nrknithin opened a new issue, #6902: URL: https://github.com/apache/incubator-kie/issues/6902
### Description The repository currently builds on **Quarkus 3.27.5.1**. The Quarkus 3.27 LTS stream reaches **end of support in September 2026** — after that it receives no further critical bug fixes or security patches, leaving every KIE/Drools/Kogito/OptaPlanner Quarkus module without a patch path for future CVEs. The current recommended production LTS is **Quarkus 3.33**, supported until **March 2027**. Its latest respin is **3.33.3.1**. Upgrading now keeps us inside a supported window and restores CVE coverage. References: - Quarkus release/support lifecycle: https://quarkus.io/releases/ - LTS support windows: https://endoflife.date/quarkus-framework - 3.33 LTS release planning: https://github.com/quarkusio/quarkus/wiki/3.33-LTS-Release-Planning ## Proposed target - `version.io.quarkus` → **3.33.3.1** (latest 3.33 respin) in the three declaring parents (`kie-quarkus-build-parent`, `kogito-quarkus/bom`, `optaplanner-build-parent`) - `version.io.quarkus.camel` → **3.33.2** (newest camel-quarkus in the 3.33 stream; Camel Quarkus publishes no respins, so it intentionally differs from the core version) ## Expected scope (from preliminary analysis) - Re-align the Quarkus-coupled version pins in `kie-parent/pom.xml` with quarkus-bom 3.33.3.1 (SmallRye family, Mutiny 3.x major, gRPC, Hibernate, MongoDB driver, etc.); keep CVE pins that are deliberately ahead of the BOM (jackson, log4j) - Quarkiverse extension bumps where a 3.33-baseline release exists (openapi-generator, reactive-messaging-http) - Replace `quarkus-smallrye-metrics` (removed from the 3.33 BOM) with Micrometer in data-audit - Adapt extension deployment modules to 3.33 internal API changes (ArC Gizmo 2 creator API, removed constants/classes, runtime-config-in-build-step enforcement, stricter generated-class consistency checks affecting generated REST endpoint registration on both REST stacks) - Deliberate holds requiring no action now: protobuf (BOM moved to 4.x, coupled to Infinispan/ProtoStream) and Flyway (BOM moved to 12.x, needs migration-script validation) ### Implementation ideas _No response_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
