAuth annotation
#38608 - Allow TLS certificate reloading for the HTTP server
#39142 - Initial version of the new declarative WebSocket server API
#39159 - Big Quarkus REST rename
#39206 - Improve graceful shutdown
#39301 - Rename SmallRye Reactive Messaging extensions to Messaging

Complete changelog

#1120 - Panache - Sort properties injected in the query should be escaped somehow
#1499 - Improve index.html welcome page
#5236 - Move handling of NotFound http code from resteasy to the vertx-http extension
#7963 - test Fault Tolerance in dev mode
#8392 - Hyperlink Rest Resources on 404 page
#15926 - Hot Reload for TLS Keystore
#16833 - quarkus scheduler does not await termination of scheduledExecutor
#20024 - Support Multi<Byte> and Multi<byte[]> for octet stream in Rest Client Reactive
#21248 - Clean up JDK 18 workarounds
#25453 - Mutiny is not compatible with quarkus opentelemetry
#26308 - Panache - load page with join fetch
#29172 - Integrate FileVault Utils with Quarkus CLI
#31157 - websocket extension should implement ping/pong
#31414 - Exclude banned dependency commons-logging in the BOM
#31497 - Enabled micrometer.binder.http-server should also capture parameterized sub-resources
#33173 - Quarkus Gradle Plugin: tests with encrypted configuration
#33495 - OIDC tenant resolution policy
#34435 - Upload schema to backup cluster in cross site
#34493 - Add CLI command for Config
#35410 - Regression 3.3.0 config quarkus.config.locations with vault
#35812 - Quarkus 3 -> PanacheRepoqueries SemanticException
#36102 - Clarify quarkus.config.locations and multiple profiles documentation
#36458 - Enhance OIDC token propagation filters to select named OIDC clients
#36496 - Panache simplfied query + CTE with
#36581 - Support of Embedded and ManyToOne nested object projection + Support of @ProjectedFieldName on class fields
#36594 - Support of Embedded and XXXToOne nested object projection + Support of @ProjectedFieldName on class fields
#36836 - Re-enable MP Tracing TCK
#36994 - OIDC AccessToken can lead to AmbiguousResolutionException
#37285 - Path-matching HTTP Security policy should secure exact path matches for both present and missing ending path separator
#37485 - OIDC multi-tenancy @Tenant annotation not selecting tenant
#37488 - Quarkus Maven Plugin doc parameters are broken
#37622 - Enable caching for quarkus:build and declare dependencies as inputs
#37645 - Docs: security-authentication-mechanisms Guide
#37680 - index.html (welcome page) now dynamic
#37782 - ExtensionDescriptorMojoTest fails on a pristine computer
#37809 - [Quarkus main] integration test 'main' fails in native mode: QuarkusTestCallbacksITCase.testCallbackContextIsNotFailed
#37901 - OpenAPI filters run twice when storing
#37920 - Fixes create and update goals docs
#38008 - Export security events as OTel Events
#38070 - Avoid executing OpenAPI build filters twice on build
#38071 - Bump com.google.api.grpc:proto-google-common-protos from 2.28.0 to 2.30.0
#38118 - Rename reflection-config.json into reflect-config.json and resources-config.json into resource-config.json
#38127 - Reset junit test's extension failed state for each test class
#38166 - Bump grpc.version from 1.59.1 to 1.61.0
#38186 - Update native configuration file best practices
#38217 - JAXB - Ignore @XmlTransient fields/methods when marking hierarchy for reflection
#38242 - Removed Panache marker and annotation processor in favour of Jandex use-site indexing
#38248 - Infinispan, upload schemas on backup clusters
#38258 - Fix typos and formatting in ADR-0002
#38274 - Add details about relocations into README and/or CONTRIBUTING
#38288 - Bump com.fasterxml:classmate from 1.6.0 to 1.7.0
#38293 - Apply polish to REST Client read timeout handling
#38294 - Remove Consul entry from MAINTAINERS.adoc
#38309 - Dev UI wraps code viewer content in  HTML comments (on Safari and Chrome, but not Firefox)
#38312 - Bump com.google.errorprone:error_prone_annotations from 2.24.0 to 2.24.1
#38313 - Bump de.flapdoodle.embed:de.flapdoodle.embed.mongo from 4.12.0 to 4.12.2
#38321 - Configuration ignored when using config maps and the prefix conflicts with a "static" config group
#38327 - Updated docs for Panache marker removal
#38339 - Bump org.apache.groovy:groovy from 4.0.17 to 4.0.18
#38341 - Building with relocations
#38344 - Apply some more cleanup now that baseline is JDK 17
#38345 - Documentation for quarkus.test.profile not mentioning multi-profile support?
