What quarkusio/quarkus shipped

This week: a path matching security fix across branches, quarkus dev --remote, a new graceful shutdown API, REST Client charset and URI fixes, Spring controller NPE fix, and Hibernate ORM timezone defaults.

This week in Quarkus: ImmutablePathMatcher now keeps a trailing slash on the root path, addressing a security issue with backports under way. quarkus dev gained a --remote option, so remote dev mode no longer needs Maven or Gradle. Graceful shutdown has a new API in the service start context with the old one deprecated. On the extensions side, REST Client respects the charset set in Consumes and validates URIs without JDK URL protocol handlers, interface-based Spring controllers no longer throw a NullPointerException, and Hibernate ORM disables direct JDBC java.time handling by default with an opt-in setting. Spring ConfigurationProperties now runs on SmallRye Config, large property-heavy classes fall back to reflection instead of failing the build, and dev mode tests leak fewer class load

4.0.0.Beta2 is out. Load shedding got an exempt path for liveness probes plus reworked overload handling. Malformed JSON bound to Vert.x JSON, JSON-B and JSON-P bodies now returns 400, and HTTP/2 requests already read are no longer paused. Reflection-free Jackson serializers are

This week Quarkus 4.0.0.Beta2 was released, adding OIDC Client attestation authentication and JFR events for the REST Client. Load shedding was improved: concurrency limit adaptation no longer serializes all request processing, overload state is more stable, and an exempt path keeps liveness probes from being shed so pods are not restarted. On the REST side, malformed JSON bound to Vert.x JsonObject and JsonArray, JSON-B and JSON-P bodies now returns 400, reactive route @Body parameters behave the same way, and HTTP/2 requests that were already read are no longer paused or resumed. Other fixes cover Infinispan cache cleanup when a cached method throws, a NullPointerException with generic @RegisterRestClient interfaces, and native container builds as root with rootful Podman. Reflection-fre

This week: Jackson set to 3.1.8 and 2.21.8 to fix a critical databind vulnerability, Undertow now checks groupId so Jackson 3 is not taken for Jackson 2, BouncyCastle ML-KEM SPIs registered for native reflection, OIDC client attestation authentication, and a Dev UI root log level

Changes this week in Quarkus: Jackson versions are set to 3.1.8 and 2.21.8, fixing a critical Jackson databind vulnerability and bringing Jackson 2.x back from 2.22 to 2.21. Undertow now compares the groupId as well as the artifactId when detecting Jackson 2 core, so Jackson 3 is no longer misidentified and native builds no longer fail. BouncyCastle ML-KEM SPIs are registered for reflection in native mode, so BCJSSE server handshakes with hybrid X25519MLKEM768 key exchange work. The OIDC Client adds OAuth2 attestation-based client authentication. The Dev UI can now set the root log level. Smaller fixes: the startup banner no longer appears twice, closing an already closed REST Client no longer logs a stack trace, async gRPC client callbacks run on a duplicated Vert.x context, and Quarkus w

This week in Quarkus: jlink images start again and REST Client and Quarkus REST responses now work in them. Per-class persistence unit assignment. Build fails early when classic Panache meets Quarkus Data. Guides updated for Java 21.

This week in Quarkus: applications packaged with quarkus-jlink start again after the service graph and client proxy changes, and REST Client calls and Quarkus REST responses now work inside a jlink image. Entities can be assigned to persistence units on a per-class basis with the PersistenceUnit annotation. The build now fails early when classic Panache is used alongside Quarkus Data, instead of failing at startup with a cryptic Hibernate error. OIDC Client caches token requests based on additional parameters, named datasources appear in AgroalDataSourceUtil.activeDataSourceNames, Gradle test logging is honored, and the guides are updated for the Java 21 minimum.

Service start/stop infrastructure has landed, with logging and other extensions converted. Also fixed: MongoDB Panache multi-field updates, Dev UI hot reload NPE, Hibernate Reactive cache clearing on shutdown. Dependency updates for Vert.x, Netty, Elytron and sshd.

This week in Quarkus: the first service start and stop infrastructure landed, converting logging and representative extensions to the new model. Fixes include multi-field PanacheQL updates in MongoDB with Panache, a Dev UI websocket NullPointerException during hot reload, and Hibernate Reactive session caches not being cleared on shutdown. GraalVM dynamic bootstraps registration was added for Gizmo 2 users. On the dependency side, Vert.x, Netty, Elytron, sshd, snappy-java and other libraries were updated, with some changes addressing published vulnerabilities. Documentation gained guidance on opening Dev UI through another host name and missing guide links were added to the metadata of 19 extensions.

Quarkus 4.0.0.Beta1, 3.40.1, and 3.40.0 are now available. The major release brings Jackson 3, Java 21 minimum, UBI 10 support, and native transport improvements. Updates across all versions include REST client fixes, pagination support, and Kubernetes Client 8.0.0 compatibility.

Three Quarkus releases ship this week. Version 4.0.0.Beta1 marks a major milestone with Jackson 3, Java 21 minimum requirement, UBI 10 support, Micrometer Observation API integration, and native transport rework. Maintenance releases 3.40.1 and 3.40.0 provide stability fixes. Notable improvements include REST client resource leak fixes, split cache extension API, cursor-based pagination for Quarkus Data, and RFC 9728 compliance for OIDC metadata responses.

3.40.0, 3.39.5, 3.27.6, and 3.33.4 are out. Updated native image metadata for GraalVM 25, fixed Redis transaction handling, Flyway multi-datasource support, and password security improvements.

Quarkus releases this week: 3.40.0, 3.39.5, 3.27.6, and 3.33.4. Key updates include native image metadata overhaul for GraalVM/Mandrel 25+, fixed Redis transaction error handling, corrected Flyway location filtering for multiple datasources, and improved password security with char[] support in BcryptUtil.

Quarkus 3.40.0.CR1 and 3.39.4 are out. This week: CDI 5.0 support, WebSocket backpressure controls, SmallRye upgrades, query parameter limits, and OIDC DPoP enforcement.

Quarkus 3.40.0.CR1 and 3.39.4 released. Key updates this week include full CDI 5.0 support with the @Reserve annotation for framework authors, WebSockets Next backpressure handling for unbounded message buffering, SmallRye Fault Tolerance 7.0.0 and Config 4.0.0 with Spring support, configurable query parameter limits, OAuth Client ID Metadata Document support, and OIDC DPoP proof validation improvements.