jaedonP opened a new pull request, #7228:
URL: https://github.com/apache/incubator-kie/pull/7228
## Summary
Overrides transitive dependency versions that carry known vulnerabilities in
`kie-parent` and `optaplanner-build-parent`:
- **OW2 ASM** is pulled in transitively at 9.3 (via `json-smart` /
`accessors-smart`) and at 9.9.1 (via `maven-core` and `quarkus-bom`). It is
pinned to 9.11.1.
- **snappy-java** 1.1.10.8 (shipped by `quarkus-bom`) is pinned to 1.1.10.12.
- **Micrometer** is bumped from 1.16.7 to 1.17.1. Micrometer 1.17.0 dropped
the `LatencyUtils:2.0.3` runtime dependency, which has no upstream fix.
`micrometer-commons`, `micrometer-core` and `micrometer-observation` are
released together and are kept aligned.
In `optaplanner-build-parent` the overrides are declared before the
`quarkus-bom` import so they take precedence. The hardcoded `asm-analysis` 9.5
in a plugin dependency now uses `${version.org.ow2.asm}`.
The temporary overrides can be removed once `quarkus-bom` ships Micrometer
>= 1.17.0 and the transitive ASM consumers ship ASM >= 9.11.
## Changes
| File | Change |
|------|--------|
| `kie-parent/pom.xml` | `version.io.micrometer` 1.16.7 -> 1.17.1; added
`micrometer-commons` and `micrometer-observation` entries; added
`version.org.ow2.asm` 9.11.1 with `asm`, `asm-analysis`, `asm-commons`,
`asm-tree`, `asm-util`; added `version.org.xerial.snappy` 1.1.10.12 with
`snappy-java` |
| `optaplanner-build/optaplanner-build-parent/pom.xml` | added
`version.io.micrometer` 1.17.1, `version.org.ow2.asm` 9.11.1 and
`version.org.xerial.snappy` 1.1.10.12 with matching overrides before the
`quarkus-bom` import; `asm-analysis` plugin dependency 9.5 ->
`${version.org.ow2.asm}` |
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
