Bump quarkus.version from 3.38.0 to 3.38.1 by dependabot[bot] · Pull Request #101 · project-ncl/uilogger

dependabot · 2026-08-17T22:44:59Z

Bumps quarkus.version from 3.38.0 to 3.38.1.
Updates io.quarkus:quarkus-bom from 3.38.0 to 3.38.1

Release notes

Sourced from io.quarkus:quarkus-bom's releases.

3.38.1

Complete changelog

#54725 - Improve Basic authentication how-to

#54781 - Vert.x's FileSystemOptions contains constants getting defined at build time

#54885 - Tests do not start

#55023 - Support management interface dynamic port in integration tests

#55062 - REST Client: Content-Type header not set when provided via jakarta.ws.rs.client.Entity

#55138 - Overwrite content-type header provided via the variant of the entity

#55267 - Initialize Vert.x FileSystemOptions at runtime for native image

#55317 - @QuarkusTest bootstrap deadlocks during parallel deployment-dependency resolution

#55345 - Pre-init Maven resolver HTTP transport classes to avoid class loading deadlock

#55405 - Bump smallrye-open-api.version from 4.3.3 to 4.3.5

#55498 - Remove the CI job that runs k8s tests on Windows

#55520 - JaCoCo: also instrument classes for dev mode tests

#55525 - JaCoCo: QuarkusExtensionTest does not contribute to coverage report

#55549 - Copy executionMaxDelay and description in CompositeScheduler

#55564 - Bump keycloak-client.version from 26.0.10 to 26.0.11

#55578 - Kotlin 2.4.0: overriding a generic suspend fun in a JAX-RS resource breaks endpoint scanning

#55588 - Bump io.rest-assured:rest-assured from 6.0.0 to 6.0.1

#55595 - Ignore synthetic methods in RESTEasy Reactive sub-resource scan

#55618 - Limit of 18 OpenAPI Profiles

#55620 - Fix EnumMap ClassCastException in bytecode recorder on method split

#55633 - Bump com.google.cloud.tools:jib-core from 0.28.1 to 0.28.2

#55636 - Fix JaCoCo coverage for QuarkusExtensionTest

#55640 - Enforce managed versions on direct dependencies of an application artifact provided as a JAR

#55643 - Access log cookie masking bypassed for cookies not first in the header

#55644 - Fix access log cookie masking to check all cookie pairs

#55652 - quarkus-rest-jackson Reflection-free-serializers fails on deserializing JsonAlias with same value as fieldname

#55655 - Remove value registry, not used

#55678 - @JsonFormat(pattern = "...") on a java.util.Date field is ignored by Reflection-free Jackson serializers

#55686 - GraphQL+OIDC issue with default configuration and native

#55687 - quarkus-rest-jackson Reflection-free-serializers serializes @Transient annotated methods

#55691 - OIDC GraphQL client: fix NPE when default OIDC client is configured and native mode

#55694 - [3.x] In reflection-free Jackson serializers skip deserialization of a JsonAlias having the same name of the field

#55701 - @TestHTTPEndpoint not propagated to @Nested subclasses.

#55702 - reflection-free serializers ignore @JsonValue declared on a superinterface method (multi-level)

#55703 - Make sure @TestHTTPEndpoint works with nested classes

#55706 - [3.x] Fix serialization of formatted date in reflection-free Jackson serializers

#55707 - Treat @Transient as @JsonIgnore in reflection-free Jackson serializers

#55713 - Fix multi-level @JsonValue inheritance in reflection-free serializers

#55714 - REST Client hangs forever on any 3xx response without a Location header (e.g. 304 Not Modified) when followRedirects is enabled and an HttpClientRequest customizer is registered

#55717 - [3.x] Fix REST Client hang when a 3xx response has no Location header

#55719 - Remove nonsensical configuration from Hibernate Search AI skill

#55728 - Bump org.hibernate.validator:hibernate-validator from 9.1.2.Final to 9.1.3.Final

