This is an automated email from the ASF dual-hosted git repository.
gitgabrio pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-drools.git
The following commit(s) were added to refs/heads/main by this push:
new a4989150788 NO-ISSUE:fix: upgrade org.eclipse.parsson:parsson from
1.1.7 to 1.1.8 to fix CVE (#6817)
a4989150788 is described below
commit a49891507883b94ec42161d03968da44af93e481
Author: athirakm94 <[email protected]>
AuthorDate: Tue Jul 21 16:01:14 2026 +0530
NO-ISSUE:fix: upgrade org.eclipse.parsson:parsson from 1.1.7 to 1.1.8 to
fix CVE (#6817)
* fix: upgrade org.eclipse.parsson:parsson from 1.1.7 to 1.1.8 to fix CVE
* fix: manage Parsson version in OptaPlanner build parent
* fix: rename Parsson version property in kie-parent
---
kie-parent/pom.xml | 4 ++--
optaplanner-build/optaplanner-build-parent/pom.xml | 8 +++++++-
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index d00abf548a8..8c92a4597a2 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -169,7 +169,7 @@
<version.jakarta.annotation-api>3.0.0</version.jakarta.annotation-api>
<version.jakarta.enterprise.cdi-api>4.1.0</version.jakarta.enterprise.cdi-api>
<version.jakarta.inject-api>2.0.1</version.jakarta.inject-api>
- <version.jakarta.json>1.1.8</version.jakarta.json>
+ <version.org.eclipse.parsson>1.1.8</version.org.eclipse.parsson>
<version.jakarta.json-api>2.1.3</version.jakarta.json-api>
<version.jakarta.json.bind-api>3.0.1</version.jakarta.json.bind-api>
<version.jakarta.persistence-api>3.2.0</version.jakarta.persistence-api>
@@ -1698,7 +1698,7 @@
<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
- <version>${version.jakarta.json}</version>
+ <version>${version.org.eclipse.parsson}</version>
</dependency>
<!-- Flyway -->
<dependency>
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index 70d90b87ff5..13a26860b5b 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -58,6 +58,7 @@
<version.io.micrometer>1.16.6</version.io.micrometer>
<version.org.openrewrite.recipe>1.19.3</version.org.openrewrite.recipe>
<version.org.slf4j>2.0.17</version.org.slf4j><!-- TODO keep in sync with
quarkus-bom -->
+ <version.org.eclipse.parsson>1.1.8</version.org.eclipse.parsson>
<version.org.springframework>7.0.8</version.org.springframework>
<version.org.springframework.boot>4.0.7</version.org.springframework.boot>
<version.com.fasterxml.jackson.databind>2.22.1</version.com.fasterxml.jackson.databind>
@@ -198,7 +199,12 @@
<artifactId>openjpa</artifactId>
<version>${version.org.apache.openjpa}</version>
</dependency>
-
+ <!-- CVE fix: override Parsson version brought in transitively by Yasson
to 1.1.8 -->
+ <dependency>
+ <groupId>org.eclipse.parsson</groupId>
+ <artifactId>parsson</artifactId>
+ <version>${version.org.eclipse.parsson}</version>
+ </dependency>
<!-- OpenRewrite -->
<dependency>
<groupId>org.openrewrite.recipe</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
