Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.4 by red-hat-konflux[bot] · Pull Request #1758 · project-ncl/bacon

red-hat-konflux · 2026-05-20T11:19:27Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
io.quarkus:quarkus-bootstrap-maven-resolver	`3.35.3` → `3.39.4`

Release Notes

quarkusio/quarkus (io.quarkus:quarkus-bootstrap-maven-resolver)

`v3.39.4`

Compare Source

Complete changelog

#35814 - Quarkus Security with Jakarta Persistence guide doesn't mention security-jpa-reactive extension
#37745 - Docs: security-oauth2 and security-oauth2-quickstart Guide
#41734 - Probable bug in CognitoPrincipal lines 62 70
#53739 - ConfigDiagnostic.configFiles() crashes with AccessDeniedException on Windows when CWD is system32
#54925 - Formatting fails with a NullPointerException and the log record is dropped
#54926 - Fix JSON logging with null formatter keys
#55111 - [quarkus-info] Allow hiding the quarkus version
#55763 - Make the OIDC token JWE decryption algorithm configurable
#55910 - Remove unreachable duplicate Claims.groups branch in CognitoPrincipal
#55916 - DPoPNonceProvider should accept DPoP proof jti
#56160 - JBang integration fails on Java 24+ with IllegalAccessError: module java.base does not open java.lang
#56287 - Add forgotten extension-status includes – and remove extension status from guides for stable extensions
#56303 - OIDC: make DPoPNonceProvider accept DPoP proof jti
#56453 - Allow TEST_TO_MAIN_MAPPINGS to be set as a system property
#56514 - Restore the third callout entry in the Hibernate ORM interceptor example
#56515 - Add the missing callout entry in the Infinispan client Greeting example
#56517 - Keep the Keycloak Dev Services resource-mapping callout list together
#56518 - Use a callout list for the generated resources extension example
#56519 - Add the two missing callout entries in the Vert.x OIDC migration guide
#56523 - Bootstrap Maven command from Getting started guide fails
#56527 - Fix reproducibility issue in Avro
#56529 - Strip quotes from extension names in Maven create command
#56537 - Bump GraalVM SDK version to 25.0.4.1
#56540 - NPE in getEffectiveMapper when response entity is an anonymous class (e.g. Stream)
#56541 - Fix NPE in getEffectiveMapper when response entity is an anonymous class
#56552 - the --debug-port or -DdebugPort parameter doesn't seem to work properly, always binding to port 5005
#56556 - Upgrade Apache HttpClient5 to 5.6.4
#56559 - Fix custom debug port being ignored in dev mode
#56560 - [3.39] Bump to Vert.x 4.5.34
#56561 - Remove empty RemoveableLateBoundSpanProcessor and LateBoundSpanProcessor files
#56562 - Customize OIDC token decryption algorithm
#56563 - [Keycloak dev service] - Make dev service access token lifespan configurable
#56583 - Avoid an internal error when a bean parameter field is not a class type
#56584 - docs: remove duplicate 'the' in OpenTelemetry logging guide
#56585 - docs: remove duplicate 'the' in Dev UI Patterns note
#56586 - Fix 'allows to' grammar in Config programmatic access docs
#56587 - Fix 'allows to storage' grammar in MongoDB guide
#56590 - Skip configuration directories that cannot be read when looking for unknown config files
#56593 - docs: remove duplicate 'the' in OIDC application-type note
#56604 - Keycloak Dev Service: make default realm's token lifespan configurable
#56613 - Compare Cognito claim names with strings instead of Claims enum constants
#56617 - Run the effective command of quarkus:update, with the local repository property
#56623 - Pass the add-opens requirements to JBang
#56626 - Fix the imports of the resource examples in the OAuth2 guide
#56627 - Mention the reactive extension in the Jakarta Persistence security guide
#56628 - Cache generated Jackson deserializers
#56630 - cyclonedx guide doesn't list quarkus.cyclonedx.endpoint.* configuration options in reference section
#56631 - Additional test coverage for CycloneDX
#56635 - Info - Allow disabling Quarkus version
#56637 - Add missing CycloneDX endpoint configuration to guide
#56654 - Flaky test: io.quarkus.micrometer.deployment.binder.VertxTcpMetricsTest.testTcpMetrics
#56656 - Flaky test: io.quarkus.quartz.test.PausedSchedulerTest.testSchedulerPauseResume
#56657 - Flaky test: io.quarkus.redis.datasource.PubSubCommandsTest.subscribeToSingleWithMultiAsMessages
#56667 - Update outdated native SSL guide summary
#56669 - Fix flaky test DevMojoIT.testResourcesFromClasspath on Windows
#56671 - Fix flaky PubSubCommandsTest by awaiting reactive subscriptions
#56708 - Fix flaky PausedSchedulerTest
#56749 - Drop testEmbeddedSbomUncompressed as quarkus.cyclonedx.embedded.compress was repurposed for the SBOM endpoint
#56754 - Prevent leakage between Micrometer tests

