Update quarkus.version to v3.37.3 by red-hat-konflux[bot] · Pull Request #1759 · project-ncl/bacon

red-hat-konflux · 2026-05-20T11:19:35Z

This PR contains the following updates:

Package	Change	Age	Confidence
io.quarkus.qute:qute-core	`3.35.3` → `3.37.3`

Release Notes

quarkusio/quarkus (io.quarkus.qute:qute-core)

`v3.37.3`

Compare Source

Complete changelog

#48106 - quarkus.grpc.codegen.proto-directory unrecognized configuration key & missing from documentation
#55093 - Incompatible exception classloaders when mocking exceptions during tests
#55196 - quarkus-oidc cannot handle non rollable refresh tokens concurrently
#55231 - Safer testcontainers.reuse.enable restoration + more resilient tests
#55272 - OIDC: deduplicate concurrent token refresh requests within a single Quarkus instance
#55288 - [3.x] OpenShift Client native integration test fails after #55242
#55292 - Bump the hibernate group across 1 directory with 12 updates
#55316 - Fix IsContainerRuntimeWorking to not write testcontainers.reuse.enable to ~/.testcontainers.properties
#55319 - Fix native image build failure caused by Netty's SelfSignedCertificate
#55351 - Don't truncate stacktrace on OIDC authentication errors
#55357 - Do not miss Throwable in the OIDC code flow error log
#55362 - @JsonFormat(shape = JsonFormat.Shape.ARRAY) on a class ignored by reflection-free Jackson serializers when used inside a List/Set
#55363 - Reflection free deserializers drops data of final collection field with no setter
#55365 - Fix flakiness of RawTypeReflectionFreeSerializerTest
#55366 - Fix serialization of pojos using JsonFormat.Shape enum in reflection-free Jackson serializers
#55369 - quarkus-rest-jackson: reflection-free deserializer ignores @JsonTypeInfo/@JsonSubTypes for polymorphic list elements inside a wrapper type
#55370 - Bail out of reflection-free deserializer when @JsonTypeInfo is used
#55373 - Jacoco + CycloneDX extension breaking combination in Quarkus 3.37.1+
#55374 - Implement getter-as-setter pattern when deserializing private collection in reflection-free Jackson serializers
#55378 - Register gRPC codegen configuration properties
#55380 - Harden remote dev mode against path traversal and unsafe deserialization
#55385 - NPE in modularity can transformed classes
#55396 - Fix NPE in modularity when processing removed resources
#55397 - Ignore unresolvable POMs for bundled CycloneDX components
#55403 - Fix bad link syntax and update cross-document references to use xref
#55410 - quarkus-rest-jackson: Reflection-free deserializer ignores @JsonProperty(required=true) on a @JsonCreator sometimes
#55411 - Take count of @JsonProperty(required=true) on a @JsonCreator in reflection-free Jackson serializers
#55425 - Disable Mockito class cache so thenThrow works across component tests
#55426 - ServerExceptionMapper on sub-resource is global instead of sub-resource specific
#55427 - Make @ServerExceptionMapper in sub-resource specific to that sub-resource
#55450 - Fix serialization of java.time.Duration in generated reflection-free Jackson serializers

