This is an automated email from the ASF dual-hosted git repository.
gitgabrio pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-drools.git
The following commit(s) were added to refs/heads/main by this push:
new 687fd5018ab NO-ISSUE: upgrade micrometer-core from 1.14.7 to 1.16.6 in
OptaPlanner modules (#6810)
687fd5018ab is described below
commit 687fd5018ab5bae7b1a7d267e874ccb2f097be9c
Author: athirakm94 <[email protected]>
AuthorDate: Fri Jul 17 15:13:28 2026 +0530
NO-ISSUE: upgrade micrometer-core from 1.14.7 to 1.16.6 in OptaPlanner
modules (#6810)
* fix: upgrade micrometer-core from 1.14.7 to 1.16.6 in OptaPlanner modules
quarkus-bom 3.27.4 pulls in micrometer-core 1.14.7 which has a known CVE.
Added explicit dependencyManagement overrides for micrometer-core,
micrometer-commons and micrometer-observation in optaplanner-build-parent
to enforce version 1.16.6 across all OptaPlanner modules.
* fix: address review comments - move micrometer under Normal dependencies
and specify quarkus-bom version
---
optaplanner-build/optaplanner-build-parent/pom.xml | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index ac422df0497..a9a85cb52c3 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -55,6 +55,7 @@
<version.org.freemarker>2.3.34</version.org.freemarker>
<version.org.jdom2>2.0.6.1</version.org.jdom2>
<version.org.jfree.jfreechart>1.5.4</version.org.jfree.jfreechart>
+ <version.io.micrometer>1.16.6</version.io.micrometer>
<version.org.openrewrite.recipe>1.19.3</version.org.openrewrite.recipe>
<version.org.slf4j>2.0.17</version.org.slf4j><!-- TODO keep in sync with
quarkus-bom -->
<version.org.springframework>7.0.8</version.org.springframework>
@@ -137,6 +138,22 @@
<scope>import</scope>
</dependency>
<!-- Normal dependencies versions-->
+ <!-- CVE fix: override micrometer version brought in by quarkus-bom
3.27.4 (1.14.7) to 1.16.6 -->
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-core</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-commons</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-observation</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
