Hi Markus, Thanks for your reply.
I think we need to keep the Java 17 baseline anyway (we need it for activemq). The CXF downgrade is just a matter of reverting two commits, so should be the most easiest option. I asked CXF, what they plan for 4.1.0 here: https://lists.apache.org/thread/rggjhm3w4gr81y8dmskp4mc7cydq13zq If one looks into their Jira / EE10 ticket, the current statement is „somewhere this year“. So I wouldn’t count with it soon. Gruß Richard > Am 12.06.2024 um 19:02 schrieb Markus Jung <ju...@apache.org>: > > Hey Richard, > > huge +1 from my side for an M2 when my OIDC PR is merged, that would allow us > to become the first real user of this feature ASAP and probably provide some > more feedback and patches ;) > > Don't know how likely a CXF 4.1.0 release/milestone is in the near future, > I'm fine if we downgrade again for now. However, my OIDC code already uses > some language features not available in Java 11. So I think we need to keep > Java 17 as a requirement. > > > Thanks > > Markus > >> On 12. Jun 2024, at 06:17, Richard Zowalla <rich...@zowalla.com> wrote: >> >> Hi all, >> >> Here is a new update on TomEE 10. >> >> Markus Jung has implemented the missing part of the EE10 security spec: [1] >> and the TCK for it looks good. Thanks a lot for that contribution! If >> anybody wants to give it a review, you find it here: [1] >> >> We have updated most MicroProfile specs to be compliant with MP6 and the TCK >> for it looks good. >> >> The only MicroProfile implementation missing is OpenTelemetry 1.0 [2] (and >> the removal of OpenTracing). There is a branch with a basic integration >> (TOMEE-4343) but while working on it, I found something odd, which I did >> discuss with Romain via Slack. The result is [3]. I hope to get some >> additional input from Mark Struberg on it, so we can hopefully find a way to >> fix the odd CDI part here. Overall, the related TCK has around 4-5 which are >> (most likely) a result of [3] because the interceptor is not working as >> expected. >> >> Since we are more and more in a (better) EE10 shape, we need to go back into >> fixing/adding the existing/remaining TCKs inside the TomEE build to see, if >> we need to do some work in our upstream dependencies. I am planning to send >> an update for that area soon, so we get an overview of what is already added >> and what is broken / missing, >> >> We are blocked by a release of CXF 4.1.0-SNAPSHOT. >> >> We should (imho) discuss, if it is worth to release a M2 with a downgrade to >> the latest stable CXF release since we added new features (MicroProfile >> updates, potentially OIDC soon) and upgraded a lot of 3rd party CVEs. So >> from my POV it would be crucial to get some feedback on a new milestone >> release. WDYT? >> >> Gruß >> Richard >> >> [1] https://github.com/apache/tomee/pull/1178 >> [2] https://issues.apache.org/jira/browse/TOMEE-4343 >> [1] https://issues.apache.org/jira/browse/OWB-1441 > >