`v3.37.2`

Compare Source

Complete changelog

#49524 - IllegalStateException: GlobalOpenTelemetry.set has already been called
#54999 - Produce ServiceStartBuildItem for OTel
#55134 - Add regression tests for QuteProcessor
#55137 - Null boxed Integer and Boolean fields dropped from JSON by reflection-free serializers (Quarkus 3.37)
#55142 - @JsonProperty is ignored or duplicated + 'visibility'-setting is ignored in 'ObjectMapperCustomizer' by reflection-free Jackson serializers
#55183 - Fix typo
#55214 - Reflection-free serializers break Kotlin boolean "is" properties and @JsonProperty annotations
#55216 - Avoid duplicate fields when using @JsonProperty + improve Kotlin support + obey visibility defined in ObjectMapperCustomizer in reflection-free Jackson serializers
#55229 - Bump com.ongres.scram:scram-client from 3.2 to 3.3 in /bom/application
#55238 - Bump SmallRye GraphQL to 2.18.3
#55254 - [3.37 Regression] quarkus-rest-jackson drops ObjectNode request body fields with reflection-free Jackson enabled
#55255 - [Reflection-free Jackson deserialisers] Unknown field throws plain JsonMappingException instead of MismatchedInputException, bypassing custom exception mappers
#55256 - Avoid generating reflection-free Jackson serializers for classes in the jackson.databind package
#55261 - Reflection-free Jackson deserialisers: @JsonUnwrapped prefix/suffix not honored
#55278 - Serialize null boxed primitives in reflection-free Jackson serializers
#55279 - Fix exception thrown in case of unknown field in reflection-free Jackson serializer
#55280 - Honor @JsonUnwrapped prefix/suffix in reflection-free Jackson serialisers
#55302 - jackson-module-kotlin incompatible with reflection-free serializers
#55304 - OIDC: include invalid_dpop_proof in AuthenticationFailedException to clarify why exception was thrown
#55309 - Opt-out Kotlin classes from generation of reflection-free Jackson serializers
#55318 - @JsonFormat with pattern on java.time types (e.g. ZonedDateTime, LocalDateTime) ignored by reflection-free Jackson serializers
#55322 - Fix serialization of java.time fields with custom format in generated reflection-free Jackson serializers
#55331 - Jackson Reflectionfree Serializer with Raw Types
#55334 - Fix reflection-free Jackson serializers when using raw types

`v3.37.1`

Compare Source

Complete changelog

#49919 - Prevent invocation of Task.project at execution time in Gradle plugin
#54854 - OIDC DPoP Nonce response uses from status code and message
#54855 - For missing and invalid nonces, return 401/use_dpop_nonce
#54889 - Response not handled in ContainerResponseFilter for dropped HTTP requests
#54903 - Allow the use of @Cancellable on ContainerResponseFilter
#54909 - Change log level of some OIDC log messages from debug to warn
#54919 - Improve the update-quarkus.adoc guide a bit
#54924 - Fix status in update-quarkus.adoc
#54942 - Include additional args in AOTMode=create" command
#54949 - Infinispan - Add missing service implementations for native
#54950 - JAXB - Register a new service implementation for native
#54955 - Significant CPU regression
#54958 - Prevent invocation of Task.project at execution time in Gradle plugin
#54975 - Infinispan - Register services properly and enforce basic client intelligence in ITs
#54997 - Bump org.hibernate.validator:hibernate-validator from 9.1.0.Final to 9.1.1.Final
#55008 - Quarkus REST sub-resources return 500 for malformed content type unlike 415 from top-level resource
#55009 - Quarkus REST: fix response status for sub-resource requests with a malformed content type
#55010 - Fix TransactionalInterceptorBase to handle reaper-cancelled transactions
#55018 - Enforce no duplicate POM dependencies via maven-enforcer-plugin
#55022 - infinispan-client and infinispan-cache IT tests fail with GraalVM CE 25.2.4-dev
#55028 - Switch from org.fusesource.jansi to org.jline:jansi
#55030 - Reduce allocation in HTTP instrumentation
#55046 - CycloneDX SBOM fixes
#55048 - Add Literal helper to NamedOidcClient qualifier
#55053 - Register for reflection all constructors of service providers
#55057 - Qute should handle properties that are not found more gracefully than throwing ClassCastException
#55066 - Qute: handle not-found params in JsonObject and Plus value resolvers
#55068 - Bump io.quarkus.develocity:quarkus-project-develocity-extension from 1.3.0 to 1.3.1
#55080 - Generated quarkusjacksonserializer fails for JSON property names containing ‘-’ and ‘.’
#55081 - Sanitize json property names while generating reflection-free Jackson serializers
#55095 - Bump eu.maveniverse.maven.nisse:extension3 from 0.9.2 to 0.9.3
#55096 - Bump eu.maveniverse.maven.njord:extension3 from 0.9.8 to 0.9.9
#55099 - Update to MicroProfile API 3.1.1
#55105 - Bump Agroal to 3.2.1
#55107 - Signals: clarify SignalMetadataEnricher threading
#55121 - Bump com.ibm.db2:jcc from 12.1.0.0 to 12.1.5.0
#55128 - @JsonFormat on java.util.Date ignored by reflection-free Jackson serializers
#55140 - Fix support for @JsonFormat on java.util.Date in reflection-free Jackson serializers
#55143 - quarkus-rest-jackson: reflection-free serializer drops JsonNullable contained type (3.37.0 regression)
#55146 - Generalize handing of any single-type-parameter parameterized type
#55158 - OIDC: Multiple AuthenticationCompletionAction beans silently ignored
#55159 - Bump org.junit:junit-bom from 6.1.0 to 6.1.1 in /devtools/gradle
#55165 - Bump the hibernate group across 1 directory with 11 updates
#55168 - Bump org.junit:junit-bom from 6.1.0 to 6.1.1
#55173 - quarkus-rest-jackson ignores @JsonIgnoreProperties in combination with @JsonUnwrapped
#55176 - Fix performance regression in AotQuarkusEntryPoint
#55178 - Fix ignoring of properties of unwrapped object in generated Jackson serializers
#55179 - Bump Keycloak server version to 26.6.4
#55181 - Support multiple AuthenticationCompletionAction as we document
#55182 - Make sure tree-shaken classes are recorded in pedigree for native build SBOMs
#55187 - Fix JDK 21 profile in signals and websockets-next deployment modules
#55188 - Mailer: clarify that Uni returned from send() must be subscribed to
#55191 - Add maven.compiler.release and testRelease to independent-projects parent POM
#55195 - Bump Keycloak client version to 26.0.10
#55208 - Use maven.compiler.testRelease for Signals Java 21 tests

