rzo1 commented on PR #3011: URL: https://github.com/apache/tomee/pull/3011#issuecomment-5927413675
@jungm heads-up, since this moves tomee-10.x off the 6.2.x line we normally keep it on: in this case, moving to 6.3.2 is fine. **Why we can't stay on 6.2.x:** CVE-2026-74761 affects every 6.x release before 6.3.2, and no fixed 6.2.x exists. 6.2.10 is the latest 6.2 release on Central. - Advisory: https://activemq.apache.org/components/classic/security - NVD ranges: https://nvd.nist.gov/vuln/detail/CVE-2026-74761 (`from 6.0.0 before 6.3.2`, `before 5.19.11`) - Released versions: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-client/maven-metadata.xml **Why 6.3.2 stays EE 10 compatible for what we ship:** - The ActiveMQ parent POMs ([6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-parent/6.2.10/activemq-parent-6.2.10.pom), [6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-parent/6.3.2/activemq-parent-6.3.2.pom)) declare the same `jakarta-jms-api-version` 3.1.0 and `javaVersion` 17. Jakarta Messaging 3.1 is in both EE 10 and EE 11. - TomEE 10 ships five ActiveMQ modules. Their non-test Jakarta, Spring and Jetty dependencies are the same in both versions: | Module | Dependency (6.2.10 and 6.3.2) | POMs | |---|---|---| | activemq-client | `jakarta.jms-api` | [6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-client/6.2.10/activemq-client-6.2.10.pom) / [6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-client/6.3.2/activemq-client-6.3.2.pom) | | activemq-broker | `jakarta.annotation-api` | [6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-broker/6.2.10/activemq-broker-6.2.10.pom) / [6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-broker/6.3.2/activemq-broker-6.3.2.pom) | | activemq-ra | `jakarta.resource-api` | [6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-ra/6.2.10/activemq-ra-6.2.10.pom) / [6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-ra/6.3.2/activemq-ra-6.3.2.pom) | | activemq-jdbc-store, activemq-openwire-legacy | none | | TomEE provides those API jars itself at EE 10 levels, so ActiveMQ's managed API versions never reach the distribution. - The EE 11-level dependencies in 6.3 are Servlet 6.1, EL 6.0, JSP 4.0, Jetty 12 and Spring 7. They come only from the web console and the HTTP transport, and TomEE 10 ships neither. As usual, CI only compiles this. A runtime regression would show up in the JMS and Arquillian JMS tests, not in the PR check. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