#38360 - Bump org.mockito:mockito-bom from 5.8.0 to 5.9.0
#38377 - Migration path for the new HTTP semantic conventions
#38379 - QuarkusComponentTest: support test method parameter injection
#38380 - Bump org.assertj:assertj-core from 3.25.1 to 3.25.2 in /devtools/gradle
#38382 - Fix documentation for profiles
#38383 - Bump org.mockito:mockito-core from 5.9.0 to 5.10.0
#38385 - Bump org.assertj:assertj-core from 3.25.1 to 3.25.2
#38403 - Update Gizmo to 1.8.0
#38408 - Remove an indent not to make it unnecessary section
#38414 - Assorted JAX-RS security fixes - CVE-2023-6267 and CVE-2023-5675
#38415 - Add com.gradle Maven extensions to Dependabot
#38416 - Add build cache for formatter/impsort
#38419 - Bump org.mockito:mockito-bom from 5.9.0 to 5.10.0
#38423 - Simplify Netty unsafe build item configuration for the shaded JCTools queues
#38425 - Make possible to reuse code flow scope calculation and initialized OIDC WebClient
#38433 - Bump com.google.http-client:google-http-client-bom from 1.43.3 to 1.44.1
#38453 - Arc - BeanManager#getEvent should be adding @Default qualifier
#38454 - Arc - Add @Default qualifier to events fired through BM#getEvent() API
#38457 - Improve logging of Spring Cloud Config extension
#38478 - Vertx: use NoopShutdownExecutorService and DevModeExecutorService
#38485 - Retry tests when they fail to fight flaky tests
#38496 - Reduce ambiguity around RegisterForReflection's defaults
#38508 - Custom authentication mechanism is not invoked when no identity providers are registered
#38523 - RESTEasy Reactive and security: invalid response after challenge and exception mapper, two Location headers
#38524 - Add Hibernate REST data codestart
#38528 - Logging with Panache: better failure condition
#38534 - Change default behavior of RegisterForReflection ignoreNested attribute to false
#38541 - Support OIDC Client JWT Bearer authentication
#38544 - Bump org.mvnpm:lit-element from 4.0.2 to 4.0.4
#38554 - Only allow a single Location to be set in RESTEasy Reactive
#38559 - Be a bit more consistent with OpenShift case
#38560 - VertxCurrentContextFactory: support multiple CDI contexts
#38561 - Provide a -Dno-build-cache shortcut do disable the build cache
#38563 - The ImageMetricsITCase failing with RH Mandrel because postgres is bigger than expected
#38565 - Add a dead simple way to do basic auth in REST Client
#38566 - Add Develocity configuration to Quarkus GitHub Bot config
#38578 - Upgrade DEV UI to codemirror 6
#38586 - Extend scan for CustomResources to full index, instead of simply application index
#38588 - Bump org.junit:junit-bom from 5.10.1 to 5.10.2 in /devtools/gradle
#38589 - Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 in /devtools/gradle
#38590 - Bump org.assertj:assertj-core from 3.25.2 to 3.25.3
#38592 - Bump io.quarkus.bot:build-reporter-maven-extension from 3.3.3 to 3.4.4
#38598 - Improve Dev Services for Infinispan
#38599 - Bump Gradle version to 8.6
#38603 - Introduce @ClientBasicAuth annotation
#38608 - Allow TLS certificate reloading for the HTTP server
#38609 - Support OIDC Client JWT Bearer authentication
#38622 - Refactor RESTEasy Classic default JAX-RS security to make endpoint detection more robust
#38627 - Bump elasticsearch-opensource-components.version from 8.11.4 to 8.12.1
#38628 - Bump grpc.version from 1.61.0 to 1.61.1
#38629 - Bump org.junit:junit-bom from 5.10.1 to 5.10.2
#38630 - Bump artemis.version from 2.31.2 to 2.32.0
#38635 - Add note about C2 compiler in dev-mode
#38642 - Adds config file overload for devservices in Infinispan