`v3.37.0`

Compare Source

Complete changelog

#54729 - Gradle: imageBuild and imagePush use this output of :jandex without declaring dependency
#54730 - Gradle plugin: declare jandex task ordering for all tasks consuming main source set resources
#54759 - ObservabilityJsonRPCService fails when LGTM dev service is disabled
#54777 - Native image: SoftDeleteStateManagement.INSTANCE field not registered for reflection
#54780 - Register StateManagement fields for native image reflection
#54784 - When using quarkus.openshift.secret-volumes."secret-volumes".items."items".path the deploy fail to openshift
#54785 - OIDC web-app step-up re-authentication redirect does not include acr_values
#54786 - Carry acr_values and max_age in the code flow authorization request
#54790 - Add link to JMC in JFR guide
#54831 - Fix dev mode startup when LGTM observability dev services are disabled
#54832 - Fix invalid secret and ConfigMap volume item mode in Kubernetes manifests
#54840 - Bump the hibernate group with 11 updates
#54848 - Upgrade to SmallRye GraphQL 2.18.2
#54867 - Rename trusted proxy Subject DN property
#54871 - Bump io.quarkus:quarkus-platform-bom-maven-plugin from 0.0.131 to 0.0.132

`v3.36.3`

Compare Source

Complete changelog

#54765 - JSON logger doesn't print stacktrace anymore
#54769 - Fix NPE in JSON Logging
#54798 - Fix dead links in kafka.adoc
#54807 - Fix dead links in security guides
#54812 - Fix miscellaneous dead links across guides
#54829 - Log Dev MCP endpoint path at startup when enabled
#54837 - Add UnwrappedTypeResolverBuilder reflective class registration to kubernetes-client
#54873 - Bump io.quarkus:quarkus-fs-util from 1.4.0 to 1.4.2
#54878 - [3.37] Update to Micrometer 1.16.6

