AnnJoy23 opened a new pull request, #7153: URL: https://github.com/apache/incubator-kie/pull/7153
## Summary Upgrades Quarkus BOM from `3.33.3.2` to `3.33.4` across all Quarkus-facing build parents and BOMs, pulls in aligned companion library upgrades, removes CVE override pins now resolved by the new BOM, and bumps the MongoDB driver to `5.11.1` to fix CVE-2026-18710 (which the new BOM does not yet resolve). --- ## Changes made ### `kie-quarkus-build-parent/pom.xml` - `version.io.quarkus`: `3.33.3.2` → `3.33.4` ### `kie-parent/pom.xml` - `version.io.netty`: `4.1.137.Final` → `4.1.138.Final` (shipped by `quarkus-bom 3.33.4`; explicit pin beats BOM import) - `version.io.vertx`: `4.5.31` → `4.5.34` (shipped by `quarkus-bom 3.33.4`) - `io.smallrye.reactive:mutiny-vertx-web-client`: `3.21.6` → `3.23.1` (coupled to Vert.x `4.5.34`; must move together) - Removed `version.org.apache.sshd` CVE pin — `quarkus-bom 3.33.4` ships sshd `2.19.0` (fixes CVE-2026-56624) - `version.mongodb-driver-sync`: `5.9.2` → `5.11.1` (CVE-2026-18710 / JAVA-6266; BOM still ships `5.6.4`) - Log4j CVE comments updated: reference version `3.33.3.2` → `3.33.4` ### `kogito-quarkus/bom/pom.xml` - `version.io.quarkus`: `3.33.3.2` → `3.33.4` - `version.mongodb.driver.sync` override comment: `5.9.2` → `5.11.1` with CVE-2026-18710 annotation and removal condition - Removed `micrometer-registry-statsd` CVE pin — `quarkus-bom 3.33.4` ships micrometer `1.16.7` (fixes CVE-2026-59295 / CVE-2026-59296) ### `kogito-springboot/bom/pom.xml` - MongoDB override comment updated to `5.11.1` with CVE-2026-18710 annotation ### `optaplanner-build/optaplanner-build-parent/pom.xml` - `version.io.quarkus`: `3.33.3.2` → `3.33.4` - Removed micrometer CVE pin (CVE-2026-59295 / CVE-2026-59296) — resolved by BOM `3.33.4` - Removed sshd CVE pin (CVE-2026-56624) — resolved by BOM `3.33.4` --- ## CVEs resolved by this PR | CVE | Library | Old override | BOM `3.33.4` ships | Pin removed? | |-----|---------|-------------|-------------------|-------------| | CVE-2026-56624 | Apache Mina SSHD | `2.14.0` | `2.19.0` | ✅ Yes | | CVE-2026-59295 | Micrometer | explicit pin | `1.16.7` | ✅ Yes | | CVE-2026-59296 | Micrometer | explicit pin | `1.16.7` | ✅ Yes | | CVE-2026-18710 | MongoDB driver | `5.9.2` | `5.6.4` (not fixed) | ➕ Bumped to `5.11.1` | --- ## Companion library upgrades | Library | Old | New | Reason | |---------|-----|-----|--------| | Netty | `4.1.137.Final` | `4.1.138.Final` | Aligned with `quarkus-bom 3.33.4` | | Vert.x | `4.5.31` | `4.5.34` | Aligned with `quarkus-bom 3.33.4` | | mutiny-vertx-web-client | `3.21.6` | `3.23.1` | Built against Vert.x `4.5.34`; must move together | --- ## Notes - `camel-quarkus` stays at `3.33.3` — no `3.33.4` release exists for the `3.33` minor line - Spring Boot Netty pin (`4.2.18.Final` in `kogito-springboot/bom`) is independent and unchanged - `version.io.micrometer` in `kie-parent` is a **functional** pin used by `drools-metric` — not a CVE pin, not removed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
