Quarkus 3.36 - Quarkus Signals, embedded SBOMs, OIDC SPIFFE authentication, and more
We’re pleased to announce the release of Quarkus 3.36.
This release brings several notable features:
-
#53788 - Quarkus Signals experimental extension
-
#53552 - Embedded dependency SBOMs and SBOM endpoint
-
#53923 - Embed SBOM in native images
-
#53773 - OIDC SPIFFE client authentication
-
#53491 - Arbitrary keystore/truststore types
-
#53415 - Dynamic JSON field additions for logging
-
#53856 - GraphQL client TLS reload
Actualización
To update to Quarkus 3.36, we recommend updating to the latest version of the Quarkus CLI and run:
quarkus updateNote that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.36.
For more information about the adjustments you need to make to your applications, please refer to the Quarkus 3.36 migration guide.
What’s new?
Quarkus Signals
Quarkus Signals is a new experimental extension that enables application components to interact in a loosely coupled fashion through emitting and receiving signals.
What it offers:
-
Type-safe resolution inspired by CDI events - signals are matched to receivers based on type and qualifiers.
-
Three emission modes inspired by the Vert.x
EventBus: publish (multicast to all receivers), send (unicast with round-robin selection), and request-reply (unicast with a typed response). A convenient blocking API is provided for each mode, with an optional reactive API returningUni. -
Flexible execution model - receivers run asynchronously and support blocking, non-blocking, and virtual thread execution, following standard Quarkus conventions (
@Blocking,@NonBlocking,@RunOnVirtualThread, etc.). -
Programmatic receivers - register and unregister receivers at runtime via a fluent builder API.
-
Signal metadata - attach arbitrary key-value pairs to emissions, accessible by receivers through
SignalContext. -
SPI for integrators - extend behavior with
SignalMetadataEnricherandReceiverInterceptor.
As mentioned, the extension is experimental, and feedback is highly welcome!
Embedded dependency SBOMs
Quarkus now supports embedding dependency SBOMs (Software Bill of Materials) into built applications and exposing them via an endpoint (/.well-known/sbom by default).
For native images, SBOMs can also be embedded directly into the native binary, following the GraalVM SBOM specification.
The CycloneDX guide has been updated to document the new options and includes an example of how to use SBOMs for vulnerability scanning.
OIDC SPIFFE client authentication
Quarkus now supports using SPIFFE JWT tokens for client authentication between Quarkus OIDC and providers such as Keycloak.
This enables workload identity-based authentication following the SPIFFE standard, making it particularly useful for zero-trust environments and service-to-service communication.
Arbitrary keystore/truststore types
The TLS registry now supports arbitrary keystore and truststore types (e.g. BCFKS) via a new other configuration group.
You can configure them using quarkus.tls.key-store.other.type=<type> without writing code.
For types that need custom loading logic, you can provide a KeyStoreFactory or TrustStoreFactory CDI bean annotated with @Identifier matching the type value.
Dynamic JSON field additions for logging
A new JsonProvider SPI allows per-record dynamic JSON field additions to the JSON logging output.
This enables you to enrich log records with custom fields dynamically at runtime.
GraphQL client TLS reload
The GraphQL client now supports dynamic TLS configuration reloading. Previously, TLS configuration was only picked up when obtaining a new client instance, requiring a shorter CDI scope. With this change, TLS reloads happen immediately and also work for application-scoped clients.
Registro completo de cambios
You can get the full changelog of 3.36.0.CR1 and 3.36.0 on GitHub.
Colaboradores
The Quarkus community is growing and has now 1197 contributors. Many many thanks to each and everyone of them.
In particular for the 3.36 release, thanks to Ales Justin, Alex Martel, Alexey Loubyansky, Arthur Navarro, Ashish Thakur, Aurea Munoz, Bruno Baptista, Chris Laprun, Christian Navolskyi, Clement Escoffier, Cristiano Nicolai, Daan Hoogenboezem, DerFrZocker, Foivos Zakkak, Foobartender, Fouad Almalki, Francesco Nigro, George Gastaldi, Georgios Andrianakis, Guillaume Smet, Holly Cummins, Inaki Villar, Jakub Jedlicka, Jamal Dabari, Jan Martiska, Julien Ponge, kyooosukedn, Ladislav Thon, lu1tr0n, Luca Molteni, Marco Sappe Griot, mariofusco, Martin Kouba, Matej Novotny, Matej Vašek, Matheus Cruz, MdTanwer, Michael Edgar, Michal Maléř, Michal Vavřík, Ozan Gunalp, pandareen, Paramvir Jindal, Paulo Casaes, Phillip Krüger, PreetiYadav, Roberto Cortez, Rolfe Dlugy-Hegwer, Roman Huber, Sanne Grinovero, SAY-5, Sergey Beryozkin, Severin Gehwolf, Shivam Srivastav, Steve Hawkins, Stéphane Épardaud, tanw9004167, Teymur Babayev, Thomas Segismont, tom, Victor Queiroz, Vishal Kumar Singh, xstefank, Yoann Rodière, and Yoshikazu Nojima.
Únete a nosotros
Valoramos mucho tus comentarios, así que por favor reporta errores, solicita mejoras… ¡Construyamos algo grandioso juntos!
Si eres un usuario de Quarkus o simplemente tienes curiosidad, no seas tímido y únete a nuestra acogedora comunidad:
-
proporcionar retroalimentación en GitHub;
-
escribir algo de código y enviar push a PR;
-
comentar con nosotros en Zulip y en nuestra lista de correo;
-
hacer tus preguntas en Stack Overflow.