#55737 - Fix reproducibility checks for quarkus-rest-deployment

#55746 - REST Client silently drops @MatrixParam / @RestMatrix parameters

#55751 - Send @MatrixParam and @RestMatrix from the REST Client

#55778 - quarkus-rest-jackson: reflection-free deserializer erases nested type arguments (Map<String, List<Foo>> elements become LinkedHashMap)

... (truncated)

Commits

fbd3706 [RELEASE] - Bump version to 3.38.1
996441b Merge pull request #55814 from gsmet/3.38.1-backports-1
ba908c2 Upgrade aesh to 3.16.6 and register MetadataRegistry for native image
111f82d Preserve nested type arguments in reflection-free Jackson deserializers
6cf851b Bump org.hibernate.validator:hibernate-validator
79c52ac Bump smallrye-open-api.version from 4.3.3 to 4.3.5
0d476e2 Send @MatrixParam and @RestMatrix from the REST Client
0de18cb Properly set test=true in QuarkusExtensionTest and Arquillian
4aa6968 Fix JaCoCo coverage for QuarkusExtensionTest
09d99a4 JaCoCo: also instrument classes for dev mode tests
Additional commits viewable in compare view

Updates io.quarkus:quarkus-maven-plugin from 3.38.0 to 3.38.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps `quarkus.version` from 3.38.0 to 3.38.1. Updates `io.quarkus:quarkus-bom` from 3.38.0 to 3.38.1 - [Release notes](https://github.com/quarkusio/quarkus/releases) - [Commits](quarkusio/quarkus@3.38.0...3.38.1) Updates `io.quarkus:quarkus-maven-plugin` from 3.38.0 to 3.38.1 --- updated-dependencies: - dependency-name: io.quarkus:quarkus-bom dependency-version: 3.38.1 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.quarkus:quarkus-maven-plugin dependency-version: 3.38.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-17T22:53:24Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 240 dependencies

Detected 3 vulnerabilities (0 Critical, 0 High, 3 Medium, 0 Low)

+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| SEVERITY |              LIBRARY               |       ID       |                                             TOP FIX                                             |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar        | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4, |
|          |                                    |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1,                    |
|          |                                    |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                    |
|          |                                    |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                    |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                             |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.21.5                                              |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar        | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                          |
|          |                                    |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,            |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                              |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.136.Final.jar | CVE-2026-59903 | io.netty:netty-codec-http:4.2.17.Final,io.netty:netty-codec-http:4.1.137.Final                  |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-resteasy-jsonb-3.38.1.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-resteasy-3.38.1.jar
|-- quarkus-vertx-utils-3.38.1.jar
	|-- vertx-web-4.5.30.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-resteasy-server-common-3.38.1.jar
	|-- quarkus-resteasy-common-3.38.1.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-scheduler-3.38.1.jar
|-- quarkus-vertx-http-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-vertx-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- quarkus-netty-3.38.1.jar
		|-- netty-codec-http2-4.1.136.Final.jar
			|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-virtual-threads-3.38.1.jar
	|-- vertx-core-4.5.30.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-handler-proxy-4.1.136.Final.jar
			|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
quarkus-smallrye-openapi-3.38.1.jar
|-- smallrye-open-api-core-4.3.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- jackson-dataformat-yaml-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pnc-api-3.5.2.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]


No Policy violations were detected

Project 'uilogger' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=6ca5d47f-9a9f-4e41-952c-d74df9e42cad
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=502c7274beb747329b34f56627f422d54f0a6df63ac0466fa6dff2503f046401

Mend AI scan succeeded.

Support Token: 3ca926348f2e14799a65d28d2e3f37a191787007141604

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 17, 2026

thescouser89 merged commit 42f0ac6 into master Aug 19, 2026
3 checks passed

dependabot Bot deleted the dependabot/maven/quarkus.version-3.38.1 branch August 19, 2026 13:52

Navigation Menu

Uh oh!

Bump quarkus.version from 3.38.0 to 3.38.1 - #101

Bump quarkus.version from 3.38.0 to 3.38.1#101
thescouser89 merged 1 commit into
masterfrom
dependabot/maven/quarkus.version-3.38.1

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026

3.38.1

Complete changelog

Uh oh!

github-actions Bot commented Aug 17, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant