What quarkusio/quarkus shipped
Written by FoxPlug from the repository's own releases; not affiliated with Quarkus. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/quarkusio/quarkus; Quarkus did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Added GraalVM dynamic bootstraps registration so Gizmo 2 users can generate optimized lambdas and other indy and condy based optimizations. Pull request #53378
- Landed the first service start and stop infrastructure, converting representative extensions including logging to the new service model. Pull request #55264
- Fixed multi field PanacheQL updates in MongoDB with Panache, which had been failing since a change in 3.37.0. Pull request #57262
- Fixed a Dev UI websocket NullPointerException raised during hot reload when the JSON RPC codec was not yet initialized. Pull request #57313
- Set OTel tracing to 100 percent in tests following extension owner feedback. Pull request #57181
- Created the OIDC Redis token state manager bean without a recorder by moving the creator into an ArC BeanCreator in the runtime module. Pull request #57205
- Included the Jackson 3 DOM handlers in native images only when a DOM type is reachable. Pull request #55998
- Fixed a bug and a race with service to recorder bridging, including Optional services not being stored and the interim service value map being updated too late. Pull request #57306
- Cleared Hibernate Reactive session caches on shutdown so static OpenedSessionsState no longer retains SessionFactory proxies across QuarkusTest restarts. Pull request #57118
- Documented how to open Dev UI through another host name using the quarkus.dev-ui.hosts option. Pull request #56710
Why it matters
This week brought the first piece of service start and stop infrastructure, a change that touches how extensions initialize and stop, alongside fixes to MongoDB Panache updates, Dev UI hot reload, and Hibernate Reactive test restarts. Dependency updates also landed for Vert.x, Netty, Elytron, sshd, snappy-java and several others, some addressing published vulnerabilities. Together these improve stability during development and testing while keeping the platform current.
Changelog entry
- GraalVM dynamic bootstraps registration added for Gizmo 2 optimizations. Pull request #53378
- Service start and stop infrastructure introduced with extensions converted to services. Pull request #55264
- Multi field PanacheQL updates fixed in MongoDB with Panache. Pull request #57262
- Dev UI websocket NullPointerException during hot reload fixed. Pull request #57313
- Bugs and a race condition fixed in service to recorder bridging. Pull request #57306
- Hibernate Reactive session caches now cleared on shutdown. Pull request #57118
- Jackson 3 DOM handlers included in native images only when a DOM type is reachable. Pull request #55998
- OIDC Redis token state manager bean created without a recorder. Pull request #57205
- Documented how to open Dev UI through another host name. Pull request #56710
- Added missing guide links to the metadata of 19 extensions. Pull request #56880
- Vert.x updated to 4.5.35 and Netty to 4.1.139.Final. Pull request #57256
- Elytron updated to 2.9.4, fixing a published vulnerability. Pull request #57211
Service start/stop infrastructure has landed, with logging and other extensions converted. Also fixed: MongoDB Panache multi-field updates, Dev UI hot reload NPE, Hibernate Reactive cache clearing on shutdown. Dependency updates for Vert.x, Netty, Elytron and sshd.
This week in Quarkus: the first service start and stop infrastructure landed, converting logging and representative extensions to the new model. Fixes include multi-field PanacheQL updates in MongoDB with Panache, a Dev UI websocket NullPointerException during hot reload, and Hibernate Reactive session caches not being cleared on shutdown. GraalVM dynamic bootstraps registration was added for Gizmo 2 users. On the dependency side, Vert.x, Netty, Elytron, sshd, snappy-java and other libraries were updated, with some changes addressing published vulnerabilities. Documentation gained guidance on opening Dev UI through another host name and missing guide links were added to the metadata of 19 extensions.
