aldettinger commented on PR #9403:
URL: https://github.com/apache/camel-quarkus/pull/9403#issuecomment-6528262687
I verified this locally by checking out `pull/9403/head` and building
against the patched BOM. The change does what it says:
* `extensions/grpc/runtime` (was `4.6.1`) and `extensions/twilio/runtime`
(was `4.4.0`) both resolve to `4.6.2`, so removing `com.auth0:java-jwt` from
`IGNORED_GAVS` is correct, and the list stays alphabetically ordered.
* No shadowing in the convergence job: `create-superapp.groovy` imports
`quarkus-bom` before `camel-quarkus-bom`, and `quarkus-bom` has no `com.auth0`
entry, so the new management entry wins. `bom-overlaps` passes.
* No downgrade — `4.6.2` is above both pre-existing versions.
* Binary compatibility looks fine for the larger `4.4.0 -> 4.6.2` jump on
the Twilio side: identical class sets, and `javap` diffs of `JWT`,
`JWTCreator$Builder`, `Algorithm`, `JWTVerifier` and `DecodedJWT` show only
additive `RSA*PSS` methods. Bytecode target and multi-release layout are
unchanged.
* The generated flattened BOMs are in sync — re-running `cq:flatten-bom`
left all three `poms/bom/src/main/generated/*.xml` entries untouched and
correctly sorted.
One suggestion on the property itself:
```xml
<java-jwt.version>4.6.2</java-jwt.version><!-- Alignment for camel-grpc and
twilio -->
```
The `4.6.1` side of the conflict is not arbitrary — it comes from
`grpc-java-jwt-version` declared in the `org.apache.camel:camel-dependencies`
parent that this project already inherits. Pinning an unrelated literal
detaches the BOM from that upstream value.
The concrete risk: when Camel bumps `grpc-java-jwt-version` (say, to pick up
a java-jwt CVE fix) as part of a routine `camel.major.minor` upgrade,
`camel-quarkus-bom` will keep forcing `4.6.2` and silently downgrade every
downstream consumer back onto the older version. Nothing fails — the
convergence job still sees a single version everywhere and the enforcer is
happy — so it would only surface in an SBOM diff.
Both idiomatic remedies already exist in this same `pom.xml`:
```xml
<!-- direct reference, like the neighbouring javassist.version /
jetty.version lines -->
<java-jwt.version>${grpc-java-jwt-version}</java-jwt.version>
```
```xml
<!-- or keep the explicit version with a sync marker -->
<java-jwt.version>4.6.2</java-jwt.version><!-- @sync
org.apache.camel:camel-dependencies:${camel.version} prop:grpc-java-jwt-version
-->
```
Note that `${grpc-java-jwt-version}` (`4.6.1`) on its own would already
resolve the convergence conflict, since it is above Twilio's `4.4.0`. So if
there is no specific reason to prefer `4.6.2` over Camel's chosen version, the
direct reference is the lowest-maintenance option. If `4.6.2` is deliberate
(e.g. a fix not yet in Camel), the `@sync` comment plus a short note of the
reason seems like the right form.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
