This is an automated email from the ASF dual-hosted git repository.
gitgabrio pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 752688608de [NO-ISSUE]: Fix CVE-2026-59295, CVE-2026-59296 in
micrometer (#7088)
752688608de is described below
commit 752688608de69afc24b6426f39ad767444ffc8ff
Author: Rajalakshmy S <[email protected]>
AuthorDate: Mon Sep 14 13:34:11 2026 +0530
[NO-ISSUE]: Fix CVE-2026-59295, CVE-2026-59296 in micrometer (#7088)
* Fix wildfly elytron and micrometer
* Remove wildfly-elytron fix - deferred to post Quarkus 3.33.x upgrade
* Update micrometer CVE comment with Quarkus version and restore
quarkus-maven-plugin extensions
* Update the comment quarkus version 3.33.2
* Pin micrometer-registry-statsd 1.16.7 in optaplanner-build-parent,
kie-quarkus-build-parent, kogito-quarkus-bom
* Remove redundant micrometer property
* Remove redundant dependency
* Update quarkus version to 3.33
* Add back micrometer dependency overrides
---------
Co-authored-by: Rajalakshmy S <[email protected]>
---
kie-parent/pom.xml | 2 +-
kogito-quarkus/bom/pom.xml | 6 ++++++
optaplanner-build/optaplanner-build-parent/pom.xml | 17 +++++++++++++++++
3 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index c559adba499..fc100fd22c7 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -143,7 +143,7 @@
<version.io.fabric8>7.3.1</version.io.fabric8>
<version.io.fabric8.kubernetes-client>7.3.1</version.io.fabric8.kubernetes-client>
<version.io.grpc>1.76.0</version.io.grpc>
- <version.io.micrometer>1.16.6</version.io.micrometer>
+ <version.io.micrometer>1.16.7</version.io.micrometer>
<version.io.netty>4.1.137.Final</version.io.netty>
<version.io.opentelemetry>1.0.0-alpha</version.io.opentelemetry>
<version.io.rest-assured>5.5.6</version.io.rest-assured>
diff --git a/kogito-quarkus/bom/pom.xml b/kogito-quarkus/bom/pom.xml
index a590c457e01..c54492ab9c1 100644
--- a/kogito-quarkus/bom/pom.xml
+++ b/kogito-quarkus/bom/pom.xml
@@ -149,6 +149,12 @@
<artifactId>quarkus-reactive-messaging-http-deployment</artifactId>
<version>${version.io.quarkiverse.reactivemessaging.http}</version>
</dependency>
+ <!-- CVE-2026-59296: micrometer-registry-statsd 1.16.6 (via Quarkus
3.33.x) -->
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-registry-statsd</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index 5cd4ba0bf2f..6b7038450c9 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -58,6 +58,7 @@
<version.org.freemarker>2.3.34</version.org.freemarker>
<version.org.jdom2>2.0.6.1</version.org.jdom2>
<version.org.jfree.jfreechart>1.5.4</version.org.jfree.jfreechart>
+ <version.io.micrometer>1.16.7</version.io.micrometer>
<version.org.openrewrite.recipe>1.19.3</version.org.openrewrite.recipe>
<version.org.slf4j>2.0.17</version.org.slf4j><!-- TODO keep in sync with
quarkus-bom -->
<version.org.eclipse.parsson>1.1.8</version.org.eclipse.parsson>
@@ -163,6 +164,22 @@
<artifactId>logback-classic</artifactId>
<version>${version.ch.qos.logback}</version>
</dependency>
+ <!-- CVE-2026-59295, CVE-2026-59296: micrometer-core/commons/observation
pinned at 1.16.6 by quarkus-bom 3.33.x; upgrade to 1.16.7 -->
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-core</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-commons</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-observation</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