#38645 - Escape column names and paths in order by clause with backticks
#38647 - Increase binary size baseline for postgresql IT with Mandrel 23.0
#38651 - Update SmallRye Commons to 2.3.0
#38668 - Bump org.liquibase:liquibase-core from 4.25.1 to 4.26.0
#38679 - Add convenience methods mirroring ReflectiveClassBuildItem factory methods
#38685 - Implement TLS Certificate Reload for the Management Interface
#38701 - Fix boolean values getters for RegisterForReflection annotations
#38707 - MicroProfile Telemetry compatibility
#38731 - Switch Hibernate ORM/Reactive/Envers extensions to @ConfigMapping
#38735 - Polish datasource config structure to get better generated documentation
#38741 - Bump wildfly-elytron.version from 2.2.3.Final to 2.3.0.Final
#38742 - Bump io.micrometer:micrometer-bom from 1.12.2 to 1.12.3
#38745 - Add test for websocket ping/pong
#38749 - ORM/HR+Panache: Remove FETCH from count queries
#38751 - Updated MongoDB/Panache parser to latest ORM parser
#38754 - JAX-RS default security is applied to annotated, inherited endpoints
#38757 - Upgrade to Hibernate Search 7.1.0.CR1, bump Elasticsearch/OpenSearch version for tests/devservices to 8.12/2.11
#38758 - Enable Develocity build cache by default and document it better
#38759 - gRPC codegen fails for large file name like io.envoyproxy.controlplane:api on windows
#38761 - Speedup ContextInstances if there are null instances
#38762 - Update JDK to 17.0.10-tem for sdkman usages & ignore gitpod changes in incremental build (GIB)
#38764 - ORM/HR/Panache: support with and where queries
#38766 - SchedulerUtils Duration parsing breaks when using duration in days without explicit prefix
#38772 - Fix HTTP Security policies when OIDC tenant is selected with the @Tenant annotation on Jakarta REST resources
#38780 - Support more than one OidcEndpoint annotation on a filter with OidcEndpoints
#38781 - @Scheduled not found when in parent classes
#38787 - Bump com.google.api.grpc:proto-google-common-protos from 2.30.0 to 2.34.0
#38789 - Allow setting the user agent programmatically
#38790 - Use docker exec instead of docker cp to create run script for Kafka native DevService
#38791 - Scheduler: inheritance of metadata
#38792 - Make sure /..;/ isn't resolved as /
#38793 - Update ibmcom/db2 image version
#38794 - KafkaDevServicesDevModeTestCase instability fix : delete topic at app startup
#38796 - ArC: improve validation of interceptor method signatures
#38797 - Revive Podman Test Build workflow
#38801 - Enhance RestMulti, configurable demand + distinct objects
#38804 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-core from 1.7.3 to 1.8.0
#38805 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-bom from 1.7.3 to 1.8.0
#38806 - Bump com.amazonaws:aws-xray-recorder-sdk-aws-sdk-v2 from 2.15.0 to 2.15.1
#38820 - Add tests to the TLS certificate reload
#38822 - Add 'day' support for scheduler every and delayed
#38825 - ManagedExecutorConfig does not seem to be working when using constructor injection
#38826 - Bump com.google.errorprone:error_prone_annotations from 2.24.1 to 2.25.0
#38829 - Bump org.wiremock:wiremock-standalone from 3.3.1 to 3.4.0
#38832 - Perform security checks on inherited endpoints before payload deserialization in the RESTEasy Reactive
#38834 - More build cache work
#38835 - Use consistent versions of the maven-plugin-plugin
#38840 - Default reactive route returns 404
#38841 - Correct how we process injection point transformers for SR CP
#38842 - Do not require IdentityProviders for HTTP Authentication mechanisms without credential types and fail if the required provider is missing
