What quarkusio/quarkus shipped
Written by FoxPlug from public releases; not affiliated with Quarkus. An automatic summary of the public release, pull request and commit data of github.com/quarkusio/quarkus. Quarkus did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Quarkus 3.40.0 released. Release
- Quarkus 3.39.5 released with OTLP export completion fix and dependency updates. Release
- Quarkus 3.27.6 released. Release
- Quarkus 3.33.4 released. Release
- Native image reachability metadata overhauled for GraalVM/Mandrel 25+ support with migration guide. Pull request #56520
- SmallRye OpenAPI updated to 4.4.0-alpha3 for Jackson 3 support. Pull request #56978
- Redis Client blocking transaction API error handling fixed to prevent server state leaks. Pull request #56976
- Flyway filesystem location filtering corrected for multiple datasources. Pull request #56779
- BcryptUtil now accepts char[] passwords to avoid plaintext strings lingering in memory. Pull request #56904
- StackOverflowError in ArC when decorated methods are declared by multiple interfaces fixed. Pull request #56741
Why it matters
This week brings three new patch releases across supported version lines plus critical fixes for native image builds, Redis transactions, and Flyway multi-datasource support. Security improvements to password handling and corrections to documentation and build processes address issues impacting native compilation and transaction reliability.
Changelog entry
- 3.40.0 released Release
- 3.39.5 released with OTLP export completion fix Release
- 3.27.6 released Release
- 3.33.4 released with BouncyCastle 1.86.1 Release
- Native image reachability metadata overhauled for GraalVM/Mandrel 25+ compatibility Pull request #56520
- SmallRye OpenAPI updated to 4.4.0-alpha3 for Jackson 3 support Pull request #56978
- Redis Client blocking transaction API error handling fixed to prevent server state leaks Pull request #56976
- Flyway filesystem location filtering corrected for multiple datasources Pull request #56779
- BcryptUtil now provides char[] overloads to avoid plaintext password strings in memory Pull request #56904
- ArC StackOverflowError fixed when decorated methods are declared by multiple interfaces Pull request #56741
- PKCS#11 keystore factory examples in TLS registry reference corrected Pull request #56662
- Remote-dev request body processing now bounded to prevent memory exhaustion Pull request #56266
- DnsClient leak prevented when resolving proxy hostnames Pull request #56961
- Hibernate ORM 5.6 database compatibility setting deprecated Pull request #56960
- WebSockets Next Multi stream stall on decode failure with backpressure fixed Pull request #56946
- MariaDB GraalVM metadata fixed when AWS SDK is on the classpath Pull request #56943
3.40.0, 3.39.5, 3.27.6, and 3.33.4 are out. Updated native image metadata for GraalVM 25, fixed Redis transaction handling, Flyway multi-datasource support, and password security improvements.
Quarkus releases this week: 3.40.0, 3.39.5, 3.27.6, and 3.33.4. Key updates include native image metadata overhaul for GraalVM/Mandrel 25+, fixed Redis transaction error handling, corrected Flyway location filtering for multiple datasources, and improved password security with char[] support in BcryptUtil.
Week of September 14, 2026
What shipped
- ArC implements CDI 5.0, including the new @Reserve annotation that allows normal beans to win over reserve beans, useful for framework authors to provide overrideable defaults. Pull request #55926
- Quarkus 3.40.0.CR1 released. Release
- Quarkus 3.39.4 released. Release
- SmallRye Fault Tolerance bumped to 7.0.0. Pull request #56804
- SmallRye Config updated to 4.0.0 with a new Spring module to support Spring @ConfigurationProperties. Pull request #56475
- WebSockets Next adds max-pending-messages back-pressure to bound in-flight messages per connection and prevent unbounded buffering when peers send faster than the application processes. Pull request #56856
- CDI REST Clients with @Url parameters no longer require a configured base URL since the parameter provides the full URL. Pull request #56691
- Maximum number of decoded query parameters is now configurable via quarkus.http.limits.max-query-parameters to override Vert.x's default limit of 1024. Pull request #56466
- OAuth Client ID Metadata Document support added, enabling client registration with HTTPS URLs and Credential JWT public key configuration for private clients. Pull request #55736
- OIDC DPoP proof now enforces iat and exp claims validation. Pull request #56598
Why it matters
This week brings CDI 5.0 support with the @Reserve annotation for better bean override patterns, multiple dependency upgrades fixing security issues and memory leaks, and new configuration options for query parameters and WebSocket backpressure. Releases 3.40.0.CR1 and 3.39.4 are now available with various fixes and enhancements across REST, OAuth, and WebSocket handling.
Changelog entry
- 3.40.0.CR1 released Release
- 3.39.4 released Release
- ArC now implements CDI 5.0 with @Reserve annotation support Pull request #55926
- SmallRye Fault Tolerance upgraded to 7.0.0 Pull request #56804
- SmallRye Config upgraded to 4.0.0 with Spring @ConfigurationProperties support Pull request #56475
- WebSockets Next: added max-pending-messages back-pressure configuration Pull request #56856
- CDI REST Client with @Url parameter no longer requires base URL configuration Pull request #56691
- HTTP query parameters limit is now configurable via quarkus.http.limits.max-query-parameters Pull request #56466
- OAuth Client ID Metadata Document support added for Keycloak client registration Pull request #55736
- RESTEasy upgraded to 7.0.5.Final with security fixes Pull request #56846
- RESTEasy upgraded to 6.2.19.Final with security fixes Pull request #56848
- OIDC: DPoP proof iat and exp claims validation enforced Pull request #56598
- MeterTag: support for repeated @MeterTag annotations on method parameters Pull request #56591
- BcryptUtil.matches reports invalid bcrypt hash with clear error message Pull request #56615
Quarkus 3.40.0.CR1 and 3.39.4 are out. This week: CDI 5.0 support, WebSocket backpressure controls, SmallRye upgrades, query parameter limits, and OIDC DPoP enforcement.
Quarkus 3.40.0.CR1 and 3.39.4 released. Key updates this week include full CDI 5.0 support with the @Reserve annotation for framework authors, WebSockets Next backpressure handling for unbounded message buffering, SmallRye Fault Tolerance 7.0.0 and Config 4.0.0 with Spring support, configurable query parameter limits, OAuth Client ID Metadata Document support, and OIDC DPoP proof validation improvements.