`v3.39.3`

Compare Source

Complete changelog

#42976 - Quarkus REST in NATIVE - abstract resources with @Path requires impl. to be CDI beans while RESTEasy does not
#45257 - update guide on writing extension regarding docs generation
#45791 - Range response status reset when using a @ServerResponseFilter
#55119 - Use branch instead of version to avoid dead link on main guides
#55674 - context propagation not working correctly
#55739 - Fix race in AeshLauncherImpl causing flaky test timeouts
#55835 - Quarkus 3.38 in dev mode - WARNING: java.lang.foreign.Linker::downcallHandle has been called by org.aesh.terminal.tty.impl.LibC in an unnamed module
#55962 - Enable WebSocket traffic logging in aesh websocket tests
#55999 - [Docs]: Lift and Shift review of Deploying to OpenShift guide
#56018 - Aesh: fix flaky WebSocket tests on Semeru by closing WebSocketClient
#56103 - Mention the quarkus-config-doc-maven-plugin
#56106 - Add licenses for generic file components in SBOMs
#56120 - Move SSH enabled config to build time and gate all processor build steps
#56129 - Fix wrapWithSpan context propagation
#56153 - Keep the 206 status of Range responses when the JAX-RS response has been materialized
#56222 - Make sure the callouts follow the Asciidoc syntax
#56240 - Update redirect instructions for Roq
#56279 - Security overview guide style review (3.40)
#56301 - Upgrade aesh to 3.17.5 and improve AeshLauncher test framework
#56336 - [3.39] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
#56340 - Add a packaging overview guide
#56346 - Manage projectreactor in the bom, update to 3.8.7
#56348 - Update building-docs skill and docs-preview.sh for Roq migration
#56354 - Upgrade hibernate ORM from 7.4.5.Final to 7.4.7.Final
#56357 - [3.39] backport of doc improvement
#56359 - Check Keycloak token type on the OIDC server-less verification path
#56365 - [3.39] Upgrade RESTEasy to 6.2.18.Final
#56374 - Remove warning from PeriodicMetricReader
#56386 - Style and syntax violations in docs callouts
#56389 - Do not use attributes in guide title to work around Roq/Yupiik limitation
#56391 - Fix numbered callout lists in documentation examples
#56393 - ReactiveRedisDataSource.withConnection leaks pool permit when cancelled before connection is acquired
#56395 - Suppress PeriodicMetricReader exporter warnings
#56400 - rest-jackson: ContextResolver result cached by entity class, dropping the media type from the key
#56402 - rest-jackson: SecurityCustomSerialization caches its ObjectWriter in a JVM-wide static field, dropping the ObjectMapper from the key
#56408 - Update the logging guide for supported APIs
#56413 - Redis client: fix connection leaks caused by cancellation during acquisition
#56424 - Quarkus REST: fix native mode when abstract resource with path is extended by a subclass without paths
#56425 - Doc - place callout lists after source listings
#56429 - Typo fixes in websockets-next guides
#56430 - Ensure FullyFeaturedServerJacksonMessageBodyWriter uses media type properly
#56431 - Ensure SecurityCustomSerialization uses ContextResolver
#56432 - Remove orphaned callout markers with missing explanations
#56444 - Drop steps for discarded toc plugin in docs preview
#56449 - Fix remaining callout list placement issues in docs
#56470 - [3.39] Decouple types discovery and generation of reflection-free Jackson serializers
#56480 - fix: align docs-preview.sh default port to 8042
#56487 - Update to Avro 1.12.2, auto-trust Avro-generated classes, add properties to configure additional Avro-trusted classes
#56489 - SBOM component to product attribution
#56493 - Certificate reload skips restored certificates by comparing against startup snapshot
#56497 - [3.39] SBOM CPE attribution
#56498 - Ensure restoring certificate to original works