#38848 - Use new code block component for Dev UI Code displays
#38852 - Add configuration option for resuming on 404
#38861 - ArC: add covariant override of Instance.handlesStream() to InjectableInstance
#38862 - Update OidcEndpoint annotation to support multiple values
#38863 - Use new Vert.x gRPC server for code.quarkus.io
#38867 - Bump to DB2 11.5.9.0
#38870 - Bump wildfly-elytron.version from 2.3.0.Final to 2.3.1.Final
#38871 - Upgrade codeblock dev ui lib to 1.0.12
#38885 - Notify manovotn about scheduler-related issues
#38896 - Remove checks that Elasticsearch dev service distribution/version matches Hibernate Search configuration
#38903 - Bump org.wiremock:wiremock-standalone from 3.4.0 to 3.4.1
#38906 - Bump io.fabric8:docker-maven-plugin from 0.43.4 to 0.44.0
#38912 - Bump org.mvnpm:echarts from 5.4.3 to 5.5.0
#38915 - Revert "Use new Vert.x gRPC server for code.quarkus.io"
#38917 - Extend Kafka integration tests to verify JKS and PEM handling
#38919 - ImageMetricsITCase.verifyImageMetrics failures in main
#38929 - QuarkusComponentTest: support parameterized test methods
#38933 - try it out in swagger configuration option
#38936 - Update native reflection configuration file best practices
#38937 - Option to warn about failures when loading workspace modules, instead of throwing errors
#38941 - Bump org.mvnpm:es-module-shims from 1.8.2 to 1.8.3
#38942 - Bump scala.version from 2.13.12 to 2.13.13
#38945 - Bump org.apache.logging.log4j:log4j-api from 2.22.1 to 2.23.0
#38946 - Bump io.quarkus.bot:build-reporter-maven-extension from 3.4.4 to 3.5.0
#38954 - Qute: introduce RenderedResults assert API for tests
#38956 - Add swagger try-it-out option
#38967 - Make standard endpoint names in OidcConfigurationMetadata public
#38972 - Bump elasticsearch-opensource-components.version from 8.12.1 to 8.12.2
#38974 - Bump org.jboss.resteasy.spring:resteasy-spring-web from 3.1.1.Final to 3.1.2.Final
#39002 - @Cache annotation not honored on reactive REST resource beans with separate interface
#39005 - Hibernate Reactive: don't make transaction-related beans as unremovable and fail on unconfigured datasource
#39007 - Add commons-compress to list of JOSDK/Fabric8 sensitive dependencies
#39009 - Narayana update to 7.0.1.Final
#39012 - Secure HTTP Permission exact paths both with/without ending path separator so that Jakarta REST endpoint paths are secured by default
#39013 - Bump kafka3.version from 3.6.1 to 3.7.0
#39014 - Bump com.google.cloud.tools:jib-core from 0.25.0 to 0.26.0
#39026 - Address increased build time RSS caused by certificate hot reload
#39030 - Fault Tolerance: add simple test for hot reload
#39035 - Make OIDC scope separator configurable to support multiple Strava scopes
#39044 - Fixes ImageMetricsTestCase
#39047 - Reactive pg datasource with enabled health check opens more connections than configured
#39050 - Add support for device flow grant type to oidc-client
#39051 - Add useful links about the run-java script
#39052 - Honor Cache and NoCache annotations on implementations of a JAX-RS interface
#39054 - Add support for device grant type to token request
#39056 - Increase JNI metrics values to account for (upcoming) 17.0.11+1 changes
#39058 - Update SmallRye Config to 3.6.0
#39060 - Revert "Fixes ImageMetricsTestCase"
#39065 - Bump maven-model-helper to 28
#39066 - Bump io.smallrye.config:smallrye-config-source-yaml from 3.5.4 to 3.6.0 in /devtools/gradle
#39071 - Bump hibernate-search.version from 7.1.0.CR1 to 7.1.0.Final
