Bump quarkus.version from 3.37.3 to 3.38.0

[dependabot]

Bumps quarkus.version from 3.37.3 to 3.38.0.
Updates io.quarkus:quarkus-bom from 3.37.3 to 3.38.0

Release notes

Sourced from io.quarkus:quarkus-bom's releases.

3.38.0

Complete changelog

• #55401 - @RegisterForProxy is silently ignored when used more than once on the same type
• #55402 - Use getAnnotationsWithRepeatable for handling repeatable annotations in proxy registration logic
• #55469 - Updates to Infinispan 16.0.14
• #55501 - Gradle: Add Gradle-version dependent warnings
• #55536 - Fix scalpel configuration

3.38.0.CR1

Complete changelog

• #27362 - Quarkus Lambda IT failing with java.net.SocketTimeoutException: Read timed out
• #29141 - Mailer stuck when sending a message from GraphQL endpoint
• #36215 - Imperative Mailer not working with smallrye-graphql
• #45227 - Generating the OpenShift Route CRD using the quarkus-maven-plugin fails when using TLS b/c is adds a path field
• #46899 - Spring Data API Extension Dynamic Projections not working
• #49975 - Support Vertx context propagation in Kotlin coroutine gRPC services
• #50151 - Make @SpringBootTest annotation work
• #50685 - quarkus-rest treats semicolon as a separator in query parameters
• #52703 - Opentelemtry VertxGrpcSpanExporter + NoopSpanExporter
• #53312 - Testcontainers are not reused between builds and test executions with testcontainers.reuse.enable=true
• #53350 - Cross-application AMQP Dev Services sharing broken — ContainerLocator not updated for new discovered() API
• #53431 - Panache Next: Switch to JD 1.1 Page and PageRequest
• #53943 - Add a property requiring to use client authentication for all OIDC endpoints
• #54290 - Document priority of configs in various dev and test profiles as well as overriding possibilities
• #54384 - quarkus-hibernate-panache-next: in Kotlin, WithId.AutoUUID fails with Unknown integral data type for ids: UUID
• #54402 - Allow trusted proxy CA subject DN to be verified
• #54537 - @Transactional does not work in Hibernate Reactive with Panache
• #54592 - SPI to have other extensions contribute (static) Hibernate Persistence Unit definitions
• #54593 - Use a per-request TaskQueue for blocking GraphQL over WebSockets
• #54596 - Migrate from quarkus-local-cache to Caffeine + JCache
• #54668 - Hibernate ORM 7.4 temporal entity support testing
• #54691 - Quarkus ForwardedParser does not validate proto values from Forwarded and X-Forwarded-Proto headers
• #54788 - Native build with future defaults fails when CLDR locale data uses disabled service loader
• #54802 - Support stream in maven create project mojo
• #54814 - KnownCompatibleBeanArchiveBuildItem: support maven type
• #54870 - HttpServerMetricsTagsContributor tags are not applied on the requestReset path, causing inconsistent tag keys for http_server_requests_seconds (quarkus-micrometer-registry-prometheus)
• #54965 - quarkus-data-hibernate: PanacheRepository.flush() (no-arg) throws IllegalStateException: Entity 'java.lang.Class' was not found
• #54971 - GraphQL blocking resolvers using Hibernate without @Transactional silently break with parallel execution
• #55045 - OIDC: Eager startup validation of JWT bearer token file prevents lazy file creation
• #55063 - SpringDataRepositoryCreator generates duplicate findAll() method when extending bare Repository marker interface with explicit findAll() declaration
• #55131 - quarkus-dev.properties is not loaded in quarkusDev when gradle-worker.no-process=true
• #55282 - Support weight-based (memory) eviction for Hibernate 2LC Caffeine cache regions

3.37.4

Complete changelog

... (truncated)

Commits

• 0b8f289 [RELEASE] - Bump version to 3.38.0
• 462bcec Merge pull request #55592 from gsmet/3.38.0-backports-1
• cde0276 Set Unix permissions when copying entries into function.zip
• 9e37685 Fix scalpel configuration
• 7299dff Make sure MavenProjects available through the API are added to the Quarkus wo...
• 9aa664a Prevent unboxing of null Character in reflecton-free Jackson serializers
• 2cee817 Update to Hibernate Validator 9.1.2
• 584707c Update to Hibernate ORM 7.4.5
• 3415437 Gradle: Add Gradle-version dependent warnings
• 1e6d4e4 Implement @​JsonAnyGetter on fields in reflection-free Jackson serializers
• Additional commits viewable in compare view

Updates io.quarkus:quarkus-maven-plugin from 3.37.3 to 3.38.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output

-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| SEVERITY |           LIBRARY           |       ID       |                                             TOP FIX                                             |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4, |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                             |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                             |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                    |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                    |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                     |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                          |
|          |                             |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,            |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                              |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| LOW      | HdrHistogram-2.2.2.jar      | CVE-2026-14683 | N/A                                                                                             |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| LOW      | HdrHistogram-2.2.2.jar      | CVE-2026-14684 | N/A                                                                                             |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| LOW      | HdrHistogram-2.2.2.jar      | CVE-2026-14685 | N/A                                                                                             |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+
| LOW      | HdrHistogram-2.2.2.jar      | CVE-2026-14686 | N/A                                                                                             |
+----------+-----------------------------+----------------+-------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-micrometer-opentelemetry-3.38.0.jar
|-- quarkus-micrometer-3.38.0.jar
	|-- micrometer-core-1.17.0.jar
		|-- HdrHistogram-2.2.2.jar [4 LOW]
	|-- LatencyUtils-2.0.3.jar
		|-- HdrHistogram-2.2.2.jar [4 LOW]
quarkus-openshift-client-3.38.0.jar
|-- openshift-client-7.8.0.jar
	|-- kubernetes-client-api-7.8.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-datatype-jsr310-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- kubernetes-model-core-7.8.0.jar
			|-- kubernetes-model-common-7.8.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-kubernetes-client-3.38.0.jar
	|-- kubernetes-client-7.8.0.jar
		|-- zjsonpatch-7.8.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- kubernetes-httpclient-vertx-7.8.0.jar
		|-- vertx-web-client-4.5.30.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- quarkus-jackson-3.38.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-datatype-jdk8-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-module-parameter-names-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-resteasy-jsonb-3.38.0.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-resteasy-3.38.0.jar
|-- quarkus-vertx-utils-3.38.0.jar
	|-- vertx-web-4.5.30.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-resteasy-server-common-3.38.0.jar
	|-- quarkus-resteasy-common-3.38.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-vertx-http-3.38.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-scheduler-3.38.0.jar
|-- quarkus-vertx-3.38.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-dataformat-yaml-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-virtual-threads-3.38.0.jar
	|-- vertx-core-4.5.30.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]


No Policy violations were detected

Project 'openshift-object-cleaner' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=f36b0deb-79c3-450c-9436-c27d886b72d8
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=129b61a916db4ac69ff609e133a2b29b7a6e40ad73d2423bbdd530ed9d671e04

Mend AI scan succeeded.

Support Token: 2c138d8504f2348e6836fc86b7ea0ee571785423316102

SAST scan output

*no findings*

Full logs and artifacts