`v3.39.2`

Compare Source

Complete changelog

#55234 - quarkus cli is missing the classname option
#55239 - Add resource class name to CreateApp
#55355 - Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1
#55360 - quarkus-container-image-buildpack fails on Windows with UnsupportedOperationException when building container image
#55545 - Support multiple colons in @PermissionsAllowed value
#55665 - Update buildpack lib to 0.0.17
#55907 - Quarkus 3.38 Date serialization issue
#56016 - Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 in /bom/application
#56030 - WriterInterceptor not called for response mapped from exception
#56064 - quarkus-rest-jackson: reflection-free (de)serializers treat a Map subclass as a bean and drop every map entry
#56126 - Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2
#56152 - Run writer interceptors for responses mapped from exceptions thrown before the interceptor handler
#56161 - Allow multiple colons in @PermissionsAllowed
#56165 - OIDC Redis TokenStateManager returns null instead of failing when the token state is missing, leading to an NPE and HTTP 500
#56173 - JarResource: cached toExternalForm() breaks relative URL resolution against CodeSource.getLocation()
#56176 - Fix resolving sibling URL in JarResource
#56182 - Issue using both Caffeine and Redis for caching
#56206 - Fix dead link
#56209 - Update preview workflow for Roq
#56216 - Avoid early token acquisition for DeferredOidcClient
#56223 - [3.39] Fix serialization of string-shaped dates without a pattern in reflection-free Jackson serializers
#56224 - [3.39] Support reflection-free json serialization of a Map subtype
#56234 - Force re-authentication when the OIDC session token state is no longer available
#56237 - Bump org.asynchttpclient:async-http-client from 2.15.0 to 2.16.0 in /bom/application
#56242 - Fix Redis cache backend type resolution
#56244 - Fix docs preview: Drop invalid condition and unused mtime
#56257 - Signals: docs - add comparison with CDI events and Vert.x EventBus
#56278 - security-getting-started-tutorial guide style review (3.40)
#56280 - security-authorize-web-endpoints-reference guide style review (3.40)
#56281 - security-keycloak-authorization guide style review (3.40)
#56282 - security-architecture guide style review (3.40)
#56292 - Fix typo sytem -> system in the dev services databases guide
#56293 - docs: fix typo exisits -> exists
#56300 - Allow --path parameter on quarkus create app cli for parity with maven creation
#56306 - Typo fixes in deploying-to-abc guides
#56308 - [3.39] Fix reading headers in Spring Web - Quarkus REST
#56320 - [3.39] Use composite key for token introspection and userinfo cache
#56333 - [3.39] Upgrade SmallRye GraphQL to 2.18.5

`v3.39.1`

Compare Source

Complete changelog

#48943 - From Quarkus 3.22, Database dev services not reused if the unit test is using a @QuarkusTestResource
#51130 - Remote Dev fails when using hibernate-reactive extension
#55389 - Fix @RunOnVirtualThread annotation in combination with blocking endpoints
#55907 - Quarkus 3.38 Date serialization issue
#55958 - container-image-jib: no progress output while the image is pushed, because ProgressEvent is never subscribed to
#55959 - Jib container push progress log
#56009 - Dev UI Dev MCP endpoint hangs indefinitely (no response, no error) when a JSON-RPC request's id is a string
#56064 - quarkus-rest-jackson: reflection-free (de)serializers treat a Map subclass as a bean and drop every map entry
#56070 - quarkus-spring-security may not fail the build when @PostAuthorize, @PreFilter or @PostFilter are used
#56079 - Skip Hibernate dev integrator in remote server-side dev mode
#56080 - MongoDB Panache: Session-commit on transaction rollback
#56086 - [3.39] Do not set an invalid country code when generating the Quarkus Dev CA
#56087 - [3.39] Handle string JSON-RPC ids and always respond on the Dev MCP endpoint (3.39 backport)
#56088 - Fail the build when unsupported Spring Security annotations are used
#56092 - [3.39] Revert "Disable the Quarkus Dev CA generation test on Windows"
#56101 - Document that CORS cannot be configured both programmatically and with properties
#56104 - quarkus-config-doc-maven-plugin picks up things from git worktrees that it should ignore
#56105 - Don't descend into nested git checkouts when scanning for config-doc target directories
#56130 - Register terminal provider SPI and defer FFM init for native images
#56131 - docs: clean up independently maintained CORS guide
#56132 - Redis replication with topology=static does not respect host ordering - Set loses master/replica order
#56158 - REST Client: @RestClient on the interface fails the build with a duplicate annotation since 3.32
#56159 - Ignore a @RestClient qualifier placed on the REST Client interface
#56166 - Fix MongoDB Panache committing sessions after a JTA transaction timeout
#56177 - Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1
#56183 - Redis: make sure the configured hosts are ordered
#56192 - Do not rebuild the application for every launch of a QuarkusMainTest
#56197 - Upgrade aesh, aesh-readline, fix ffm downcall and customizers
#56204 - Switch to JavaParser for generating build items doc

`v3.39.0`

Compare Source

Major changes

#56072 - [3.39] Revert "Enable reflection-free Jackson serializers by default"

Complete changelog

#55738 - Make sure MicrometerRegistryProviderBuildItem has a stable collection order
#55756 - Datasource guide style review (3.40)
#55834 - @Scheduled method can run before @InjectMock is installed in @QuarkusTest
#55891 - Scheduler: document halted start mode as a testing workaround
#55902 - Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1
#55911 - "ScheduledJobStarted" CDI Event for a scheduled job.
#55914 - Fire StartedExecution CDI event for scheduled jobs
#55947 - Update to Kotlin 2.4.10
#55980 - Bump Gradle from 9.6.0 to 9.7.0
#55988 - Embedding cyclone DX SBOM fails with minikube extension since 3.38.0.CR1 because of org.jline:jline-parent:4.0.0 dependency
#55991 - Document implicit transactions for blocking SmallRye GraphQL resolvers when JTA is available
#55995 - Bump org.bouncycastle:bc-jdk18on-bom from 1.85 to 1.85.2
#55997 - Bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10
#56001 - Document implicit transactions for blocking SmallRye GraphQL resolvers
#56002 - Use testcontainers' oracle-free instead of oracle-xe
#56008 - DevUI: use bean class as source for synthetic observers
#56019 - Fix jline dependency
#56020 - [3.39] Add quarkus-extension.json
#56041 - Preserve the configured order of REST compression media types
#56042 - Make sure JacksonDeserializerFactory#DeserializationData's constructorFields has a stable order
#56043 - Record WebSocket endpoint security checks in a stable order
#56051 - Do not use maps with unstable iteration order in OidcGraphQLClientIntegrationProcessor
#56052 - Make sure map returned from WebSocketProcessor#collectEndpointSecurityChecks is stable and immutable
#56053 - Make sure ctorFields in JacksonDeserializerFactory#deserializeObjectFields is immutable
#56054 - [3.39] Backport doc categories work to 3.39
#56072 - [3.39] Revert "Enable reflection-free Jackson serializers by default"