#39079 - Add simple form base app in security-authentication-mechanisms guide
#39081 - Remove remnants of dev-v1
#39086 - Fix test assertion
#39089 - Allow some test mojos to be resolved online
#39091 - Enhance client-side gRPC TLS configuration
#39106 - Allows the HTTP server to use PEM truststore
#39109 - Correctly forward websocket errors in DevUIJsonRPCTest
#39125 - Bump com.google.api.grpc:proto-google-common-protos from 2.34.0 to 2.36.0
#39132 - OIDC token propagation: add option to select named OIDC client and token exchange per REST client with the @AccessToken annotation
#39142 - Initial version of the new declarative WebSocket server API
#39150 - Update resteasy-reactive-migration.adoc
#39152 - Add debugging to resteasy / arc interactions
#39153 - WebSockets Next: make it possible to write a ping frame to the connection
#39154 - WebSockets Next: rename WebSocketServerConnection to WebSocketConnection
#39157 - WebSockets Next: add test for filtering connected clients while broadcasting
#39158 - Updates to Infinispan 15.0.0.CR1
#39159 - Big Quarkus REST rename
#39161 - Native quarkus-amazon-lambda-http -- runtime provided is no longer supported
#39162 - Add mapping to a Map<String, ConfigObject> in the documentation
#39163 - Update Runtime to provided.al2023 for amazon lambda http native
#39164 - Improve error message when the keystore/truststore type cannot be detected from the file extension
#39165 - Bump JUnit Pioneer to 2.2.0
#39166 - Move junit-pioneer to build-parent
#39171 - Bump io.quarkus.develocity:quarkus-project-develocity-extension from 1.0.5 to 1.0.6
#39172 - Bump org.eclipse.angus:angus-activation from 2.0.1 to 2.0.2
#39174 - Enable MP Telemetry TCK
#39178 - Update grpc-service-implementation.adoc
#39190 - Update kindcontainer to 1.4.5
#39192 - Make HTTP templates for observability work with subresources
#39193 - WebSockets Next: rename WebSocketServerConnection to WebSocketConnection
#39196 - Deprecate HyphenateEnumConverter
#39199 - Bump testcontainers.version from 1.19.6 to 1.19.7
#39200 - Bump org.jetbrains.dokka:dokka-maven-plugin from 1.9.10 to 1.9.20
#39202 - Bump grpc.version from 1.61.1 to 1.62.2
#39204 - Update partial extension names to include full extension names
#39206 - Improve graceful shutdown
#39207 - Export security events as OpenTelemetry Span Events
#39208 - Remove jdk*-workarounds from rest-client TCK
#39210 - Overriding quarkus.package.output-directory can cause random native build failures
#39211 - Bump Microsoft SQL Server JDBC driver to 12.6.1
#39212 - Bump mssql-jdbc to 12.6.1
#39213 - Ensure that regular jar is not created when a native binary is requested
#39214 - Improve logging for IO utils and add thread info in build logs
#39215 - No way to configure iat claim as optional in quarkus-oidc
#39216 - Unwrap processing exception from REST Client when returning a Uni
#39217 - Remove commented out code from ResteasyReactiveOutputStream
#39223 - Fix WithSpan uni and multi
#39225 - Upgrade to Mutiny 2.5.8
#39226 - WebSockets Next: test for filtering connected clients while broadcasting
#39227 - No SecurityScheme on OpenAPI when using openIdConnect and @PermissionsAllowed
#39232 - Update docs as Quarkus no longer defautling keystore type to JKS
#39236 - Resolve OIDC tenants with path-matching configuration as alternative to TenantResolver
#39239 - Bump org.apache.groovy:groovy from 4.0.18 to 4.0.19
#39243 - Detect .truststore and .keystore files as JKS
#39245 - dev-ui shows wrong property for rest-client
#39248 - WebSockets Next: attempt to fix/diagnose flaky tests [do not merge yet!]
