Skip to content

[3.33] 3.33.3 backports 4#55400

Merged
gsmet merged 23 commits into
quarkusio:3.33from
gsmet:3.33.3-backports-4
Jul 11, 2026
Merged

[3.33] 3.33.3 backports 4#55400
gsmet merged 23 commits into
quarkusio:3.33from
gsmet:3.33.3-backports-4

Conversation

@gsmet

@gsmet gsmet commented Jul 10, 2026

Copy link
Copy Markdown
Member

Please don't merge, I will merge it myself.

jmartisk and others added 23 commits July 10, 2026 14:10
…or for reflection"

This reverts commit 3e73718.

(cherry picked from commit cd115a5)
…ain source set resources

When the org.kordamp.gradle.jandex or com.github.vlsi.jandex plugin is applied, its jandex/processJandexIndex task writes into build/resources/main. Every Quarkus task that calls configureQuarkusBuildTask() receives mainSourceSet.getResources() — which resolves to the same directory — as part of its compile classpath input. Gradle 9 task-validation detects this as an implicit dependency and fails with WorkValidationException.

PR quarkusio#48363 already fixed this for quarkusDependenciesBuild and quarkusDev using addDependencyOnJandexIfConfigured() + afterEvaluate(). This change applies the same pattern to all remaining affected tasks: imageBuild, imagePush (reported in quarkusio#54729), quarkusAppPartsBuild, deploy, buildAotEnhancedImage, and quarkusShowEffectiveConfig.

Fixes quarkusio#54729

(cherry picked from commit 97b1380)
…ernetes-client

Signed-off-by: xstefank <xstefank122@gmail.com>
(cherry picked from commit 3b2e8a0)
Signed-off-by: Ahmed El amraouiyine <ahmed.elamraouiyine@vilavi.fr>
(cherry picked from commit 28d7008)
Fixes: quarkusio#54604

Co-authored-by: xstefank <xstefank122@gmail.com>
(cherry picked from commit b551fb1)
(cherry picked from commit 6ea2068)
There were essentially two leaks that seemed to only show up
when `Multi#transformToUniAndConcatenate` was used (or at least
the first does for sure).

1. Context chaining via `newNestedContext`: In a reactive pipeline, the
   next REST client call runs on the previous call's duplicated context.
   `newNestedContext` stores a `__PARENT_CONTEXT__` reference to it, forming
   an unbounded chain where no context
   can be GC'd.

2. Context retention via `Response`: The `Response` object retains the
   `RestClientRequestContext`, which holds the duplicated context through
   both the clientRequestContext field and the properties map. These
   references outlive the handler chain.

Closes: quarkusio#54639
(cherry picked from commit 2febb03)
(cherry picked from commit 02fea44)
This is done in order to give users a way to always have
 `ContainerResponseFilter`, regardless of whether the connection
 is still open

 Closes: quarkusio#54889

(cherry picked from commit 0195bf4)
Closes: quarkusio#55008

Signed-off-by: Michal Vavřík <dev@michalvavrik.net>
(cherry picked from commit a2001a7)
Add the banDuplicatePomDependencyVersions rule to fail the build
when a dependency is declared more than once in a pom.xml.

(cherry picked from commit 654e274)
The regression was introduced by quarkusio#53885.
When using AOT,
AotQuarkusEntryPoint.class.getResource(AotQuarkusEntryPoint.class.getSimpleName()
+ ".class") is actually quite costly so we should avoid calling it
  when it's not needed.

Which should always be the case at some point, once the bug we are
working around is fixed.

(cherry picked from commit c0cc814)
Bumps [com.ongres.scram:scram-client](https://github.com/ongres/scram) from 3.2 to 3.3.
- [Release notes](https://github.com/ongres/scram/releases)
- [Changelog](https://github.com/ongres/scram/blob/main/CHANGELOG.md)
- [Commits](ongres/scram@3.2...3.3)

---
updated-dependencies:
- dependency-name: com.ongres.scram:scram-client
  dependency-version: '3.3'
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 66e4884)
The SmallRye GraphQL extension ships MaxQueryDepthInstrumentation but
the instrumentation-query-depth property had no default, leaving
applications with cyclic type graphs exposed to memory exhaustion from
a single deeply nested query.

A default of 10 covers virtually all legitimate query patterns. Users
can override via quarkus.smallrye-graphql.instrumentation-query-depth.

(cherry picked from commit 7b01e8f)
Bumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from 42.7.11 to 42.7.13.
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.11...REL42.7.13)

---
updated-dependencies:
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit a1f9b50)
@gsmet gsmet self-assigned this Jul 10, 2026
@gsmet gsmet added the area/infra internal and infrastructure related issues label Jul 10, 2026
@gsmet gsmet requested a review from a team July 10, 2026 12:13
@quarkus-bot

quarkus-bot Bot commented Jul 10, 2026

Copy link
Copy Markdown

/cc @aloubyansky (3.33), @jmartisk (3.33), @rsvoboda (3.33)

@quarkus-bot quarkus-bot Bot added area/core area/dependencies Pull requests that update a dependency file labels Jul 10, 2026
@quarkus-bot quarkus-bot Bot added area/devtools Issues/PR related to maven, gradle, platform and cli tooling/plugins area/documentation area/gradle Gradle area/graphql area/health area/jbang Issues related to when using jbang.dev with Quarkus area/kafka area/kubernetes area/maven area/metrics area/oidc area/picocli area/platform Issues related to definition and interaction with Quarkus Platform area/rest area/smallrye area/testing labels Jul 10, 2026
@quarkus-bot quarkus-bot Bot changed the title 3.33.3 backports 4 [3.33] 3.33.3 backports 4 Jul 10, 2026
@quarkus-bot

quarkus-bot Bot commented Jul 10, 2026

Copy link
Copy Markdown

Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 93e586f.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

@gsmet gsmet merged commit 6b831f5 into quarkusio:3.33 Jul 11, 2026
62 of 65 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/core area/dependencies Pull requests that update a dependency file area/devtools Issues/PR related to maven, gradle, platform and cli tooling/plugins area/documentation area/gradle Gradle area/graphql area/health area/infra internal and infrastructure related issues area/jbang Issues related to when using jbang.dev with Quarkus area/kafka area/kubernetes area/maven area/metrics area/oidc area/picocli area/platform Issues related to definition and interaction with Quarkus Platform area/rest area/smallrye area/testing

Projects

None yet

Development

Successfully merging this pull request may close these issues.