`v3.38.3`

Compare Source

Complete changelog

#34749 - Openshift manifest generator does not detect commit id in "detached HEAD" state
#55437 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2 in /devtools/gradle
#55875 - Tree shake break with liquibase extension, if no changelog file exists
#55918 - Quarkus dev mode fails on macOS when GNU stty precedes BSD stty in PATH
#55924 - Make sure liquibase extensions don't fail on missing change logs
#55948 - Bump org.junit:junit-bom from 6.1.2 to 6.1.3
#55954 - Bump org.junit:junit-bom from 6.1.2 to 6.1.3 in /devtools/gradle
#55967 - Correct typo in catalog overrides
#55983 - Avoid eagerly initializing the full map of System#getProperties when not necessary
#55985 - Fall back to the basic console when terminal initialization fails in dev mode
#55990 - [3.x] Bump dekorate to 4.1.11
#56021 - quarkus-logging-json 3.36.x and above removes MDC information when choosing ECS format
#56024 - Disable tree-shake in test mode
#56033 - Keep MDC and NDC data in the ECS log format
#56038 - [3.x] Fix native image build failure on aarch64 when using BC FIPS Poly1305-AES
#56047 - [3.38] Revert "Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85"
#56066 - Pass String array arguments of the invoked secured method to @PermissionChecker
#56067 - Do not set an invalid country code when generating the Quarkus Dev CA
#56077 - Apply CliSettings customizers in CliRunner single-command execution path

`v3.38.2`

Compare Source

Complete changelog

#55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
#55169 - Changing how connection closure is handled to avoid a race condition
#55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
#55298 - Fix test selection for nested test classes
#55554 - Bump to Vert.x 4.5.31
#55560 - [3.x] maven native integration tests fail after #55461
#55584 - Qute localization breaks with too many entries
#55587 - Add presence checks on substituted Netty classes
#55653 - Fix VerifyError for large Qute message bundles
#55675 - Serialization issue in rest endpoints when class has empty constructor
#55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
#55760 - Upgrade Yasson from 3.0.4 to 3.0.5
#55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
#55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
#55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
#55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
#55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
#55849 - Merge isPublicConstructors() when a reflective class is registered twice
#55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
#55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
#55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
#55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
#55867 - ArC: fix client proxy name collision for producers
#55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
#55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
#55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
#55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
#55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
#55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
#55912 - Tree Shaker breaks hibernate filters
#55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
#55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
#55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
#55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change

`v3.38.1`

Compare Source

Complete changelog

#54725 - Improve Basic authentication how-to
#54781 - Vert.x's FileSystemOptions contains constants getting defined at build time
#54885 - Tests do not start
#55023 - Support management interface dynamic port in integration tests
#55062 - REST Client: Content-Type header not set when provided via jakarta.ws.rs.client.Entity
#55138 - Overwrite content-type header provided via the variant of the entity
#55267 - Initialize Vert.x FileSystemOptions at runtime for native image
#55317 - @QuarkusTest bootstrap deadlocks during parallel deployment-dependency resolution
#55345 - Pre-init Maven resolver HTTP transport classes to avoid class loading deadlock
#55405 - Bump smallrye-open-api.version from 4.3.3 to 4.3.5
#55498 - Remove the CI job that runs k8s tests on Windows
#55520 - JaCoCo: also instrument classes for dev mode tests
#55525 - JaCoCo: QuarkusExtensionTest does not contribute to coverage report
#55549 - Copy executionMaxDelay and description in CompositeScheduler
#55564 - Bump keycloak-client.version from 26.0.10 to 26.0.11
#55578 - Kotlin 2.4.0: overriding a generic suspend fun in a JAX-RS resource breaks endpoint scanning
#55588 - Bump io.rest-assured:rest-assured from 6.0.0 to 6.0.1
#55595 - Ignore synthetic methods in RESTEasy Reactive sub-resource scan
#55618 - Limit of 18 OpenAPI Profiles
#55620 - Fix EnumMap ClassCastException in bytecode recorder on method split
#55633 - Bump com.google.cloud.tools:jib-core from 0.28.1 to 0.28.2
#55636 - Fix JaCoCo coverage for QuarkusExtensionTest
#55640 - Enforce managed versions on direct dependencies of an application artifact provided as a JAR
#55643 - Access log cookie masking bypassed for cookies not first in the header
#55644 - Fix access log cookie masking to check all cookie pairs
#55652 - quarkus-rest-jackson Reflection-free-serializers fails on deserializing JsonAlias with same value as fieldname
#55655 - Remove value registry, not used
#55678 - @JsonFormat(pattern = "...") on a java.util.Date field is ignored by Reflection-free Jackson serializers
#55686 - GraphQL+OIDC issue with default configuration and native
#55687 - quarkus-rest-jackson Reflection-free-serializers serializes @Transient annotated methods
#55691 - OIDC GraphQL client: fix NPE when default OIDC client is configured and native mode
#55694 - [3.x] In reflection-free Jackson serializers skip deserialization of a JsonAlias having the same name of the field
#55701 - @TestHTTPEndpoint not propagated to @Nested subclasses.
#55702 - reflection-free serializers ignore @JsonValue declared on a superinterface method (multi-level)
#55703 - Make sure @TestHTTPEndpoint works with nested classes
#55706 - [3.x] Fix serialization of formatted date in reflection-free Jackson serializers
#55707 - Treat @Transient as @JsonIgnore in reflection-free Jackson serializers
#55713 - Fix multi-level @JsonValue inheritance in reflection-free serializers
#55714 - REST Client hangs forever on any 3xx response without a Location header (e.g. 304 Not Modified) when followRedirects is enabled and an HttpClientRequest customizer is registered
#55717 - [3.x] Fix REST Client hang when a 3xx response has no Location header
#55719 - Remove nonsensical configuration from Hibernate Search AI skill
#55728 - Bump org.hibernate.validator:hibernate-validator from 9.1.2.Final to 9.1.3.Final
#55737 - Fix reproducibility checks for quarkus-rest-deployment
#55746 - REST Client silently drops @MatrixParam / @RestMatrix parameters
#55751 - Send @MatrixParam and @RestMatrix from the REST Client
#55778 - quarkus-rest-jackson: reflection-free deserializer erases nested type arguments (Map<String, List<Foo>> elements become LinkedHashMap)
#55779 - Preserve nested type arguments in reflection-free Jackson deserializers
#55794 - [3.38] Quarkus REST - Fix unbounded multipart part-header accumulation
#55798 - [3.38] Fix path normalization
#55800 - Upgrade aesh to 3.16.6 and register MetadataRegistry for native image

`v3.38.0`

Compare Source

Complete changelog

#55401 - @RegisterForProxy is silently ignored when used more than once on the same type
#55402 - Use getAnnotationsWithRepeatable for handling repeatable annotations in proxy registration logic
#55469 - Updates to Infinispan 16.0.14
#55501 - Gradle: Add Gradle-version dependent warnings
#55536 - Fix scalpel configuration

`v3.37.4`

Compare Source

Complete changelog

#46633 - AWS Lamdba function.zip permission issue on Windows
#55436 - Update to Vert.x 4.5.30 and Netty 4.1.136.Final
#55438 - Qute does not apply property-not-found-strategy when chaining template extension methods
#55451 - reflection-free serializers ignore @JsonValue declared on a superinterface method
#55452 - Skip NOT_FOUND in value resolver to avoid locking in NOT_FOUND strings before calls to.raw
#55455 - Embedding cyclone DX SBOM fails with relative parent pom file
#55466 - Check @JsonValue declared on a superinterface method in reflection-free Jackson serializers
#55470 - Update to Hibernate ORM 7.4.5 / Update to Hibernate Validator 9.1.2
#55476 - Make sure MavenProjects available through the API are added to the Quarkus workspace
#55487 - quarkus-rest-jackson: reflection-free deserializer NPEs at build time for a polymorphic @JsonCreator parameter
#55489 - Fall back to reflection-based deserialization when a @JsonCreator parameter cannot be handled
#55497 - quarkus-rest-jackson Reflection-free-serializers with @JsonAnyGetter
#55500 - Implement @JsonAnyGetter and @JsonAnySetter on fields in reflection-free Jackson serializers
#55513 - Set Unix permissions when copying entries into function.zip
#55519 - quarkus-rest-jackson Reflection-free-serializers unboxing Character throws NullPointer
#55521 - Prevent unboxing of null Character in reflecton-free Jackson serializers