#39249 - OIDC make token iat claim optional via config property
#39250 - Migrate from config classes to @ConfigMapping OIDC token propagation, OIDC GraphQL client and OIDC client filters
#39251 - Make mutiny version of pool use the already configured vertx pool
#39253 - Upgrade Smallrye Stork to 2.6.0
#39255 - Fix config key for dev-ui
#39257 - Quarkus 3.8.1: Use GraalVM sdk 23.1.2 over 23.0.1
#39259 - Add handling of the annotation @PermissionsAllowed on methods or class for OpenAPI
#39260 - Bump GraalVM SDK version to 23.1.2
#39261 - Support programmatically created OidcClients in custom OIDC Client filters
#39262 - Make it easy for custom OIDC filters to use programmaticatlly created OIDC Clients
#39264 - Escape entity name in Panache queries
#39265 - Properly support sending InputStream in REST Client
#39266 - ./mvnw --file $(pwd)/./pom.xml broken since quarkus 3.7.1
#39267 - Consolidate rerouted requests in access log
#39270 - Update the title of dev-ui.adoc
#39271 - Update the title of dev-ui.adoc and fix minor typos
#39275 - Bump jaxb-runtime.version from 4.0.4 to 4.0.5
#39276 - Bump org.mvnpm.at.mvnpm:vaadin-webcomponents from 24.3.5 to 24.3.7
#39279 - Renaming reactive messaging to Quarkus messaging
#39282 - Add missing headers configuration for InputStream handling
#39285 - Support sending Multi<io.vertx.mutiny.core.buffer.Buffer> in REST Client
#39287 - Enhance TLS certificate alias and SNI handling (HTTP & gRPC)
#39288 - WebSockets Next: ping/pong and callbacks API refactoring
#39289 - Validate that http and https are not on the same port
#39291 - Enable gRPC code generation to utilize argument file
#39301 - Rename SmallRye Reactive Messaging extensions to Messaging
#39303 - Update native configuration best practices for proxies
#39308 - Update SmallRye Config to 3.6.1
#39309 - Normalize POM path
#39311 - Be more consistent with extension names in datasource.adoc
#39312 - Refine extension search to allow searching on "rest"
#39316 - Empty container-group not allowed in Quarkus 3.8.2
#39317 - Update SmallRye GraphQL to 2.8.0
#39318 - Fail to deploy application when http and https ports are the same
#39319 - org.graalvm.js:js was renamed to org.graalvm.polyglot:js-community
#39320 - Quarkus OIDC Client: OidcRequestFilter is missing OIDC client name information
#39326 - Updates Infinispan to Protostream 5.0.1.Final
#39328 - Pass the client and tenant id to OIDC request filters
#39335 - Various small tweaks for the REST extensions
#39337 - Fix rest-client-mutiny mention in the docs
#39340 - Bump com.gradle:common-custom-user-data-maven-extension from 1.12.5 to 1.13
#39341 - Bump org.eclipse.jgit:org.eclipse.jgit from 6.8.0.202311291450-r to 6.9.0.202403050737-r
#39342 - Migrate Keycloak Admin Client from config classes to the @ConfigMapping
#39346 - Document the types of allowed large payloads in REST Client
#39349 - Update gitflow-incremental-builder to 4.5.3
#39353 - Allow config empty values in the Gradle worker
#39354 - Add note about pre-matching filters execution model
#39357 - Migrate Security WebAuth config classes to @ConfigMapping
#39366 - Update Kotlin to 1.9.23
#39370 - Do not return on exact match when searching extensions
#39373 - Add some guide metadata for REST extensions
#39377 - Small doc adjustments for the Mailer guides
#39378 - Do not skip docs for snapshot deployment
#39379 - Bump org.apache.commons:commons-compress from 1.26.0 to 1.26.1
#39380 - Bump apicurio-registry.version from 2.5.8.Final to 2.5.9.Final
#39381 - Bump io.micrometer:micrometer-bom from 1.12.3 to 1.12.4
#39383 - Typo at OIDC Client Mutual TLS config properties