`v3.36.2`

Compare Source

Complete changelog

#34285 - Using Dev ui "breaks" a lambda
#40420 - FrameworkRouter not initialized when access-log is enabled with custom non-application-root-path
#54080 - Don't use ordered execution for @RunOnVertxContext
#54438 - Allow Dev UI to work with Amazon Lambda HTTP extensions in dev mode
#54546 - Bump kafka.version from 4.2.0 to 4.2.1
#54597 - Fix null Vert.x log messages showing as NULL in native mode
#54604 - With quarkus.thread-pool.queue-size set, async health work can be silently dropped
#54609 - Don't ignore Future in Smallrye Health
#54621 - Bump the hibernate group with 10 updates
#54639 - Memory Leak with Quarkus Rest Client in a Reactive pipeline
#54646 - Panache: PanacheRepositoryBase.findByIds(List<?> ids) returns a list of instead of
#54647 - Fix return type of PanacheRepositoryBase
#54649 - Bump to Vert.x 4.5.28 and Netty 4.1.135.Final
#54659 - Fix memory leak in REST Client reactive pipelines
#54669 - Fix startup NPE when the access log is enabled without a framework router
#54673 - add config properties section to cyclonedx guide
#54674 - cyclonedx sbom missing serialnumber
#54675 - Add cyclone configuration to docs
#54678 - Missing %l in the access log documentation
#54689 - Basic auth may return 401 with older clients when realm is unset
#54697 - Document Basic authentication realm compatibility
#54700 - Include serial numbers into generated SBOMs
#54705 - Bump quarkiverse-parent from 20 to 22
#54708 - Updates Infinispan to 16.0.13
#54709 - Add support for --no-wrapper on CreateProjectMojo
#54711 - Bump jacoco.version from 0.8.14 to 0.8.15
#54713 - Add option to Maven plugin to forget wrapper addition
#54732 - Dev-UI: Update German translation for 'Read me' to 'Lies mich'

`v3.36.1`

Compare Source

Complete changelog

#52741 - quarkus-amazon-lambda-rest does not correctly include a Jandex
#53197 - Smallrye config and microprofile config version conflict causes build failure with java modules
#53613 - Quarkus build with vertx-hazelcast fails after upgrade to 3.33.1
#53785 - Multi threaded maven uber jar builds on windows faill with java.nio.file.ClosedFileSystemException
#53808 - Wrap shorthand admonition blocks in ==== delimiters
#54001 - Gradle quarkusRun task starts in TEST mode
#54095 - Gradle config from one module's quarkusAppPartsBuild leaks into another module in 3.35.x
#54144 - Open archive path tree interrupt workaround
#54229 - Signals: add configurable concurrency limit
#54270 - Enable RAG generation during release builds
#54273 - Keycloak exchange code for tokens fails in devmode if clientId contains an underscore
#54281 - quarkus.rest-client-oidc-filter.refresh-on-unauthorized not respected with multiple @RegisterProvider annotations
#54286 - Signals: introduce configurable concurrency limiter
#54313 - Fix Hibernate ORM Dev UI localization and clear HQL input on submit
#54320 - Use Mode.RUN for the Gradle quarkusRun task to fix indexing crash
#54340 - Fix Keycloak DEV UI code exchange for client IDs with underscores
#54342 - @ServerExceptionMapper with generic base class drops other exception mappers at runtime
#54343 - Fix JSON logging excluded keys config ignoring nested fields
#54346 - Fix @ServerExceptionMapper bridge method handling for generic types
#54357 - Fix typo it's is -> it is
#54382 - Bump the hibernate group with 11 updates
#54389 - Updates to Infinispan 16.0.12.Final
#54413 - Update documentation of ReflectiveClassConditionBuildItem
#54423 - Fix "Kafka OAuthBearer authentication fails in native mode" again
#54426 - Injecting test security identity on IO thread is blocking operation
#54427 - Fix injecting @TestSecurity identity with @RunOnVertxContext
#54428 - Disambiguate config doc anchors for build-time properties
#54432 - Fix platform BOM and platform metadata override ordering
#54436 - Fix: quarkus.rest-client-oidc-filter.refresh-on-unauthorized not respected with multiple @RegisterProvider annotations
#54443 - Bump the hibernate group across 1 directory with 16 updates
#54447 - Reset stale Quarkus system properties on reused Gradle worker JVMs
#54455 - [Kafka Dev UI] Topic message timestamp displayed one month behind actual value
#54467 - Bump proposed Maven version to 3.9.16
#54468 - Signals: Receivers - resolve lambda inference ambiguity
#54470 - Bump org.eclipse.parsson:parsson from 1.1.7 to 1.1.9
#54473 - Fix Kafka Dev UI message timestamp displaying one month earlier
#54480 - Lambda fails serialization when returning Record, succeeds when swapped to Object
#54482 - REST Client + Micrometer: duplicate gauge registration warning for http.client.active.connections on first invocation
#54484 - Properly support java.lang.Record as Lambda return type
#54496 - Avoid duplicate gauge warnings for REST Client
#54497 - Agroal invalid connection metric has the wrong description
#54499 - Fix wrong description for agroal.invalid.count metric
#54505 - Bump Maven wrapper to 3.9.16
#54520 - Add maven distribution sha256 validation
#54522 - Dev UI Workspace - the scroll is not working anymore
#54527 - Avoid transfer progress in Quarkus Update commands
#54531 - Remove superfluous code in dev ui guide
#54541 - Raggedy alignment on dev UI for new actions links
#54543 - Undeprecate AbstractQuarkusExtensionTest and make it abstract
#54544 - Bump version.surefire.plugin from 3.5.4 to 3.5.6
#54545 - Bump jaxb-runtime.version from 4.0.8 to 4.0.9
#54553 - Finalize Maven 3.9.16 update
#54555 - Fix Dev UI Workspace scroll not working
#54556 - Align Dev UI action links with regular extension links
#54558 - DataSource leaks after upgrading to Quarkus 3.36.0
#54560 - Signals: document programmatic Signal creation via Signal.create()
#54573 - Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.1 to 3.0.2
#54574 - Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.21.4
#54577 - Multiple extensions registered a feature of the same name: hibernate-orm-panache
#54582 - Improve French translation of the Dev UI
#54587 - [3.36] Fix duplicate feature name when hibernate-panache-next and hibernate-orm-panache coexist
#54588 - Do not bytecode record the Vert.x service instances
#54595 - Index additional classes in AWS Lambda extensions
#54599 - Align MicroProfile Config with SmallRye Config
#54606 - Bump Agroal to 3.2

`v3.36.0`

Compare Source

Complete changelog

#53533 - Complains about missing <extensions>true</extensions> for newly created extension
#54119 - Add extension-rag module to generate RAG vector embeddings from core documentation
#54133 - Bump kubernetes-client-bom from 7.6.1 to 7.7.0
#54186 - Signals: improvements
#54196 - Bump Gradle from 9.3.1 to 9.5.1
#54202 - Bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3
#54209 - Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18
#54217 - Reflection free serializer improvements
#54220 - Bump Microsoft SQL Server JDBC driver to 13.4.0
#54221 - Support for multiple SunPKCS11 configurations
#54223 - Add extensions=true to generated extension codestart POMs for external extensions
#54227 - Exclude transitive dependencies from narayana-jta
#54228 - Add Spring's entities among class placeholders to be unwrapped
#54239 - Add preauthorized_code as OidcClient grant type enum
#54241 - Bump Vineflower to 1.12.0
#54243 - Agroal 3.1 Causes Connections to Use DB Default Transaction Isolation
#54248 - Signals: remove flaky BlockingEmissionFailureTest
#54258 - Using copyRecursive instead of registering configuration for QuarkusComponentVariants
#54259 - Ensure LauncherProvider always use current Config
#54262 - Bump Agroal to 3.1.2
#54300 - Bump com.github.ben-manes.caffeine:caffeine from 3.2.3 to 3.2.4

`v3.35.4`

Compare Source

Complete changelog

#51109 - Smallrye OpenAPI generation for SSE with Multi return type generates array type
#53479 - x-smallrye-profile Profile filtering not working properly
#53798 - Update remaining actions to pinned shas
#53844 - Bump smallrye-open-api.version from 4.3.0 to 4.3.1
#53916 - Add support for more Jackson annotations in generated reflection-free serializers
#53944 - Bump the hibernate group with 9 updates
#53946 - [3.35.1] Hibernate IllegalArgumentException is not a subtype
#53964 - StackOverflowError in Hibernate metadata processing since 3.35 for generic AttributeConverter
#54060 - Allow WebDependencyJarBuildItem to carry import mappings directly
#54085 - Improve Micrometer test resilience
#54091 - mTLS auth mechanism throws NPE when proxy "forwarded" header indicate HTTPS in the HTTP request
#54093 - Using reflection-free serializers breaks in 3.35
#54127 - quarkus-opentelemetry native image on JDK 25: IllegalArgumentException: Receiver type ManagementSupport$$Lambda is not an instance of com.sun.management.OperatingSystemMXBean at runtime
#54140 - Fix CNFE for CpuMethods otel class
#54146 - SunPKCS provider is not available at runtime
#54147 - Apply security provider specific configuration at runtime
#54148 - Bump Narayana from 7.3.3.Final to 7.3.4.Final
#54150 - Bump the hibernate group across 1 directory with 14 updates
#54188 - Update JAXB to 4.0.8
#54189 - Generate reflection-free Jackson serializers only for public classes
#54199 - docs: replace Markdown xml fence with AsciiDoc source block
#54208 - Bump smallrye-open-api from 4.3.1 to 4.3.3
#54242 - Prevent NPE in mTLS auth mech when communication with a trusted proxy happens over HTTP protocol but headers indicate HTTPS
#54264 - Fix NPE in RemoteUserAttribute with anonymous identity
#54310 - Prometheus compression header fix

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

github-actions · 2026-05-20T11:34:02Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output

k18on-1.74.jar [2 CRITICAL, 3 HIGH, 4 MEDIUM]
					|-- bcutil-jdk18on-1.74.jar
						|-- bcprov-jdk18on-1.74.jar [2 CRITICAL, 3 HIGH, 4 MEDIUM]
				|-- bcprov-jdk18on-1.74.jar [2 CRITICAL, 3 HIGH, 4 MEDIUM]
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
				|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
					|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
				|-- keycloak-server-spi-25.0.3.jar
					|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-adapter-spi-25.0.3.jar
			|-- bcprov-jdk18on-1.74.jar [2 CRITICAL, 3 HIGH, 4 MEDIUM]
		|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- jackson-core-2.19.2.jar [1 HIGH]
			|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
			|-- keycloak-common-25.0.3.jar [2 MEDIUM]
|-- common-3.5.1-SNAPSHOT.jar
	|-- jackson-datatype-jsr310-2.19.2.jar
		|-- jackson-core-2.19.2.jar [1 HIGH]
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- pom-manipulation-common-lite-5.3.jar
		|-- jackson-core-2.19.2.jar [1 HIGH]
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- pnc-common-3.5.1.jar
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
|-- config-3.5.1-SNAPSHOT.jar
	|-- jackson-core-2.19.2.jar [1 HIGH]
	|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- jackson-dataformat-yaml-2.19.2.jar
		|-- jackson-core-2.19.2.jar [1 HIGH]
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
|-- opentelemetry-ext-cli-java-2.0.0.jar
	|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
	|-- opentelemetry-exporter-otlp-1.51.0.jar
		|-- opentelemetry-exporter-sender-okhttp-1.51.0.jar
			|-- opentelemetry-exporter-common-1.51.0.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- opentelemetry-sdk-metrics-1.51.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- opentelemetry-sdk-trace-1.51.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
	|-- opentelemetry-sdk-1.51.0.jar
		|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- opentelemetry-sdk-common-1.51.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- opentelemetry-sdk-logs-1.51.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
	|-- opentelemetry-semconv-1.29.0-alpha.jar
		|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
|-- rex-model-1.2.3.jar
	|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- pnc-api-3.0.5-jakarta.jar
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
|-- pnc-api-3.5.2.jar
	|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- hibernate-validator-6.2.5.Final.jar
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
|-- rest-client-3.5.6.jar
	|-- jackson-datatype-jdk8-2.12.6.redhat-00001.jar
		|-- jackson-core-2.19.2.jar [1 HIGH]
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- json-patch-1.13.jar
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
		|-- jackson-coreutils-2.0.jar
			|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
	|-- vertx-core-3.9.14.jar [1 MEDIUM]
		|-- jackson-core-2.19.2.jar [1 HIGH]
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
		|-- netty-buffer-4.1.84.Final.jar
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
		|-- netty-codec-http2-4.1.84.Final.jar [4 HIGH, 4 MEDIUM]
			|-- netty-codec-http-4.1.84.Final.jar [3 HIGH, 10 MEDIUM]
			|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-handler-4.1.84.Final.jar [3 HIGH, 1 MEDIUM]
		|-- netty-codec-http-4.1.84.Final.jar [3 HIGH, 10 MEDIUM]
			|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-handler-4.1.84.Final.jar [3 HIGH, 1 MEDIUM]
		|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
		|-- netty-handler-proxy-4.1.84.Final.jar [1 MEDIUM]
			|-- netty-codec-http-4.1.84.Final.jar [3 HIGH, 10 MEDIUM]
			|-- netty-codec-socks-4.1.84.Final.jar
				|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-handler-4.1.84.Final.jar [3 HIGH, 1 MEDIUM]
		|-- netty-handler-4.1.84.Final.jar [3 HIGH, 1 MEDIUM]
			|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-transport-native-unix-common-4.1.84.Final.jar
				|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
		|-- netty-resolver-dns-4.1.84.Final.jar [2 HIGH, 1 MEDIUM]
			|-- netty-codec-dns-4.1.84.Final.jar [1 HIGH]
				|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-codec-4.1.84.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
			|-- netty-handler-4.1.84.Final.jar [3 HIGH, 1 MEDIUM]
		|-- netty-resolver-4.1.84.Final.jar
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
		|-- netty-transport-4.1.84.Final.jar
			|-- netty-common-4.1.84.Final.jar [2 MEDIUM]
	|-- common-3.5.6.jar
		|-- jackson-databind-2.19.2.jar [2 HIGH, 3 MEDIUM]
		|-- opentelemetry-instrumentation-annotations-2.24.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
	|-- dto-3.5.6-patch-builders.jar
		|-- jsoup-1.22.2.jar
			|-- netty-codec-http-4.1.84.Final.jar [3 HIGH, 10 MEDIUM]
			|-- netty-handler-4.1.84.Final.jar [3 HIGH, 1 MEDIUM]
	|-- rest-api-3.5.6-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 11 HIGH, 2 MEDIUM]
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
			|-- xnio-nio-3.8.7.Final.jar
				|-- xnio-api-3.8.7.Final.jar [2 HIGH]


No Policy violations were detected

Project 'bacon' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=f85d9f1a-b4b0-47cd-8126-d6bf70df9ffc
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=6d0c058f67e84d0886f851d7173c47c7ca091a6fdb1242cdbb51128e57035c41

Mend AI scan succeeded.

Support Token: 011521feaf19c4b689572dba62ba484281784367344925

SAST scan output

*no findings*

Full logs and artifacts

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.version branch from 1711f96 to 7f7f2cc Compare June 3, 2026 09:32

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus.qute:qute-core to v3.36.0~~ Update dependency io.quarkus.qute:qute-core to v3.36.1 Jun 3, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.version branch from 7f7f2cc to 30c3e7e Compare June 15, 2026 17:47

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus.qute:qute-core to v3.36.1~~ Update dependency io.quarkus.qute:qute-core to v3.36.2 Jun 15, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.version branch from 30c3e7e to 93cc954 Compare June 20, 2026 17:59

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus.qute:qute-core to v3.36.2~~ Update dependency io.quarkus.qute:qute-core to v3.37.0 Jun 20, 2026

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus.qute:qute-core to v3.37.0~~ Update quarkus.version to v3.37.0 Jun 25, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.version branch from 93cc954 to 801855d Compare July 4, 2026 13:04

red-hat-konflux Bot changed the title ~~Update quarkus.version to v3.37.0~~ Update quarkus.version to v3.37.1 Jul 4, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.version branch from 801855d to 986e67e Compare July 11, 2026 13:18

red-hat-konflux Bot changed the title ~~Update quarkus.version to v3.37.1~~ Update quarkus.version to v3.37.2 Jul 11, 2026

Update quarkus.version to v3.37.3

14cda28

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.version branch from 986e67e to 14cda28 Compare July 18, 2026 09:28

red-hat-konflux Bot changed the title ~~Update quarkus.version to v3.37.2~~ Update quarkus.version to v3.37.3 Jul 18, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update quarkus.version to v3.37.3#1759

Update quarkus.version to v3.37.3#1759
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/quarkus.version

red-hat-konflux Bot commented May 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Configuration

Documentation

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading