Bump quarkus.version from 3.38.1 to 3.38.2

[dependabot]

Bumps quarkus.version from 3.38.1 to 3.38.2.
Updates io.quarkus:quarkus-bom from 3.38.1 to 3.38.2

Release notes

Sourced from io.quarkus:quarkus-bom's releases.

3.38.2

Complete changelog

• #55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
• #55169 - Changing how connection closure is handled to avoid a race condition
• #55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
• #55298 - Fix test selection for nested test classes
• #55554 - Bump to Vert.x 4.5.31
• #55560 - [3.x] maven native integration tests fail after #55461
• #55584 - Qute localization breaks with too many entries
• #55587 - Add presence checks on substituted Netty classes
• #55653 - Fix VerifyError for large Qute message bundles
• #55675 - Serialization issue in rest endpoints when class has empty constructor
• #55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
• #55760 - Upgrade Yasson from 3.0.4 to 3.0.5
• #55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
• #55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
• #55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
• #55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
• #55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
• #55849 - Merge isPublicConstructors() when a reflective class is registered twice
• #55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
• #55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
• #55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
• #55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
• #55867 - ArC: fix client proxy name collision for producers
• #55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
• #55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
• #55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
• #55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
• #55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
• #55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
• #55912 - Tree Shaker breaks hibernate filters
• #55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
• #55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
• #55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
• #55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change

Commits

• a160716 [RELEASE] - Bump version to 3.38.2
• 2d1b4e2 Merge pull request #55961 from gsmet/3.38.2-backports-1
• ca6d508 Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
• 5b94e27 Bump to Vert.x 4.5.31
• 02cfa9e Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
• ff35071 Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
• c6c9fbe fix: changing how connection closure is handled
• 88e7707 Initilize at runtime BC FIPS classes that embed Cleaner
• 4b2de67 Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
• 4065534 Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
• Additional commits viewable in compare view

Updates io.quarkus:quarkus-maven-plugin from 3.38.1 to 3.38.2

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output

Identified 240 dependencies

Detected 4 vulnerabilities (0 Critical, 0 High, 4 Medium, 0 Low)

+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |           LIBRARY           |       ID       |                                               TOP FIX                                                |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                          |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                             |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar  | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.17.1,io.micrometer:micrometer-core:1.16.7         |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar  | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-registry-statsd:1.16.7,                                  |
|          |                             |                | https://github.com/micrometer-metrics/micrometer.git - v1.17.1,io.micrometer:micrometer-core:1.16.7, |
|          |                             |                | io.micrometer:micrometer-core:1.17.1, https://github.com/micrometer-metrics/micrometer.git - v1.16.7 |
|          |                             |                | ,io.micrometer:micrometer-registry-statsd:1.17.1                                                     |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-hibernate-orm-3.38.2.jar
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-micrometer-opentelemetry-3.38.2.jar
|-- quarkus-micrometer-3.38.2.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-resteasy-jsonb-3.38.2.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-resteasy-3.38.2.jar
|-- quarkus-resteasy-server-common-3.38.2.jar
	|-- quarkus-resteasy-common-3.38.2.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-vertx-http-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- vertx-web-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-scheduler-3.38.2.jar
|-- quarkus-vertx-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-virtual-threads-3.38.2.jar
	|-- vertx-core-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-smallrye-openapi-3.38.2.jar
|-- smallrye-open-api-core-4.3.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- jackson-dataformat-yaml-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]


No Policy violations were detected

Project 'uilogger' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=6ca5d47f-9a9f-4e41-952c-d74df9e42cad
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=502c7274beb747329b34f56627f422d54f0a6df63ac0466fa6dff2503f046401

Mend AI scan succeeded.

Support Token: 04b365e6cded94e01a19d8db0d01e0a491787611853243

SAST scan output

*no findings*

Full logs and artifacts