3.2.9.Final

Complete changelog

• #37154 - Doc enhancements to the security architecture guide
• #37150 - Remove security guides we are no longer publishing for 3.2 product docs
• #37146 - 3.2.9 backports 3
• #37135 - Properly handle authority-pseudo header in the ForwardedParser
• #37121 - Docs - Add missing steps to Basic authentication how-to
• #37082 - 3.2.9 backports 2
• #37077 - Handle duplicated context in the CacheResultInterceptor
• #37070 - Security doc fix: Broken link and bad code snippet
• #37056 - [3.2] Set all discovered quarkus.* properties as system properties in QuarkusWorker
• #37045 - Regression with ForwardedParser setting an empty host header
• #37031 - Update artifact ids for dependencies in Blaze-Persistence documentation for Quarkus 3 integration
• #37021 - Gradle: set all discovered quarkus.* properties as system properties in QuarkusWorker
• #36995 - Improve response filter documentation
• #36992 - quarkus.container-image.push=true not working in 3.2.8
• #36969 - -Dquarkus.container-image.push=true used with gradle seems not to push anymore since 3.5.1
• #36955 - @ServerResponseFilter with Throwable parameter is not called when REST resource is throwing an exception
• #36927 - Fix grammar error in OIDC and Bootstrap JavaDocs
• #36883 - Keycloak DevService: Improve error messages and documentation
• #35835 - Blaze documentation outdated for Quarkus 3

3.5.2

Complete changelog

• #37120 - Bump Smallrye RM from 4.10.1 to 4.10.2
• #37104 - Make analytics tests more a bit more resilient
• #37090 - Add the actual coordinates of the MySQL driver
• #37070 - Security doc fix: Broken link and bad code snippet
• #37069 - Tiny tweaks based on QE feedback for Datasource guide
• #37068 - Updates infinispan client intelligence section
• #37058 - Bump com.fasterxml.jackson:jackson-bom from 2.15.2 to 2.15.3
• #37055 - Bump io.smallrye.config:smallrye-config-source-yaml from 3.4.1 to 3.4.4 in /devtools/gradle
• #37038 - Disable CustomManifestArgumentsTest on Windows
• #37032 - OpenAPI make sure basic auth auto detection work
• #37028 - Fix typos in reactive-sql-clients.adoc
• #37025 - Document how to log authentication failures for RESTEasy Reactive users migrating from the RESTEasy Classic
• #37019 - Address CVE-2023-21971 present in MySQL connector
• #37018 - Address CVE-2023-21971 present in MySQL connector
• #37015 - Bump org.eclipse.parsson:parsson from 1.1.4 to 1.1.5
• #37010 - Fix vale errors and some warnings in the OIDC Configuration Properties reference guide
• #37006 - Never register server specific providers in REST Client (fixed)
• #37003 - Small adjustments for documentation related content
• #37001 - Revert "Unblock SmallRye Health exposed routes"
• #36991 - Upgrade es-module-shims to 1.8.1
• #36985 - Generate a file with relations between guides
• #36983 - Fix discarded ObjectMapper configuration
• #36981 - Updates to Infinispan 14.0.20.Final
• #36968 - Send host.name in all spans
• #36953 - Workaround #36952 alias jboss/jboss-parent-pom#236 jboss-parent:40 still manages jdk-misc, but does not define version.jdk-misc anymore
• #36942 - Option TraceServiceLoaderFeature removed in GraalVM 23.1
• #36941 - Fix OTel Resource Attributes
• #36924 - Add keywords and topics for hibernate-search-orm-elasticsearch.adoc
• #36917 - Update SmallRye Config to 3.4.4
• #36914 - Reset databases/users for each Hibernate ORM tenancy test module
• #36912 - Avoid @TempDir in RestClientCDIDelegateBuilderTest
• #36884 - SmallRye Config property mapping mismatches from the property name in the generated config documentation
• #36868 - Native binary generated using quarkus, graalvm and picocli trying to read from .env folder in working directory
• #36856 - Lowercase env vars with hyphens are no picked up anymore in Quarkus 3.5.0 (e.g. in docker compose or Hashicorp Nomad)
• #36850 - ObjectMapper configuration is discarded in resteasy-reactive-jackson's JsonFactory
• #36847 - SmallRye Config error message suggests strange enum values when a bad value is passed
• #36753 - Fix order of defaults recording
• #36742 - DevUI resource error on main
• #36711 - Disable Http2RSTFloodProtectionTest on Windows
• #36578 - Maven CLI: add startWith matching into recipes detection
• #36573 - Maven CLI: add wildcard matching into recipes detection
• #36570 - Maven CLI: use recipes for platform extensions
• #36568 - Maven CLI: use recipes for platform extensions
• #36129 - auto-service-loader-registration fails with GraalVM CE 21+35.1
• #32049 - resteasy-reactive Interceptors don't get executed after Authorization failure
• #31024 - Resteasy Reactive client tries to use ContainerResponseFilter

