This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new c0a8f9557a1 [main][incubator-kie-issues -2400] Fix CVE-2026-47857,
CVE-2026-47863 in reactor-core (#7103)
c0a8f9557a1 is described below
commit c0a8f9557a14862dc61e04bfc12aacdab3f74d35
Author: Christine-Jose <[email protected]>
AuthorDate: Fri Sep 11 18:17:59 2026 +0530
[main][incubator-kie-issues -2400] Fix CVE-2026-47857, CVE-2026-47863 in
reactor-core (#7103)
* Fix CVE-2026-47857, CVE-2026-47863 in reactor-core
Upgrade io.projectreactor:reactor-core from 3.5.0/3.8.6 to 3.8.7
to address CVE-2026-47857 and CVE-2026-47863.
Pin added to kogito-quarkus BOM ahead of the quarkus-bom import
so the override takes precedence over any version the Quarkus BOM
would otherwise pull in.
- Added <version.io.projectreactor>3.8.7</version.io.projectreactor>
property to kogito-quarkus/bom/pom.xml
- Added io.projectreactor:reactor-core dependency management entry
* Remove comments from reactor-core CVE fix
---
kogito-quarkus/bom/pom.xml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kogito-quarkus/bom/pom.xml b/kogito-quarkus/bom/pom.xml
index d905ad7c19d..a590c457e01 100644
--- a/kogito-quarkus/bom/pom.xml
+++ b/kogito-quarkus/bom/pom.xml
@@ -63,6 +63,7 @@
<version.org.graalvm.nativeimage>23.1.2</version.org.graalvm.nativeimage>
<version.org.jredisearch>2.2.0</version.org.jredisearch>
<version.org.json>20231013</version.org.json>
+ <version.io.projectreactor>3.8.7</version.io.projectreactor>
</properties>
<dependencyManagement>
<dependencies>
@@ -148,6 +149,11 @@
<artifactId>quarkus-reactive-messaging-http-deployment</artifactId>
<version>${version.io.quarkiverse.reactivemessaging.http}</version>
</dependency>
+ <dependency>
+ <groupId>io.projectreactor</groupId>
+ <artifactId>reactor-core</artifactId>
+ <version>${version.io.projectreactor}</version>
+ </dependency>
<!-- CVE fix: quarkus-bom:3.33.x pins all MongoDB driver artifacts to
5.5.1.
Override to match
mongodb-driver-sync:${version.mongodb-driver-sync} already
pinned in kie-parent. Must appear before the quarkus-bom import to
take precedence.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
