This is an automated email from the ASF dual-hosted git repository.
tiagobento pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-tools.git
The following commit(s) were added to refs/heads/main by this push:
new e7c01271e39 kie-issues#1203: Overriding apache `mime4j` dependency
version (#2321)
e7c01271e39 is described below
commit e7c01271e390b4f579cea7622b92fb49cf34604d
Author: Yeser Amer <[email protected]>
AuthorDate: Fri May 17 04:42:33 2024 +0200
kie-issues#1203: Overriding apache `mime4j` dependency version (#2321)
---
.../jbpm-quarkus-devui/jbpm-quarkus-devui-deployment/pom.xml | 9 +++++++++
.../sonataflow-quarkus-devui-deployment/pom.xml | 11 ++++++++++-
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/packages/jbpm-quarkus-devui/jbpm-quarkus-devui-deployment/pom.xml
b/packages/jbpm-quarkus-devui/jbpm-quarkus-devui-deployment/pom.xml
index f246450075c..f5616c1a44f 100644
--- a/packages/jbpm-quarkus-devui/jbpm-quarkus-devui-deployment/pom.xml
+++ b/packages/jbpm-quarkus-devui/jbpm-quarkus-devui-deployment/pom.xml
@@ -36,6 +36,7 @@
<properties>
<java.module.name>org.jbpm.quarkus.dev.ui.deployment</java.module.name>
<path.to.webapp.app>../node_modules/@kie-tools/runtime-tools-process-dev-ui-webapp</path.to.webapp.app>
+ <version.apache.mime4j>0.8.11</version.apache.mime4j>
</properties>
<dependencies>
@@ -72,6 +73,14 @@
<groupId>org.kie.kogito</groupId>
<artifactId>kogito-quarkus-extension-spi</artifactId>
</dependency>
+ <!-- Transitively imported by
io.quarkus:quarkus-resteasy-multipart-deployment
+ Overriding it to fix CVE-2024-21742
+ Can be removed once the parent dependency updates it to a 0.8.11+
version -->
+ <dependency>
+ <groupId>org.apache.james</groupId>
+ <artifactId>apache-mime4j-core</artifactId>
+ <version>${version.apache.mime4j}</version>
+ </dependency>
<!-- Undertow is needed so that the static resource serving can correctly
locate CP resources from `META-INF/resources` of the application, as it would
be normally expected.
See https://issues.redhat.com/browse/KOGITO-3477 -->
diff --git
a/packages/sonataflow-quarkus-devui/sonataflow-quarkus-devui-deployment/pom.xml
b/packages/sonataflow-quarkus-devui/sonataflow-quarkus-devui-deployment/pom.xml
index 7c957dd5ff9..9adf83582f7 100644
---
a/packages/sonataflow-quarkus-devui/sonataflow-quarkus-devui-deployment/pom.xml
+++
b/packages/sonataflow-quarkus-devui/sonataflow-quarkus-devui-deployment/pom.xml
@@ -36,6 +36,7 @@
<properties>
<path.to.webapp.app>../node_modules/@kie-tools/serverless-workflow-dev-ui-webapp</path.to.webapp.app>
+ <version.apache.mime4j>0.8.11</version.apache.mime4j>
</properties>
<dependencies>
@@ -68,6 +69,14 @@
<groupId>io.quarkus</groupId>
<artifactId>quarkus-resteasy-multipart-deployment</artifactId>
</dependency>
+ <!-- Transitively imported by
io.quarkus:quarkus-resteasy-multipart-deployment
+ Overriding it to fix CVE-2024-21742
+ Can be removed once the parent dependency updates it to a 0.8.11+
version -->
+ <dependency>
+ <groupId>org.apache.james</groupId>
+ <artifactId>apache-mime4j-core</artifactId>
+ <version>${version.apache.mime4j}</version>
+ </dependency>
<!-- Undertow is needed so that the static resource serving can correctly
locate CP resources from `META-INF/resources` of the application, as it would
be normally expected.
See https://issues.redhat.com/browse/KOGITO-3477 -->
@@ -109,7 +118,7 @@
<path>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-extension-processor</artifactId>
- <version>${quarkus.platform.version}</version>
+ <version>${quarkus.platform.version}</version>
</path>
</annotationProcessorPaths>
</configuration>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
