Release published Quarkus 3.36 — A Java framework for cloud-native applications focused on containers, Kubernetes, JVM, and native compilation. The release took place on May 27, 2026. The main changes are related to a new experimental signal exchange mechanism between components, improvements in supply chain security, TLS, and OIDC authentication for zero-trust scenarios.
For updates, developers recommend using the latest version of Quarkus CLI and running:
quarkus update
According to the project, the quarkus update command can update applications to Quarkus 3.36 even from Quarkus 2.x branches.
Key changes
Quarkus Signals — an experimental extension for signal exchange between components.
Quarkus has introduced a new mechanism allowing application components to interact in a loosely coupled manner: one component sends a signal, and another receives it. Recipient resolution is type-safe and inspired by CDI events: signals are matched with handlers based on type and qualifiers. Three modes are supported: publish — broadcasting to all recipients, send — sending to one recipient with round-robin selection, and request-reply — a request with a typed response. Each mode has a blocking API and a reactive API based on Uni.A flexible execution model for signal handlers.
Signal recipients are executed asynchronously and can function as blocking, non-blocking, or runnable on virtual threads. Familiar Quarkus annotations such as @Blocking, @NonBlocking, and @RunOnVirtualThread are used for this purpose. There is also support for registering and unregistering handlers at runtime via a fluent builder API.Metadata for signals and SPI for integrators.
Arbitrary key-value pairs can be attached to signals, accessible to handlers through SignalContext. To extend behavior, integration points SignalMetadataEnricher and ReceiverInterceptor have been added. The extension is still in an experimental status, and developers are awaiting feedback from users.Embedded SBOM for dependencies.
Quarkus can now embed SBOM — Software Bill of Materials, which describes the composition of dependencies — directly into built applications. By default, such an SBOM can be delivered via the endpoint /.well-known/sbom. This is useful for auditing dependencies, inventorying components, and subsequent vulnerability scanning.SBOM in native images.
The ability to embed SBOM directly into the native binary file according to the GraalVM SBOM specification has been added for native image. This addresses the scenario where the application is distributed not as a JVM artifact, but as a standalone executable file.OIDC client authentication via SPIFFE.
Quarkus OIDC has added support for SPIFFE JWT tokens for client authentication to providers like Keycloak. This change is aimed at infrastructures with workload identity, a zero-trust model, and service-to-service interactions, where workload identity is more important than static secrets.Arbitrary types for keystore and truststore.
The TLS Registry now supports arbitrary types of key and trusted certificate stores, such as BCFKS, via a new configuration group called other. The type can be specified with the parameter quarkus.tls.key-store.other.type= without writing additional code. If custom loading logic is required for the type, a CDI bean KeyStoreFactory or TrustStoreFactory with the corresponding @Identifier can be provided.Dynamic fields in JSON logs.
A new SPI JsonProvider has been added, allowing fields to be dynamically added to JSON logs for each entry. This enables enriching logs with runtime context, such as additional request identifiers, service tags, or environment data.Hot reload of TLS for GraphQL client.
The GraphQL client now supports dynamic reloading of TLS configuration. Previously, the new TLS configuration was only picked up when a new client instance was created, requiring a reduction of the CDI scope. Now the update is applied immediately and works, including for clients with application scope.
Additional changes and updates to components.
In the final release, 3.36.0 there were also improvements to Signals, Gradle upgrade to 9.5.1, Jackson BOM to 2.21.3, slf4j-api to 2.0.18, Microsoft SQL Server JDBC driver to 13.4.0, support for multiple SunPKCS11 configurations, fix for POM generation for external extensions, and the addition of preauthorized_code as a variant of the OidcClient grant type.
The Quarkus platform components have also been updated: Camel Quarkus 3.36.0, Debezium 3.5.1.Final, Quarkus Amazon Services 3.19.0, Quarkus LangChain4j 1.10.0, Quarkus MCP Server 1.12.1 and Quarkus Operator SDK 7.7.5.
Source: linux.org.ru