`v3.37.3`

Compare Source

Complete changelog

#48106 - quarkus.grpc.codegen.proto-directory unrecognized configuration key & missing from documentation
#55093 - Incompatible exception classloaders when mocking exceptions during tests
#55196 - quarkus-oidc cannot handle non rollable refresh tokens concurrently
#55231 - Safer testcontainers.reuse.enable restoration + more resilient tests
#55272 - OIDC: deduplicate concurrent token refresh requests within a single Quarkus instance
#55288 - [3.x] OpenShift Client native integration test fails after #55242
#55292 - Bump the hibernate group across 1 directory with 12 updates
#55316 - Fix IsContainerRuntimeWorking to not write testcontainers.reuse.enable to ~/.testcontainers.properties
#55319 - Fix native image build failure caused by Netty's SelfSignedCertificate
#55351 - Don't truncate stacktrace on OIDC authentication errors
#55357 - Do not miss Throwable in the OIDC code flow error log
#55362 - @JsonFormat(shape = JsonFormat.Shape.ARRAY) on a class ignored by reflection-free Jackson serializers when used inside a List/Set
#55363 - Reflection free deserializers drops data of final collection field with no setter
#55365 - Fix flakiness of RawTypeReflectionFreeSerializerTest
#55366 - Fix serialization of pojos using JsonFormat.Shape enum in reflection-free Jackson serializers
#55369 - quarkus-rest-jackson: reflection-free deserializer ignores @JsonTypeInfo/@JsonSubTypes for polymorphic list elements inside a wrapper type
#55370 - Bail out of reflection-free deserializer when @JsonTypeInfo is used
#55373 - Jacoco + CycloneDX extension breaking combination in Quarkus 3.37.1+
#55374 - Implement getter-as-setter pattern when deserializing private collection in reflection-free Jackson serializers
#55378 - Register gRPC codegen configuration properties
#55380 - Harden remote dev mode against path traversal and unsafe deserialization
#55385 - NPE in modularity can transformed classes
#55396 - Fix NPE in modularity when processing removed resources
#55397 - Ignore unresolvable POMs for bundled CycloneDX components
#55403 - Fix bad link syntax and update cross-document references to use xref
#55410 - quarkus-rest-jackson: Reflection-free deserializer ignores @JsonProperty(required=true) on a @JsonCreator sometimes
#55411 - Take count of @JsonProperty(required=true) on a @JsonCreator in reflection-free Jackson serializers
#55425 - Disable Mockito class cache so thenThrow works across component tests
#55426 - ServerExceptionMapper on sub-resource is global instead of sub-resource specific
#55427 - Make @ServerExceptionMapper in sub-resource specific to that sub-resource
#55450 - Fix serialization of java.time.Duration in generated reflection-free Jackson serializers

`v3.37.2`

Compare Source

Complete changelog

#49524 - IllegalStateException: GlobalOpenTelemetry.set has already been called
#54999 - Produce ServiceStartBuildItem for OTel
#55134 - Add regression tests for QuteProcessor
#55137 - Null boxed Integer and Boolean fields dropped from JSON by reflection-free serializers (Quarkus 3.37)
#55142 - @JsonProperty is ignored or duplicated + 'visibility'-setting is ignored in 'ObjectMapperCustomizer' by reflection-free Jackson serializers
[#&Bump jackson-core from 2.10.0 to 2.10.1 #82

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

github-actions · 2026-05-20T11:34:06Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 372 dependencies

Detected 169 vulnerabilities (10 Critical, 71 High, 84 Medium, 4 Low)

Displaying top 50 vulnerabilities. View the full list on the application.
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                      LIBRARY                      |       ID       |                                               TOP FIX                                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2025-14813 | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-5598  | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-58062 | Upgrade to version org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,                                 |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-59650 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-8763  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-jdk15to18:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,                               |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | freemarker-2.3.34.jar                             | CVE-2026-84939 | Upgrade to version org.freemarker:freemarker:2.3.35,org.freemarker:freemarker-gae:2.3.35,            |
|          |                                                   |                | https://github.com/apache/freemarker.git - v2.3.35                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.5.1.jar                             | CVE-2026-71290 | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                                   |                | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | lz4-1.3.0.jar                                     | CVE-2025-12183 | Upgrade to version org.lz4:lz4-java:1.8.1, https://github.com/yawkat/lz4-java.git - v1.8.1           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.84.Final.jar                    | CVE-2026-75595 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.17.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | undertow-core-2.2.24.Final.jar                    | CVE-2025-12543 | Upgrade to version io.undertow:undertow-core:2.2.39.Final,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.3.21.Final,                                          |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.2.39.Final                                           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-12802 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-fips:1.0.12,                            |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59639 | Upgrade to version org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.1.12,org.bouncycastle:bcpkix-fips:2.0.12,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59642 | Upgrade to version org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-fips:2.0.12,          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                         |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-29857 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78,     |
|          |                                                   |                | BouncyCastle.Cryptography - 2.3.1                                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-30172 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-34447 | Upgrade to version org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78,        |
|          |                                                   |                | org.bouncycastle:bctls-fips:1.0.19                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12803 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12816 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12860 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-13506 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-jdk18on:1.85 |
|          |                                                   |                | ,org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-14682 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.0.2,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk15to18:1.85,                       |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58059 | Upgrade to version org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,          |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:2.0.2,  |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58060 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.0.2 |
|          |                                                   |                | , https://github.com/bcgit/bc-java.git - r1rv85                                                      |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58061 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,                               |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:1.0.2.7,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcutil-jdk18on-1.74.jar                           | CVE-2026-59645 | Upgrade to version org.bouncycastle:bcutil-lts8on:2.73.12,org.bouncycastle:bcutil-fips:2.1.7,        |
|          |                                                   |                | org.bouncycastle:bcutil-jdk18on:1.85,org.bouncycastle:bcutil-jdk15to18:1.85,                         |
|          |                                                   |                | org.bouncycastle:bcutil-fips:2.0.7, https://github.com/bcgit/bc-java.git - r1rv85                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | hibernate-validator-6.0.23.Final-redhat-00001.jar | CVE-2025-35036 | Upgrade to version  https://github.com/hibernate/hibernate-validator.git - 7.0.0.Final,              |
|          |                                                   |                | https://github.com/hibernate/hibernate-validator.git - 6.2.0.Final                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.2.jar                                 | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.3.6.jar                               | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.2.jar                              | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.3.6.jar                            | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                                  | CVE-2026-75140 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-common-25.0.3.jar                        | CVE-2026-74909 | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.6.7,                               |
|          |                                                   |                | https://github.com/keycloak/keycloak.git - 26.7.4, https://github.com/keycloak/keycloak.git -        |
|          |                                                   |                | 26.4.16,org.keycloak:keycloak-common:26.7.4                                                          |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar            | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                                   |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | lz4-1.3.0.jar                                     | CVE-2025-66566 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.10.1                                 |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-42583 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.133.Final,                        |
|          |                                                   |                | io.netty:netty-codec:4.1.133.Final,io.netty:netty-codec-compression:4.2.13.Final,                    |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.13.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-59901 | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-dns-4.1.84.Final.jar                  | CVE-2026-42579 | Upgrade to version io.netty:netty-codec-dns:4.1.133.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final,io.netty:netty-codec-dns:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.2.13.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-33870 | io.netty:netty-codec-http:4.1.132.Final,io.netty:netty-codec-http:4.2.10.Final                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42584 | Upgrade to version io.netty:netty-codec-http:4.1.133.Final, https://github.com/netty/netty.git -     |
|          |                                                   |                | netty-4.2.13.Final,io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55831 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55833 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-56745 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2023-44487 | Upgrade to version org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17,            |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-server:12.0.2,                                                   |
|          |                                                   |                | org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17,                               |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0,       |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3,                                     |
|          |                                                   |                | org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14,                                               |
|          |                                                   |                | org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,  |
|          |                                                   |                | 7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3,v1.57.1,v1.58.3,             |
|          |                                                   |                | kubernetes/kubernetes - v1.25.15,v1.26.10,v1.27.7,v1.28.3,v1.29.0, kubernetes/apimachinery -         |
|          |                                                   |                | v0.25.15,v0.26.10,v0.27.7,v0.28.3,v0.29.0, kubernetes/apiserver- v0.25.15,v0.26.10,v0.27.7,v0.28.3,  |
|          |                                                   |                | v0.29.0                                                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2025-55163 | Upgrade to version  https://github.com/netty/netty.git - 4.2.4.Final,                                |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.124.Final,io.netty:netty-codec-http2:4.1.124.Final,   |
|          |                                                   |                | io.netty:netty-codec-http2:4.2.4.Final                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-33871 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.132.Final,                        |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.11.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-56819 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final,io.netty:netty-codec-http2:4.2.16.Final, |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-59900 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final                                          |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.84.Final.jar                    | CVE-2026-44249 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.15.Final,                         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.135.Final                                             |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