Week of September 28, 2026
What shipped
- Quarkus 4.0.0.Beta1 released with Jackson 3, Java 21 minimum, UBI 10 support, Micrometer Observation API, SPIFFE client extension, and native transport rework. Release
- Quarkus 3.40.1 released with fixes for Redis CacheResult concurrency issues and Java 25 native build problems. Release
- Quarkus 3.40.0 released with CycloneDX documentation enhancements and Scalpel 0.4.2 update. Release
- REST Client response entities are now properly closed when clients disconnect prematurely, preventing connection leaks. Pull request #57060
- The cache extension is split into a lightweight API module and full extension following the scheduler-api pattern. Pull request #56543
- Quarkus Data now supports cursor-based pagination via Hibernate Reactive 5.0.0.Beta1's getReactiveKeyedResultList(). Pull request #57027
- Kubernetes Client upgraded to 8.0.0 with Jackson 3 and Dekorate upgraded to 5.0.0 for compatibility. Pull request #56982
- WebSockets Next now reports correct close reasons when connections are closed abruptly. Pull request #57113
- OIDC protected resource metadata responses now include Content-Type: application/json header per RFC 9728. Pull request #57094
- HTTP header collection is now supported via MultivaluedMap in REST endpoints alongside query parameters. Pull request #56985
Why it matters
Three stable releases ship this week including the major 4.0.0.Beta1 with Jackson 3 and Java 21 requirements. Infrastructure improvements fix resource leaks in REST clients, split the cache extension into API and implementation modules, and add cursor-based pagination support. Several bug fixes address WebSocket close reasons, OIDC compliance, and Kubernetes Client compatibility.
Changelog entry
- REST Client response entities properly closed when clients disconnect prematurely Pull request #57060
- WebSockets Next corrects close reason when connection closes abruptly Pull request #57113
- WebSockets Next fixes NPE during security identity update with proactive auth disabled Pull request #57064
- OIDC protected resource metadata response now includes Content-Type: application/json header Pull request #57094
- Cache extension split into API library and full extension modules Pull request #56543
- Dev UI Routes page fixed for sub-router mounts Pull request #56995
- Redis client now created only once per client name Pull request #57072
- MultivaluedMap now supported for collecting HTTP headers in REST endpoints Pull request #56985
- Quarkus Data adds cursor-based pagination support via Hibernate Reactive Pull request #57027
- REST Client URL no longer required when domain sockets are used Pull request #57044
- Kubernetes Client upgraded to 8.0.0 with Jackson 3 support and Dekorate to 5.0.0 Pull request #56982
- Hibernate 8 integration follow-up fixes restore QuarkusSessionTypeTest and pass additional properties to descriptor Pull request #57019
Quarkus 4.0.0.Beta1, 3.40.1, and 3.40.0 are now available. The major release brings Jackson 3, Java 21 minimum, UBI 10 support, and native transport improvements. Updates across all versions include REST client fixes, pagination support, and Kubernetes Client 8.0.0 compatibility.
Three Quarkus releases ship this week. Version 4.0.0.Beta1 marks a major milestone with Jackson 3, Java 21 minimum requirement, UBI 10 support, Micrometer Observation API integration, and native transport rework. Maintenance releases 3.40.1 and 3.40.0 provide stability fixes. Notable improvements include REST client resource leak fixes, split cache extension API, cursor-based pagination for Quarkus Data, and RFC 9728 compliance for OIDC metadata responses.
Week of September 21, 2026
What shipped
- Quarkus 3.40.0 released. Release
- Quarkus 3.39.5 released with OTLP export completion fix and dependency updates. Release
- Quarkus 3.27.6 released. Release
- Quarkus 3.33.4 released. Release
- Native image reachability metadata overhauled for GraalVM/Mandrel 25+ support with migration guide. Pull request #56520
- SmallRye OpenAPI updated to 4.4.0-alpha3 for Jackson 3 support. Pull request #56978
- Redis Client blocking transaction API error handling fixed to prevent server state leaks. Pull request #56976
- Flyway filesystem location filtering corrected for multiple datasources. Pull request #56779
- BcryptUtil now accepts char[] passwords to avoid plaintext strings lingering in memory. Pull request #56904
- StackOverflowError in ArC when decorated methods are declared by multiple interfaces fixed. Pull request #56741
Why it matters
This week brings three new patch releases across supported version lines plus critical fixes for native image builds, Redis transactions, and Flyway multi-datasource support. Security improvements to password handling and corrections to documentation and build processes address issues impacting native compilation and transaction reliability.
