3.6.0.CR1

Major changes

• #36935 - Support for dynamic OIDC JWK set resolution
• #36874 - Move HTTP Permissions and Roles policies from build-time to runtime
• #36781 - Added Discord as well-known OIDC provider
• #36728 - JPA Security: allow pointing to a named persistence unit
• #36634 - Introduce OidcRequestFilter
• #36631 - Make it possible to acquire OIDC SecurityIdentity after HTTP request has completed
• #36602 - Move quarkus-jaeger and quarkus-smallrye-opentracing to Quarkiverse
• #36375 - OIDC client integration for GraphQL clients

Complete changelog

• #37088 - Security doc fix: Fix links in Protect a web application topic
• #37071 - RESTEasy Qute integration: add dependency conditions
• #37066 - Add label area/native-image to issues mentioning mandrel
• #37063 - Make testLambdaCapturing test conditional on GraalVM version
• #37060 - Bump io.smallrye.reactive:mutiny from 2.2.0 to 2.5.1
• #37051 - Use dynamically resolved Java version when creating Gradle projects
• #37047 - Quarkus CLI doesn't honor --java=21 for gradle projects
• #37039 - Add endpoints page in Dev UI
• #37037 - [GraalVM 24.0] RegisterForReflectionITCase.testLambdaCapturing from integration-tests/main fails with quarkus main branch
• #37036 - Use empty string in Sse event when there is no data
• #37033 - Sse difference in empty event between non-reactive and reactive output
• #37030 - Fix HttpSecurityProcessor compilation by importing Singleton
• #37022 - Make basic realm and form authentication configuration properties only used during runtime the runtime properties
• #37020 - Fix vale errors and warnings in the OpenID Connect (OIDC) and OAuth2 Client and Filters Reference Guide
• #37017 - Allow to create named HTTP Security policies referenced in the application.properties path matching rules as CDI beans
• #37009 - Revert "Make Dependabot group micro updates"
• #37005 - Qute: allow extensions to register additional template roots
• #36999 - Build cache - Upload quarkus-ide-launcher-999-SNAPSHOT.jar
• #36989 - Adds download topology as PNG file
• #36970 - Build cache - Make sure there is a new line before EOF
• #36965 - Dev UI Fix Reactive messaging screen
• #36956 - Better handle multi-line outputs in develocity-publish-build-scans.yml
• #36950 - Remove jakarta.ejb-api from narayana-jta extension
• #36944 - Bump wildfly-common version to 1.7.0.Final
• #36939 - Redis vector fields and arguments
• #36935 - Support for dynamic OIDC JWK set resolution
• #36930 - Ability to generate gRPC descriptor set
• #36926 - Make Dependabot group micro updates
• #36921 - Qute: consider synthetic parameter declarations during validation
• #36915 - Rename OidcClientRequestFilter filter to OidcRequestFilter
• #36912 - Avoid @TempDir in RestClientCDIDelegateBuilderTest
• #36910 - Use proper exception when media type handling is incorrect
• #36909 - Bump org.eclipse.jgit:org.eclipse.jgit from 6.6.1.202309021850-r to 6.7.0.202309050840-r
• #36908 - Bump com.google.api.grpc:proto-google-common-protos from 2.27.0 to 2.28.0
• #36903 - Bump org.junit:junit-bom from 5.10.0 to 5.10.1 in /devtools/gradle
• #36900 - Devservice for amqp can't load channels on dev ui
• #36897 - Unable to generate gRPC descriptor set
• #36888 - Fix dev-ui double contruction of Web Components
• #36882 - Quarkus JTA has not needed Dependency to ejb-api
• #36874 - Move HTTP Permissions and Roles policies from build-time to runtime
• #36873 - Register server exception mapper method of the Rest-Interface implementation class
• #36872 - Server exception mapper method of the Rest-Interface implementation class is not registered for resource defined in the interface.
• #36871 - Adds Pattern support to Kafka Streams Topology Dev UI
• #36859 - Include removed dependencies in the ApplicationModel
• #36842 - Update Revved up by Develocity badge
• #36824 - Fix codestarts snapshots
• #36818 - Add SPA Form Based Authentication instructions
• #36817 - ModuleBuildDurationReport: Fix help message for sort
• #36809 - Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.13.0
• #36799 - Skip non-existing directory when watching for changes
• #36798 - Unexpected content-type can cause two different exceptions depending on the jax-rs resource
• #36796 - DevUI Router loads WebComponents twice when it's already loaded
• #36791 - Bump org.jetbrains.kotlin:kotlin-gradle-plugin-api from 1.8.10 to 1.9.20 in /devtools/gradle
• #36789 - OpenTracing to OpenTelemetry Tutorial
• #36781 - Added Discord as well-known OIDC provider
• #36760 - Add a reminder to check for 8080 port uses to FAQ
• #36759 - Security JPA: support Hibernate multitenancy
• #36755 - Bump commons-io:commons-io from 2.13.0 to 2.15.0
• #36752 - If the node name is longer than 28 bytes, shorten it with SHA-224
• #36748 - Validate Startup observers are not secured with RBAC annotations
• #36745 - Qute: dev mode - add config to skip restart for some templates
• #36733 - Bump jaxb-runtime.version from 4.0.3 to 4.0.4
• #36729 - Bump com.google.guava:guava from 32.1.2-jre to 32.1.3-jre
• #36728 - JPA Security: allow pointing to a named persistence unit
• #36725 - Recommend GraalVM CE in the documentation
• #36724 - Update virtual thread documentation to Java 21
• #36723 - Fix various mistakes in gRPC guides
• #36718 - Add a description to the Stork extension metadata
• #36711 - Disable Http2RSTFloodProtectionTest on Windows
• #36706 - Kafka Streams Dev UI migration to v2
• #36704 - Add use layer 7 proxy for reactive pg client
• #36703 - Bump io.micrometer:micrometer-bom from 1.11.1 to 1.11.5
• #36702 - Bump flyway.version from 9.22.2 to 9.22.3
• #36701 - Bump elasticsearch-opensource-components.version from 8.10.2 to 8.10.4
• #36700 - Fixes for Kafka and Pulsar schema discovery
• #36698 - Bump strimzi kafka-oauth-client to 0.14.0 with fix for native
• #36696 - Refactor BuildChainBuilder
• #36695 - Disable MySQL OIDC DB token manager test due to limited Github CI resources
• #36693 - Indicate that 2.x is not supported anymore
• #36692 - Qute templates needs a "no restart" config to avoid auto-reload in dev-mode
• #36686 - Quarkus native tests fail with latest GraalVM CE for JDK 22, 24.0.0-dev builds due to wildfly substitution
• #36685 - Arc - change hashing function to use base64 to shorten resulting String
• #36674 - Bump io.smallrye.reactive:smallrye-mutiny-vertx-core from 3.6.0 to 3.7.2
• #36673 - Bump asm.version from 9.5 to 9.6
• #36669 - Some fixes for Micrometer extension and tests with Stork
• #36667 - CORS content review
• #36665 - Update Gitpod configuration with Java 17
• #36661 - HTTP and RestEasy-related content review
• #36657 - Revert "Bump io.strimzi:kafka-oauth-client from 0.12.0 to 0.14.0"
• #36654 - Migrate Java version in Gitpod configuration to Java 17
• #36653 - integration-tests/kafka-oauth-keycloak failing in native
• #36648 - Bump jacoco.version from 0.8.10 to 0.8.11
• #36647 - Bump org.jboss.threads:jboss-threads from 3.5.0.Final to 3.5.1.Final
• #36642 - Reinitialize the com.google.protobuf.UnsafeUtil class at runtime
• #36640 - Document gRPC code generation
• #36634 - Introduce OidcRequestFilter
• #36631 - Make it possible to acquire OIDC SecurityIdentity after HTTP request has completed
• #36630 - Use container urls for connecting to services by default
• #36627 - Update gRPC Protoc to version 3.24.4 and the generator to 1.59.0
• #36626 - ArC: performance optimizations related to client proxy invocations
• #36624 - Fix termination of the fallback virtual thread executor
• #36623 - Fix OIDC/GraphQL client initialization
• #36616 - Fix zlib link
• #36608 - Bump com.google.api.grpc:proto-google-common-protos from 2.23.0 to 2.27.0
• #36606 - Reverts workaround liquibase issue
• #36602 - Move quarkus-jaeger and quarkus-smallrye-opentracing to Quarkiverse
• #36600 - Building container images from scratch doesn't work
• #36580 - Redis: use known commands correctly
• #36579 - Add information about new sponsor field
• #36576 - QuarkusTest: handle beans declared on test profile specifically
• #36575 - Updates Liquibase integrationtest
• #36574 - Module build duration report
• #36565 - Bump apicurio-registry.version from 2.4.7.Final to 2.4.13.Final
• #36564 - Bump testcontainers.version from 1.19.0 to 1.19.1
• #36563 - OIDC ID token introspection
• #36562 - Add a warning for how to report security vulnerability
• #36560 - Metaspace improvements in QuarkusUnitTest (and dev mode!) - round 3
• #36554 - TestProfile specific CDI beans
• #36553 - Add note that pinning cases section is historical information.
