> On Sep 27, 2026, at 5:39 AM, Nacho Barrientos via dev
> <[email protected]> wrote:
>
> Not at all, it's just that our validation procedures for a patch version
> bump are more lightweight than those for a minor version bump so it
> would have been more straightforward to get that CVE patched if it had
> been included in 6.2.10.
>
Sounds good, let us know if you have any hiccups with the upgrade. For sure
look into the changes related to Jetty if you use the console and/or REST APIs.
The new Jetty configuration approach in 6.3.x is hardened to use native Jetty
configuration files instead of mapping Jetty setup using Spring. This will be
easier to maintain and ensure proper security hardening going forward.
Thanks,
Matt Pavlovich
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