Changelog entry
- 3.40.0 released Release
- 3.39.5 released with OTLP export completion fix Release
- 3.27.6 released Release
- 3.33.4 released with BouncyCastle 1.86.1 Release
- Native image reachability metadata overhauled for GraalVM/Mandrel 25+ compatibility Pull request #56520
- SmallRye OpenAPI updated to 4.4.0-alpha3 for Jackson 3 support Pull request #56978
- Redis Client blocking transaction API error handling fixed to prevent server state leaks Pull request #56976
- Flyway filesystem location filtering corrected for multiple datasources Pull request #56779
- BcryptUtil now provides char[] overloads to avoid plaintext password strings in memory Pull request #56904
- ArC StackOverflowError fixed when decorated methods are declared by multiple interfaces Pull request #56741
- PKCS#11 keystore factory examples in TLS registry reference corrected Pull request #56662
- Remote-dev request body processing now bounded to prevent memory exhaustion Pull request #56266
- DnsClient leak prevented when resolving proxy hostnames Pull request #56961
- Hibernate ORM 5.6 database compatibility setting deprecated Pull request #56960
- WebSockets Next Multi stream stall on decode failure with backpressure fixed Pull request #56946
- MariaDB GraalVM metadata fixed when AWS SDK is on the classpath Pull request #56943
3.40.0, 3.39.5, 3.27.6, and 3.33.4 are out. Updated native image metadata for GraalVM 25, fixed Redis transaction handling, Flyway multi-datasource support, and password security improvements.
Quarkus releases this week: 3.40.0, 3.39.5, 3.27.6, and 3.33.4. Key updates include native image metadata overhaul for GraalVM/Mandrel 25+, fixed Redis transaction error handling, corrected Flyway location filtering for multiple datasources, and improved password security with char[] support in BcryptUtil.
Week of September 14, 2026
What shipped
- ArC implements CDI 5.0, including the new @Reserve annotation that allows normal beans to win over reserve beans, useful for framework authors to provide overrideable defaults. Pull request #55926
- Quarkus 3.40.0.CR1 released. Release
- Quarkus 3.39.4 released. Release
- SmallRye Fault Tolerance bumped to 7.0.0. Pull request #56804
- SmallRye Config updated to 4.0.0 with a new Spring module to support Spring @ConfigurationProperties. Pull request #56475
- WebSockets Next adds max-pending-messages back-pressure to bound in-flight messages per connection and prevent unbounded buffering when peers send faster than the application processes. Pull request #56856
- CDI REST Clients with @Url parameters no longer require a configured base URL since the parameter provides the full URL. Pull request #56691
- Maximum number of decoded query parameters is now configurable via quarkus.http.limits.max-query-parameters to override Vert.x's default limit of 1024. Pull request #56466
- OAuth Client ID Metadata Document support added, enabling client registration with HTTPS URLs and Credential JWT public key configuration for private clients. Pull request #55736
- OIDC DPoP proof now enforces iat and exp claims validation. Pull request #56598
Why it matters
This week brings CDI 5.0 support with the @Reserve annotation for better bean override patterns, multiple dependency upgrades fixing security issues and memory leaks, and new configuration options for query parameters and WebSocket backpressure. Releases 3.40.0.CR1 and 3.39.4 are now available with various fixes and enhancements across REST, OAuth, and WebSocket handling.
Changelog entry
- 3.40.0.CR1 released Release
- 3.39.4 released Release
- ArC now implements CDI 5.0 with @Reserve annotation support Pull request #55926
- SmallRye Fault Tolerance upgraded to 7.0.0 Pull request #56804
- SmallRye Config upgraded to 4.0.0 with Spring @ConfigurationProperties support Pull request #56475
- WebSockets Next: added max-pending-messages back-pressure configuration Pull request #56856
- CDI REST Client with @Url parameter no longer requires base URL configuration Pull request #56691
- HTTP query parameters limit is now configurable via quarkus.http.limits.max-query-parameters Pull request #56466
- OAuth Client ID Metadata Document support added for Keycloak client registration Pull request #55736
- RESTEasy upgraded to 7.0.5.Final with security fixes Pull request #56846
- RESTEasy upgraded to 6.2.19.Final with security fixes Pull request #56848
- OIDC: DPoP proof iat and exp claims validation enforced Pull request #56598
- MeterTag: support for repeated @MeterTag annotations on method parameters Pull request #56591
- BcryptUtil.matches reports invalid bcrypt hash with clear error message Pull request #56615
Quarkus 3.40.0.CR1 and 3.39.4 are out. This week: CDI 5.0 support, WebSocket backpressure controls, SmallRye upgrades, query parameter limits, and OIDC DPoP enforcement.
Quarkus 3.40.0.CR1 and 3.39.4 released. Key updates this week include full CDI 5.0 support with the @Reserve annotation for framework authors, WebSockets Next backpressure handling for unbounded message buffering, SmallRye Fault Tolerance 7.0.0 and Config 4.0.0 with Spring support, configurable query parameter limits, OAuth Client ID Metadata Document support, and OIDC DPoP proof validation improvements.