• #36541 - Create security cors doc
• #36535 - Bump mongo-client.version from 4.10.2 to 4.11.0
• #36525 - Build cache - Various small adjustments
• #36524 - Qute: relax cdi/inject namespace validation
• #36520 - Dev mode: fix HotDeploymentWatchedFileBuildItem predicate
• #36519 - Infinispan client ref guide update with sni host validation
• #36516 - Housekeeping native-image build step
• #36512 - Bump io.quarkus.bot:build-reporter-maven-extension from 3.1.0 to 3.2.2
• #36509 - Move HTTP CORS section to its own document
• #36503 - Allows Mongo client settings customization
• #36494 - Document Mandrel and GraalVM new UnlockExperimentalVMOptions option
• #36493 - Disable GraphQLClientUsingOidcClientTest
• #36491 - Update documentation about using GraalVM configuration files
• #36489 - WebJars locator extension Dev UI support
• #36483 - Fixes java doc warnings
• #36477 - Get rid of {doc-guides} attribute in documentation
• #36476 - Support for jaeger remote sampler
• #36473 - Enable publication of build scans for PRs coming from forks
• #36472 - HotDeploymentWatchedFileBuildItem predicate not working when auto-build is enabled (vscode)
• #36466 - Reactive routes: virtual threads support
• #36462 - Bump io.strimzi:kafka-oauth-client from 0.12.0 to 0.14.0
• #36461 - Bump version.cdi-tck from 4.0.10 to 4.0.12
• #36447 - Clarify REST Clients extension names
• #36444 - Bump Keycloak version to 22.0.4
• #36430 - Virtual-Threads Support for quarkus-reactive-routes
• #36429 - Bump org.yaml:snakeyaml from 2.1 to 2.2
• #36426 - Update javadocs for various build items
• #36425 - Check whether a conditional dependency has already been activated before scheduling it for processing
• #36422 - Remove or replace Pinning cases?
• #36389 - QuarkusComponentTest: initial support for ConfigMapping
• #36380 - Config: docs for config value mismatch detection
• #36375 - OIDC client integration for GraphQL clients
• #36374 - Vert.x EventBus: use codec selector for non-concrete types
• #36373 - Support for non-mock @ConfigMapping in @QuarkusComponentTest
• #36353 - Make it very obvious where Getting Started with Security tutorial is
• #36335 - quarkus.otel.traces.sampler.arg doesn't support String value (e.g. cannot configure "jaeger_remote" sampler)
• #36327 - Add validation of execution model annotations
• #36319 - Bump kafka3.version from 3.5.1 to 3.6.0
• #36312 - Bump kubernetes-client-bom from 6.8.1 to 6.9.2
• #36288 - Guide on how to store secrets locally
• #36284 - Test Java 21 on CI
• #36248 - Added synthetic beans for the managed ExecutorService backed by virtual threads
• #36194 - Rename tooling codestarts
• #36172 - @ConsumeEvent does not work in native when returning a Uni<Set>
• #36080 - Bump rest-assured.version from 5.3.0 to 5.3.2
• #35985 - smallrye-opentracing end of life and move to Quarkiverse
• #35984 - Jaeger extension end of life and move to Quarkiverse
• #35934 - Stork observability
• #35878 - GraphQL typesafe client - support for @OidcClientFilter
• #35811 - Include note about the use of -H:+-UnlockExperimentalVMOptions starting with GraalVM for JDK 21 (23.1)
• #35356 - Adding security annotations to classes with start up methods does not fail the build
• #35231 - JPA Security: allow pointing to a named persistence unit
• #33854 - Quarkus gRPC guide doesn't have Gradle examples
• #33337 - Thread pinning with PostgreSQL JDBC driver
• #33181 - Cleanup codestarter test
• #32164 - Fix gRPC context propagation
• #32092 - Quarkus watches wrong protobuf directory
• #32046 - quarkus-grpc: gRPC Context including Deadline not propagated to gRPC server
• #30491 - Generate right-length node name
• #30293 - Native gRPC Client is failing to send a message to GRPC server
• #29309 - Javadoc Warnings in the Gradle plugin
• #28704 - Broken Redis client for cluster mode (MOVED Exception)
• #28528 - OpenTracing to OpenTelemetry migration guide
• #24069 - OIDC: New tenant specific service to map a TokenCredential to a SecurityIdentity
• #22432 - Improve OIDC client pluggability
• #22418 - add protoc ppc64le to grpc codegen
• #21273 - Webjars: support DEV UI
• #16700 - JPA security : allow @UserDefinition to work with multitenant datasource
• #12802 - gRPC: Configurable proto input directory
• #12594 - Quarkus Security issue in the Native Executable