3.6.0.CR1

Major changes

• #36935 - Support for dynamic OIDC JWK set resolution
• #36874 - Move HTTP Permissions and Roles policies from build-time to runtime
• #36781 - Added Discord as well-known OIDC provider
• #36728 - JPA Security: allow pointing to a named persistence unit
• #36634 - Introduce OidcRequestFilter
• #36631 - Make it possible to acquire OIDC SecurityIdentity after HTTP request has completed
• #36602 - Move quarkus-jaeger and quarkus-smallrye-opentracing to Quarkiverse
• #36375 - OIDC client integration for GraphQL clients

Complete changelog

• #37088 - Security doc fix: Fix links in Protect a web application topic
• #37071 - RESTEasy Qute integration: add dependency conditions
• #37066 - Add label area/native-image to issues mentioning mandrel
• #37063 - Make testLambdaCapturing test conditional on GraalVM version
• #37060 - Bump io.smallrye.reactive:mutiny from 2.2.0 to 2.5.1
• #37051 - Use dynamically resolved Java version when creating Gradle projects
• #37047 - Quarkus CLI doesn't honor --java=21 for gradle projects
• #37039 - Add endpoints page in Dev UI
• #37037 - [GraalVM 24.0] RegisterForReflectionITCase.testLambdaCapturing from integration-tests/main fails with quarkus main branch
• #37036 - Use empty string in Sse event when there is no data
• #37033 - Sse difference in empty event between non-reactive and reactive output
• #37030 - Fix HttpSecurityProcessor compilation by importing Singleton
• #37022 - Make basic realm and form authentication configuration properties only used during runtime the runtime properties
• #37020 - Fix vale errors and warnings in the OpenID Connect (OIDC) and OAuth2 Client and Filters Reference Guide
• #37017 - Allow to create named HTTP Security policies referenced in the application.properties path matching rules as CDI beans
• #37009 - Revert "Make Dependabot group micro updates"
• #37005 - Qute: allow extensions to register additional template roots
• #36999 - Build cache - Upload quarkus-ide-launcher-999-SNAPSHOT.jar
• #36989 - Adds download topology as PNG file
• #36970 - Build cache - Make sure there is a new line before EOF
• #36965 - Dev UI Fix Reactive messaging screen
• #36956 - Better handle multi-line outputs in develocity-publish-build-scans.yml
• #36950 - Remove jakarta.ejb-api from narayana-jta extension
• #36944 - Bump wildfly-common version to 1.7.0.Final
• #36939 - Redis vector fields and arguments
• #36935 - Support for dynamic OIDC JWK set resolution
• #36930 - Ability to generate gRPC descriptor set
• #36926 - Make Dependabot group micro updates
• #36921 - Qute: consider synthetic parameter declarations during validation
• #36915 - Rename OidcClientRequestFilter filter to OidcRequestFilter
• #36912 - Avoid @TempDir in RestClientCDIDelegateBuilderTest
• #36910 - Use proper exception when media type handling is incorrect
• #36909 - Bump org.eclipse.jgit:org.eclipse.jgit from 6.6.1.202309021850-r to 6.7.0.202309050840-r
• #36908 - Bump com.google.api.grpc:proto-google-common-protos from 2.27.0 to 2.28.0
• #36903 - Bump org.junit:junit-bom from 5.10.0 to 5.10.1 in /devtools/gradle
• #36900 - Devservice for amqp can't load channels on dev ui
• #36897 - Unable to generate gRPC descriptor set
• #36888 - Fix dev-ui double contruction of Web Components
• #36882 - Quarkus JTA has not needed Dependency to ejb-api
• #36874 - Move HTTP Permissions and Roles policies from build-time to runtime
• #36873 - Register server exception mapper method of the Rest-Interface implementation class
• #36872 - Server exception mapper method of the Rest-Interface implementation class is not registered for resource defined in the interface.
• #36871 - Adds Pattern support to Kafka Streams Topology Dev UI
• #36859 - Include removed dependencies in the ApplicationModel
• #36842 - Update Revved up by Develocity badge
• #36824 - Fix codestarts snapshots
• #36818 - Add SPA Form Based Authentication instructions
• #36817 - ModuleBuildDurationReport: Fix help message for sort
• #36809 - Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.13.0
• #36799 - Skip non-existing directory when watching for changes
• #36798 - Unexpected content-type can cause two different exceptions depending on the jax-rs resource
• #36796 - DevUI Router loads WebComponents twice when it's already loaded
• #36791 - Bump org.jetbrains.kotlin:kotlin-gradle-plugin-api from 1.8.10 to 1.9.20 in /devtools/gradle
• #36789 - OpenTracing to OpenTelemetry Tutorial
• #36781 - Added Discord as well-known OIDC provider
• #36760 - Add a reminder to check for 8080 port uses to FAQ
• #36759 - Security JPA: support Hibernate multitenancy
• #36755 - Bump commons-io:commons-io from 2.13.0 to 2.15.0
• #36752 - If the node name is longer than 28 bytes, shorten it with SHA-224
• #36748 - Validate Startup observers are not secured with RBAC annotations
• #36745 - Qute: dev mode - add config to skip restart for some templates
• #36733 - Bump jaxb-runtime.version from 4.0.3 to 4.0.4
• #36729 - Bump com.google.guava:guava from 32.1.2-jre to 32.1.3-jre
• #36728 - JPA Security: allow pointing to a named persistence unit
• #36725 - Recommend GraalVM CE in the documentation
• #36724 - Update virtual thread documentation to Java 21
• #36723 - Fix various mistakes in gRPC guides
• #36718 - Add a description to the Stork extension metadata
• #36711 - Disable Http2RSTFloodProtectionTest on Windows
• #36706 - Kafka Streams Dev UI migration to v2
• #36704 - Add use layer 7 proxy for reactive pg client
• #36703 - Bump io.micrometer:micrometer-bom from 1.11.1 to 1.11.5
• #36702 - Bump flyway.version from 9.22.2 to 9.22.3
• #36701 - Bump el...

3.5.1

Complete changelog

• #36920 - Fix OIDC scope to permission mapping when scope is empty
• #36911 - OIDC "Permission must not be empty" with imported test realm since 3.5.0
• #36907 - Bump resteasy.version from 6.2.5.Final to 6.2.6.Final
• #36906 - [Docs] security-oidc-auth0-tutorial.adoc improvements
• #36901 - Fix formatting in the datasource docs
• #36895 - Docs: fix formatting of code snippet in the Micrometer tutorial
• #36889 - Build cache - Also exclude .cache for Spotless
• #36887 - Qute: fix validation of array index-based expressions
• #36885 - Handle generic types for ParamConverter in REST Client
• #36883 - Keycloak DevService: Improve error messages and documentation
• #36857 - Fix OIDC key resolver to accept SHA256 certificate thumbprints
• #36855 - OIDC key resolver fails to recognize an x5t#S256 thumbprint
• #36841 - TransactionalUniAsserterTest: test that injected argument is used
• #36830 - Reformat source code block title
• #36803 - Gradle plugin: use full URI for configuration source locations
• #36800 - Quarkus code-gen (Gradle): Fix behavior to filter unavailable services
• #36793 - Add jvmArgs option to Quarkus Gradle plugin task quarkusRun
• #36787 - Fix dead link in reactive-sql-clients.adoc
• #36776 - Exclude resteasy-client from lra-proxy-api in narayana-lra extension
• #36770 - Keycloak Admin Client Reactive: Fix typo that allows users to customize ObjectMapper
• #36767 - Gradle build does not work when an "application.properties" exists at the root of the project
• #36751 - Fix typo in reactive-event-bus.adoc
• #36741 - Fix sockjs documentation
• #36720 - Update OpenSearch container test configuration
• #36719 - Remove type from ResolverMapKey
• #36716 - Cannot build project with quarkus-cxf extension and custom ConfigSourceFactory: Provider not found
• #36713 - Ignore bridge methods and improve error message in @Embeddable annotation checks
• #36710 - Raise FileSystemWatcherTestCase wait times
• #36689 - Try to stabilize PausedSchedulerTest
• #36677 - OpenAPI.yaml with recursion
• #36663 - Disable VertxMDCTest on Windows
• #36646 - OpenAPI support to register schema for a type from 3rd party lib
• #36639 - RESTEasy Reactive does not call method ParamConverter#toString for collection elements
• #36638 - Codestarts: Add Entity annotation to Kotlin all-open
• #36637 - Deprecate the scala extension
• #36629 - Remove the pinned event example from the documentation
• #36609 - Add a custom OIDC identity provider test
• #36599 - TransactionalUniAsserter never fails with Hibernate Reactive
• #36598 - Use MongoDB 4.4 consistently
• #36596 - Fix version reporting and parsing
• #36593 - Allow for setting logging body limit programmatically
• #36582 - Unit test always succeeds in combination with hibernate-reactive & panache
• #36572 - Fix typos and a forgot backtick in the doc files
• #36571 - Fix the mailer connection pool when multiple mailers are used
• #36567 - @MailerName not working with different SMTP servers
• #36561 - Add auth mechanism to the Liquibase MongoDB connection string
• #36547 - Qute: make it possible to init a new EngineBuilder from an Engine
• #36546 - Fix URL for Dev UI es-shims
• #36542 - SmallRye GraphQL 2.5.1
• #36540 - Upgrade H2 to version 2.2.224
• #36538 - OTel flush timeout
• #36537 - Reset the Apicurio registry client in dev mode and tests
• #36514 - SmallRye OpenAPI 3.7.0 and Tests to check content type between Services and OpenAPI
• #36469 - oidc-client-graphql tests are failing with NPE
• #36450 - Don't emit null values from SSE
• #36435 - Bump Gradle version to 8.4
• #36434 - Unblock SmallRye Health exposed routes
• #36421 - Quarkus 3.4.x - Build failure: java.lang.Object is used as an embeddable but does not have an @Embeddable annotation
• #36297 - SmallRye OpenAPI 3.6.2 changes contract for post/put/delete/patch when consumes/produces content type is not defined
• #36067 - @ClientObjectMapper should run only once
• #35996 - Make Maven ITs less fragile
• #35666 - Quarkus Liquibase-MongoDB Extension is ignoring auth-mechanism and auth-mechanism-properties
• #35099 - Use a non-blocking handler for SmallRye Health Status
• #26557 - Continuous Testing with Apicurio DevService

3.2.8.Final

Complete changelog

• #36916 - Tiny grammar tweaks for the Authorization of web endpoints guide
• #36869 - Produce a 503 response when there no more worker threads to handle blocking requests
• #36860 - Exhausted thread pool returns error 500 instead of 503 status code
• #36852 - Remove erroneous preview status from cache doc
• #36837 - Tiny Vale tweaks for Datasource and Logging guide
• #36835 - Duplicate Authorization Bearer Header Fix
• #36833 - More reliable test setup in integration-tests/hibernate-orm-tenancy/datasource
• #36816 - Fixing Db2 Driver typo
• #36814 - Documentation not correct : https://quarkus.io/guides/datasource#configure-a-jdbc-datasource (DB2 driver)
• #36810 - AccessTokenRequestReactiveFilter::propagateToken duplicates the authorization header
• #36802 - Fix assertions in Hibernate ORM 5.6 compatibility tests
• #36794 - hibernate-orm-compatibility-5.6 tests are failing on CompatibilityTest.offsetTime
• #36788 - Fix dead link in infinispan-client-reference.adoc
• #36705 - Bump Keycloak version to 22.0.5
• #36682 - Vert.x: fix NPE in ForwardedProxyHandler
• #36668 - Fix quarkus update regression on extensions
• #36664 - Take @ConstrainedTo into account for interceptors
• #36656 - TrustedXForwarderProxiesUnknownHostnameFailureTest failing on Windows
• #36651 - Dev UI: Fix height in Rest Client
• #36645 - QuarkusSecurityTestExtension afterEach call should not be made for tests without @TestSecurity
• #36628 - Make the ZSTD Substitutions more robust
• #36620 - Dev UI Rest Client Page has additional scroll bar
• #36605 - Fix handling of HTTP/2 H2 empty frames in Resteasy Reactive
• #36604 - Fix handling of HTTP/2 H2 empty frames in Resteasy Reactive
• #36601 - QuarkusSecurityTestExtension should not call CDI.current() when annotation is not present.
• #36566 - Fix deployer detection in quarkus-maven-plugin
• #36556 - ArC: fix PreDestroy callback support for decorators
• #36545 - @PostConstruct and @PreDestroy support on @Decorator classes
• #36544 - Update Vert.x version to 4.4.6
• #36501 - Let custom OIDC token propagation filters customize the exchange status
• #36459 - Let custom OIDC token propagation filters provide client name
• #36453 - Upgrade Oracle JDBC driver to 23.3.0.23.09
• #36436 - Upgrade to Hibernate ORM 6.2.13.Final
• #36420 - Allow parallel execution of blocking health checks
• #36419 - Blocking Health Checks should be executed in parallel, not sequentially/ordered
• #36408 - Ensure that SSE builder works in native
• #36406 - AssembleDownstreamDocumentation - print guide name
• #36403 - IBM Db2 - Register resource bundle classes for reflection
• #36402 - Native Picocli build breaks SSE client
• #36399 - quarkus-jdbc-db2: resource bundle missing
• #36382 - redis-cache blocks the eventloop
• #36377 - Allow @ClientHeaderParam to override User-Agent
• #36371 - Fix issue in Java migration in dev-mode
• #36351 - Properly handle invalid response body errors in Reactive REST Client
• #36333 - Prepare for ORM update
• #36329 - Custom User-Agent header ignored
• #36325 - Selection of the deployer doesn't work as expected
• #36311 - Upgrade: Hibernate ORM 6.2.11.Final and Reactive 2.0.6.Final
• #36299 - quarkus-flyway: Java-Migration does not get picked up on live reload
• #36290 - Fixed URL for configuring JSON support
• #36261 - Upgrade to Hibernate Search 6.2.2.Final
• #36257 - Rest client call hangs when receiving an invalid chunked response and does not release resources (e.g. Bulkhead semaphore)
• #36234 - NullPointerException for request with empty Host header
• #36223 - Fix Liquibase on Windows 11
• #36179 - Update to the JDBCStore section of the Transaction guide
• #36160 - Improve handling of broken accept headers in MediaTypeHeaderDelegate
• #36159 - Resteasy Reactive incorrectly handles broken accept header
• #36144 - PG Reactive Client: Cannot create Money value in Range (-1.00, 0.00)
• #36143 - Fix Authorization of Web Endpoints link
• #36119 - quarkus-redis need newer vertx-redis-client to fix connection pool issue
• #36062 - Don't register subresource for reflection based on their use as a return type
• #36050 - Quarkus 3.3.3 - injecting UserTransaction generates Jandex warnings on startup
• #36025 - Don't use RuntimeDelegate in ResponseHandler
• #36024 - ClassCastException with RESTEasy reactive and a Jersey client
• #35990 - Don't ignore empty SSE events in client
• #35987 - Improve the way HTTP authorizer logs exceptions
• #35975 - OIDC: AuthenticationRedirectionException after successful login
• #35966 - SSE: Reactive SseEventSource client doesn't consume empty events
• #35959 - Log invalid CORS origin and method
• #35958 - [GraalVM 24.0] Hibernate ORM elasticsearch native integration tests fail with return type mismatch
• #35956 - Fix return type of hibernate-search substitution
• #35938 - Bump org.apache.commons:commons-compress from 1.23.0 to 1.24.0 in /bom/application
• #35937 - Bump org.apache.commons:commons-compress from 1.23.0 to 1.24.0 in /independent-projects/tools
• #35914 - Prevent recording configuration coming from Gradle
• #35910 - Add logic to load yaml recipes based on the extension
• #35899 - Add note about unsupported @Lock in Spring Data JPA
• #35888 - Restore missing parameters in OIDC Dev UI client cred and password SwaggerUI/GraphQL handlers
• #35876 - More hierarchical classes are not picked up as global interceptors
• #35858 - NullPointerException when entity primary key has the type byte[]
• #35846 - Fixes aggregation of configurations with two different executions ids
• #35844 - Improve description of the duration format in configuration documentatio...

3.5.0

Complete changelog

• #36527 - Start MongoDB 4.4 instead of 4.0
• #36523 - Minor OIDC Auth0 updates
• #36518 - Allow for setting logging scope programmatically
• #36517 - Use Mandrel 23.1 in windows CI
• #36501 - Let custom OIDC token propagation filters customize the exchange status
• #36495 - Support external OTel exporters in CDI
• #36490 - Take ReaderInterceptor into account when reading SSE events
• #36487 - Upgrade to Liquibase 4.24.0
• #36485 - Fix typo in gradle-tooling.adoc
• #36474 - Fix some issues in getting-started-dev-services
• #36465 - Be more consistent in guides when creating projects/adding extensions
• #36464 - HTTP reference guide - HTTP/2 section update, drop JDK 8 note
• #36459 - Let custom OIDC token propagation filters provide client name
• #36457 - Update builder images to jdk-21
• #36453 - Upgrade Oracle JDBC driver to 23.3.0.23.09
• #36452 - Fix doc extension-add.adoc
• #36451 - Adjust extension name for consistency with rest of Quarkus
• #36446 - Regression: Liquibase fails to migrate on Quarkus start, crashing the application
• #36445 - Updates to Infinispan 14.0.19.Final
• #36442 - Use default content type when X-SSE header not set
• #36436 - Upgrade to Hibernate ORM 6.2.13.Final
• #36432 - Hibernate Reactive Panache: improve error message
• #36420 - Allow parallel execution of blocking health checks
• #36419 - Blocking Health Checks should be executed in parallel, not sequentially/ordered
• #36417 - Reduce timeout of the doc build to 60 minutes
• #36413 - Simplify virtual threads guide by pushing users to 21
• #36412 - Drop Optaplanner from the documentation
• #36411 - Drop panache topic from Hibernate Reactive guide
• #36410 - Add compatibility topic to Spring guides
• #36407 - Register RuntimeOverrideConfigSource in STATIC_INIT
• #36406 - AssembleDownstreamDocumentation - print guide name
• #36400 - Add topics and extensions metadata to guides
• #36367 - Bump org.wiremock:wiremock-standalone from 3.1.0 to 3.2.0
• #36365 - Bump de.flapdoodle.embed:de.flapdoodle.embed.mongo from 4.7.0 to 4.9.2
• #36360 - Drop the old Dev UI guide
• #36337 - Upgrade maven to version 3.9.5
• #36236 - No Panache session in REST endpoints defined by an interface
• #35931 - Add OIDC Auth0 extended tutorial
• #33548 - Pick random debug port when the configured one is taken
• #33363 - allow quarkus dev to pick random debug port

3.2.7.Final

Complete changelog

• #36274 - Fix title of upx.adoc
• #36069 - Remove update guide from docs yml
• #35988 - Enhancements to Configuration section of the Logging guide
• #35885 - Applying the QE feedback for the Logging guide
• #35849 - Doc link fixes & enhancements to Bearer token authentication tutorial
• #35843 - Additional review and application of QE feedback to the Datasource guide
• #35819 - Remove 'Security vulnerability detection' topic from downstream doc list
• #35771 - Adding the JUL URL to the Logging guide update
• #35633 - Make hibernate reactive status clear in docs
• #35630 - Fix doc link asciidoc change link to xref where applicable
• #35618 - Config doc - Avoid processing methods if not @ConfigMapping
• #35594 - Openshift deployment config properties all start with get-/is-

2.16.12.Final

Complete changelog

• #36431 - Add a test case verifying the RST flood protection
• #36390 - Update Netty to 4.1.100
• #36241 - Update Snappy to version 1.1.10.5
• #36221 - Bump org.apache.avro:avro from 1.11.2 to 1.11.3 in /bom/application
• #35968 - Warn when wrong token proxy is accessed
• #35964 - OIDC: NPE when accessing IdToken when Bearer access token is sent

3.4.3

Complete changelog

• #36408 - Ensure that SSE builder works in native
• #36404 - Do not exclude properties from recording that are available in sources that should always be included
• #36403 - IBM Db2 - Register resource bundle classes for reflection
• #36402 - Native Picocli build breaks SSE client
• #36399 - quarkus-jdbc-db2: resource bundle missing
• #36377 - Allow @ClientHeaderParam to override User-Agent
• #36371 - Fix issue in Java migration in dev-mode
• #36351 - Properly handle invalid response body errors in Reactive REST Client
• #36329 - Custom User-Agent header ignored
• #36326 - Cannot load fixed or default YAML configuration when running native build
• #36302 - Fix headers and preambles in all guides and reintroduce some keywords
• #36299 - quarkus-flyway: Java-Migration does not get picked up on live reload
• #36290 - Fixed URL for configuring JSON support
• #36257 - Rest client call hangs when receiving an invalid chunked response and does not release resources (e.g. Bulkhead semaphore)
• #36147 - Bump org.eclipse.parsson:parsson from 1.1.2 to 1.1.4
• #36096 - Build cache - Use notCacheableBecause instead of storeEnabled
• #35929 - Do not store build cache for core extensions having config
• #35927 - Build cache - Core extensions containing config shouldn't be cached
• #35769 - Default response content type using GraphQL spec

3.5.0.CR1

Major changes

• #36268 - Add OIDC Mastodon provider
• #36175 - Introduce OIDC Database Token State Manager extension
• #36164 - Support Java 21 main launch protocol
• #35923 - Map OIDC scope attribute to the SecurityIdentity permissions
• #35610 - Change decompiler from quiltflower to vineflower
• #33790 - Allow Hibernate Reactive to coexist with Agroal (and thus Flyway and Liquibase)

Complete changelog

• #36393 - Remove "coming soon" about CLI in tooling.adoc
• #36386 - Fixes PatternSyntaxException:Unclosed group near index 34
• #36385 - Fix jakarta.el.ELException: Function 'match' not found
• #36384 - Add gradle deps example to unblock downstream docs build
• #36377 - Allow @ClientHeaderParam to override User-Agent
• #36371 - Fix issue in Java migration in dev-mode
• #36369 - List specific guides about virtual threads
• #36366 - OIDC Db Token State Manager - disable MSSQL test due to limited Github CI resources and cancel timer on shutdown
• #36362 - Explain how to deal with Rate Limiting in the OIDC providers doc
• #36361 - Check semicolon during the OIDC scope to permission conversion
• #36354 - Allow ORM dependencies in mavenLocal for Gradle tests
• #36351 - Properly handle invalid response body errors in Reactive REST Client
• #36349 - PRs involving Doc updates are failing
• #36348 - Smallrye GraphQL 2.5.0
• #36347 - Kafka serde discovery generates serializer for dead letter queue failure strategy
• #36333 - Prepare for ORM update
• #36332 - Bump com.google.cloud.tools:jib-core from 0.24.0 to 0.25.0
• #36331 - Bump org.bouncycastle:bctls-fips from 1.0.16 to 1.0.17
• #36329 - Custom User-Agent header ignored
• #36322 - Do not warn on static init about clearly build-related properties being set in environment variables
• #36321 - Upgrade vaadin to 24.1.10
• #36318 - Bump elasticsearch-opensource-components.version from 8.10.1 to 8.10.2
• #36317 - Bump com.amazonaws:aws-lambda-java-events from 3.11.2 to 3.11.3
• #36315 - Bump org.junit.jupiter:junit-jupiter from 5.9.3 to 5.10.0
• #36314 - Bump com.gradle.enterprise from 3.15 to 3.15.1 in /devtools/gradle
• #36313 - OIDC scope to permission conversion does not initialize StringPermission actions
• #36311 - Upgrade: Hibernate ORM 6.2.11.Final and Reactive 2.0.6.Final
• #36309 - Use consistent versions of Maven for Maven wrapper and mvnd
• #36307 - Add support for Google Application Default Credentials
• #36306 - Natively support Google Application Default Credentials in the container-image-jib extension
• #36302 - Fix headers and preambles in all guides and reintroduce some keywords
• #36299 - quarkus-flyway: Java-Migration does not get picked up on live reload
• #36293 - Use correct quotes
• #36291 - Warning "Build time property cannot be changed at runtime: quarkus.native.builder-image.pull"
• #36290 - Fixed URL for configuring JSON support
• #36286 - Add the secrets keyword in the .env section in the reference docs
• #36281 - Config: detect injected config value mismatch during static init
• #36280 - Enable OracleOpenTelemetryJdbcInstrumentationTest
• #36279 - Update SmallRye OpenAPI to 3.6.2
• #36275 - Fix OIDC Mastodon image name typo
• #36271 - Support for AddingSpanAttributes
• #36268 - Add OIDC Mastodon provider
• #36267 - Work around missing GraalVM internal version starting with JDK 22
• #36262 - Fix gRPC compilation command line
• #36260 - Fix GraalVM.Version#getVersionAsString
• #36259 - Upgrade MSSQL Docker image
• #36257 - Rest client call hangs when receiving an invalid chunked response and does not release resources (e.g. Bulkhead semaphore)
• #36253 - Enums are not correctly documented in Open API / Swagger UI in Quarkus 3.X
• #36252 - Bump io.smallrye.config:smallrye-config-source-yaml from 3.3.4 to 3.4.1 in /devtools/gradle
• #36249 - Update crazy-max/ghaction-import-gpg from v5 to v6
• #36247 - Use text/plain instead of incorrect plain/text
• #36246 - Quarkus main fails to parse GraalVM version starting with GraalVM for JDK 22
• #36245 - integration-tests/grpc-external-proto-test generate-code step fails to generate Java classes from proto files
• #36244 - Replace StringBuffer with StringBuilder in RR code
• #36240 - Improve Virtual Threads integration tests
• #36238 - Optionally run Gradle build + ITs using different JDK
• #36235 - Allow configuring MongoDB client UUID representation
• #36233 - Add virtual threads entry to the bot
• #36232 - Update the AMQP Dev Service image
• #36210 - Allow for customization of a MongoDB Connection String properties
• #36206 - Bump Smallrye RM version from 4.9.0 to 4.10.1
• #36203 - Remove dumping the stack trace in the EventStreamFacade
• #36202 - Ignore the module-info from the application in dev mode
• #36198 - OpenAPI different default content type for pojo return and primitives
• #36195 - Make the name of the configuration adoc file configurable
• #36193 - Document the need for a case sensitive FS
• #36190 - AMQP-Devservices: quay.io/artemiscloud/activemq-artemis-broker:1.0.22 does not start
• #36189 - Make the name of the configuration adoc file configurable
• #36188 - OpenAPI: renamed test classes
• #36185 - Upgrade to Mutiny 2.5.1
• #36183 - Fail smallrye-jwt build if @Claim types are injected without ClaimValue in ApplicationScoped beans
• #36182 - Bump SmallRye JWT version to 4.3.1
• #36175 - Introduce OIDC Database Token State Manager extension
• #36173 - Introduce a -Dclean-cache flag
• #36165 - Update gitflow-incremental-builder to 4.5.1
• #36164 - Support Java 21 main launch protocol
• #36154 - Quarkus and Java 21 Instanc...