Hello Richard, I vote for the following option: (b) Fork from CXF 4.1.0-SNAPSHOT and release something indermediate under org.apache.tomee
because I think it will help to validate ahead of time the upcoming CXF 4.1.0 with TomEE 10 milestone testers ; rather than rolling back to released CXF 4.0.4 but since we need 4.1.x for TomEE 10 final, we would just loose time and risk to miss some regressions in 4.1.x. After all, which better real-time test other than TomEE CXF has ? (my two cents) Alex Le mer. 26 juin 2024 à 15:37, Richard Zowalla <r...@apache.org> a écrit : > > Hi, > > I think the CXF guys won't do a milestone / release in the next few weeks. > > So we have two options: > > (a) Downgrade to 4.0.4 > (b) Fork from CXF 4.1.0-SNAPSHOT and release something indermediate under > org.apache.tomee > (c) ?? > > Any thoughts? Do we have alternatives? > > Gruß > Richard > > > [1] https://lists.apache.org/thread/rggjhm3w4gr81y8dmskp4mc7cydq13zq > [2] https://lists.apache.org/thread/pcddpwrr3jjxccsvyp27spjr1gmbljov > > On 2024/06/18 09:43:47 Thomas Andraschko wrote: > > i would like to see a M2, too > > > > isnt there a way to get a M1 or RC1 from CXF guys? > > > > Am Di., 18. Juni 2024 um 11:37 Uhr schrieb Richard Zowalla <r...@apache.org > > >: > > > > > Any other thoughts? > > > > > > @JL: Do you want the Geronimo mail implant release (ongoing vote) to be > > > included in an M2? > > > > > > @Jon: Think it would be worth to include > > > https://github.com/apache/tomee/pull/1166 ? > > > > > > > > > > Am 12.06.2024 um 20:38 schrieb Richard Zowalla <rich...@zowalla.com>: > > > > > > > > Hi Markus, > > > > > > > > Thanks for your reply. > > > > > > > > I think we need to keep the Java 17 baseline anyway (we need it for > > > activemq). The CXF downgrade is just a matter of reverting two commits, so > > > should be the most easiest option. > > > > > > > > I asked CXF, what they plan for 4.1.0 here: > > > https://lists.apache.org/thread/rggjhm3w4gr81y8dmskp4mc7cydq13zq > > > > If one looks into their Jira / EE10 ticket, the current statement is > > > „somewhere this year“. So I wouldn’t count with it soon. > > > > > > > > Gruß > > > > Richard > > > > > > > > > > > >> Am 12.06.2024 um 19:02 schrieb Markus Jung <ju...@apache.org>: > > > >> > > > >> Hey Richard, > > > >> > > > >> huge +1 from my side for an M2 when my OIDC PR is merged, that would > > > allow us to become the first real user of this feature ASAP and probably > > > provide some more feedback and patches ;) > > > >> > > > >> Don't know how likely a CXF 4.1.0 release/milestone is in the near > > > future, I'm fine if we downgrade again for now. However, my OIDC code > > > already uses some language features not available in Java 11. So I think > > > we > > > need to keep Java 17 as a requirement. > > > >> > > > >> > > > >> Thanks > > > >> > > > >> Markus > > > >> > > > >>> On 12. Jun 2024, at 06:17, Richard Zowalla <rich...@zowalla.com> > > > wrote: > > > >>> > > > >>> Hi all, > > > >>> > > > >>> Here is a new update on TomEE 10. > > > >>> > > > >>> Markus Jung has implemented the missing part of the EE10 security > > > spec: [1] and the TCK for it looks good. Thanks a lot for that > > > contribution! If anybody wants to give it a review, you find it here: [1] > > > >>> > > > >>> We have updated most MicroProfile specs to be compliant with MP6 and > > > the TCK for it looks good. > > > >>> > > > >>> The only MicroProfile implementation missing is OpenTelemetry 1.0 [2] > > > (and the removal of OpenTracing). There is a branch with a basic > > > integration (TOMEE-4343) but while working on it, I found something odd, > > > which I did discuss with Romain via Slack. The result is [3]. I hope to > > > get > > > some additional input from Mark Struberg on it, so we can hopefully find a > > > way to fix the odd CDI part here. Overall, the related TCK has around 4-5 > > > which are (most likely) a result of [3] because the interceptor is not > > > working as expected. > > > >>> > > > >>> Since we are more and more in a (better) EE10 shape, we need to go > > > back into fixing/adding the existing/remaining TCKs inside the TomEE build > > > to see, if we need to do some work in our upstream dependencies. I am > > > planning to send an update for that area soon, so we get an overview of > > > what is already added and what is broken / missing, > > > >>> > > > >>> We are blocked by a release of CXF 4.1.0-SNAPSHOT. > > > >>> > > > >>> We should (imho) discuss, if it is worth to release a M2 with a > > > downgrade to the latest stable CXF release since we added new features > > > (MicroProfile updates, potentially OIDC soon) and upgraded a lot of 3rd > > > party CVEs. So from my POV it would be crucial to get some feedback on a > > > new milestone release. WDYT? > > > >>> > > > >>> Gruß > > > >>> Richard > > > >>> > > > >>> [1] https://github.com/apache/tomee/pull/1178 > > > >>> [2] https://issues.apache.org/jira/browse/TOMEE-4343 > > > >>> [1] https://issues.apache.org/jira/browse/OWB-1441 > > > >> > > > >> > > > > > > > > > > > >
