Hi, the thing is, that we cannot release with a SNAPSHOT dependency. While it might be "ok" for binaries, it has the potential to break every user, who is using a TomEE dependency inside their environments for building, testing or embedding applications.
If we decide for having CXF 4.1.0-SNAPSHOT included, we would need to create a short-living fork of the current CXF version (with different group-ids) in order to have something "stable" or shade it (as it was done before CXF 4.x) just for a m2 release. Best case would be, that CXF releases a milestone, but I don't think, that they will do it, so it leaves us only these options. Best Richard On 2024/06/12 06:12:21 Alex The Rocker wrote: > Hello Richard, > > First of all, thank you very much for these updates, and a big thanks > to Markus for his major contribution ! > > To answer your question, I beleive that indeed a Milestone 2 release > end of June would be perfect timing on my side to run many tests on > (relatively) various uses of TomEE. > > However, I'm not sure that rollbacking to latest stable CXF would be a > good idea - unless we plan to turn Millestone 2 into a released > version within short time after Milestone 2. If we are not in such > hurry, then I tend to prefer to use TomEE 10 Milestone 2 with on-going > CXF release that will eventually be used in final TomEE 10, so as to > help CXF community to get feedbacks through TomEE 10 Milestone 2 > testers. > > That's my 2 cents ! > > Thanks, > Alex > > > Le mer. 12 juin 2024 à 06:17, Richard Zowalla <rich...@zowalla.com> a écrit : > > > > Hi all, > > > > Here is a new update on TomEE 10. > > > > Markus Jung has implemented the missing part of the EE10 security spec: [1] > > and the TCK for it looks good. Thanks a lot for that contribution! If > > anybody wants to give it a review, you find it here: [1] > > > > We have updated most MicroProfile specs to be compliant with MP6 and the > > TCK for it looks good. > > > > The only MicroProfile implementation missing is OpenTelemetry 1.0 [2] (and > > the removal of OpenTracing). There is a branch with a basic integration > > (TOMEE-4343) but while working on it, I found something odd, which I did > > discuss with Romain via Slack. The result is [3]. I hope to get some > > additional input from Mark Struberg on it, so we can hopefully find a way > > to fix the odd CDI part here. Overall, the related TCK has around 4-5 which > > are (most likely) a result of [3] because the interceptor is not working as > > expected. > > > > Since we are more and more in a (better) EE10 shape, we need to go back > > into fixing/adding the existing/remaining TCKs inside the TomEE build to > > see, if we need to do some work in our upstream dependencies. I am planning > > to send an update for that area soon, so we get an overview of what is > > already added and what is broken / missing, > > > > We are blocked by a release of CXF 4.1.0-SNAPSHOT. > > > > We should (imho) discuss, if it is worth to release a M2 with a downgrade > > to the latest stable CXF release since we added new features (MicroProfile > > updates, potentially OIDC soon) and upgraded a lot of 3rd party CVEs. So > > from my POV it would be crucial to get some feedback on a new milestone > > release. WDYT? > > > > Gruß > > Richard > > > > [1] https://github.com/apache/tomee/pull/1178 > > [2] https://issues.apache.org/jira/browse/TOMEE-4343 > > [1] https://issues.apache.org/jira/browse/OWB-1441 >