auth-4.0.0-SNAPSHOT.jar
|-- common-4.0.0-SNAPSHOT.jar
	|-- pnc-common-3.5.4-jakarta.jar
		|-- opentelemetry-ext-cli-java-2.0.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-exporter-otlp-1.51.0.jar
				|-- opentelemetry-exporter-sender-okhttp-1.51.0.jar
					|-- opentelemetry-exporter-common-1.51.0.jar
						|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-logs-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-metrics-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-trace-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-1.51.0.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-common-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- jsoup-1.23.1.jar [1 HIGH]
	|-- rest-api-3.6.0-SNAPSHOT-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- dto-3.6.0-SNAPSHOT.jar
			|-- jsoup-1.23.1.jar [1 HIGH]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- xnio-api-3.8.7.Final.jar [2 HIGH]
		|-- xnio-nio-3.8.7.Final.jar
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
	|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
		|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- bcpkix-jdk18on-1.74.jar [3 HIGH, 5 MEDIUM]
				|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
				|-- bcutil-jdk18on-1.74.jar [1 HIGH]
					|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
	|-- keycloak-adapter-spi-25.0.3.jar
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
		|-- keycloak-common-25.0.3.jar [1 HIGH, 2 MEDIUM]
cli-4.0.0-SNAPSHOT.jar
|-- jansi-2.4.3.jar [1 LOW]
|-- experimental-4.0.0-SNAPSHOT.jar
	|-- quarkus-domino-api-0.0.133.jar
		|-- quarkus-platform-bom-decomposer-0.0.133.jar
			|-- quarkus-bootstrap-maven-resolver-3.39.4.jar
				|-- smallrye-beanbag-maven-1.6.1.jar
					|-- jsoup-1.23.1.jar [1 HIGH]
		|-- cyclonedx-core-java-12.1.0.jar
			|-- json-schema-validator-1.5.9.jar
				|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
|-- pig-4.0.0-SNAPSHOT.jar
	|-- logback-core-1.6.3.jar
		|-- jansi-2.4.3.jar [1 LOW]
	|-- commons-compress-1.27.1.jar
		|-- zstd-jni-1.5.7-6.jar [8 HIGH, 1 MEDIUM]
	|-- freemarker-2.3.34.jar [1 CRITICAL]
	|-- javax.el-3.0.1-b12.jar [1 MEDIUM]
	|-- licenses-generator-4.0.0-SNAPSHOT.jar
		|-- maven-embedder-3.9.16.jar
			|-- maven-shared-utils-3.4.2.jar
				|-- jansi-2.4.3.jar [1 LOW]
			|-- jansi-2.4.3.jar [1 LOW]
	|-- core-2.6.7.jar
		|-- zstd-jni-1.5.7-6.jar [8 HIGH, 1 MEDIUM]
		|-- commons-vfs2-2.10.0.jar
			|-- httpclient5-5.5.1.jar [1 CRITICAL, 1 MEDIUM]
			|-- httpcore5-5.3.6.jar [1 HIGH]
		|-- httpclient5-5.5.1.jar [1 CRITICAL, 1 MEDIUM]
			|-- httpcore5-h2-5.3.6.jar [1 HIGH]
				|-- httpcore5-5.3.6.jar [1 HIGH]
			|-- httpcore5-5.3.6.jar [1 HIGH]
		|-- jhttpc-1.16.jar
... *truncated, see full logs below*

SAST scan output

*no findings*

Full logs and artifacts

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from a3b04ff to d589e1d Compare June 3, 2026 09:32

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.36.0~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.36.1 Jun 3, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from d589e1d to 1b4b0d2 Compare June 15, 2026 17:46

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.36.1~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.36.2 Jun 15, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from 1b4b0d2 to 0e7b444 Compare June 20, 2026 17:59

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.36.2~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.37.0 Jun 20, 2026

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.37.0~~ Update quarkus.resolver.version to v3.37.0 Jun 25, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from 0e7b444 to b7473bc Compare July 4, 2026 13:04

red-hat-konflux Bot changed the title ~~Update quarkus.resolver.version to v3.37.0~~ Update quarkus.resolver.version to v3.37.1 Jul 4, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from b7473bc to 9b45c6b Compare July 11, 2026 13:18

red-hat-konflux Bot changed the title ~~Update quarkus.resolver.version to v3.37.1~~ Update quarkus.resolver.version to v3.37.2 Jul 11, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from 9b45c6b to 17c9b3e Compare July 18, 2026 09:28

red-hat-konflux Bot changed the title ~~Update quarkus.resolver.version to v3.37.2~~ Update quarkus.resolver.version to v3.37.3 Jul 18, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch 2 times, most recently from 9c5c5fb to 287201c Compare July 25, 2026 20:32

red-hat-konflux Bot changed the title ~~Update quarkus.resolver.version to v3.37.3~~ Update quarkus.resolver.version to v3.38.0 Jul 25, 2026

red-hat-konflux Bot changed the title ~~Update quarkus.resolver.version to v3.38.0~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.38.0 Aug 3, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from 287201c to fbdc916 Compare August 7, 2026 13:23

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.38.0~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.38.1 Aug 7, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from fbdc916 to a4966e6 Compare August 16, 2026 01:18

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.38.1~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.38.2 Aug 16, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from a4966e6 to 04b3921 Compare August 23, 2026 01:52

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.38.2~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.0 Aug 23, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from 04b3921 to fbe269a Compare August 30, 2026 01:25

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.0~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.1 Aug 30, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from fbe269a to 8f6bfd5 Compare September 6, 2026 00:46

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.1~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.2 Sep 6, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from 8f6bfd5 to abbb8ab Compare September 13, 2026 00:42

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.2~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.3 Sep 13, 2026

Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.4

aaa8b0b

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/quarkus.resolver.version branch from abbb8ab to aaa8b0b Compare September 20, 2026 01:10

red-hat-konflux Bot changed the title ~~Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.3~~ Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.4 Sep 20, 2026

Navigation Menu

Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.4 - #1758

Update dependency io.quarkus:quarkus-bootstrap-maven-resolver to v3.39.4#1758
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/quarkus.resolver.version

red-hat-konflux Bot commented May 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

red-hat-konflux Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Major changes

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Complete changelog

Configuration

Documentation

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading