This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new c9c470ca2cd [NO-ISSUE] Upgrade Quarkus from 3.33.3.2 to 3.33.4 (#7153)
c9c470ca2cd is described below
commit c9c470ca2cdae7bb4638b507905346cfc6fbac4f
Author: ANN JOY <[email protected]>
AuthorDate: Thu Oct 1 21:32:13 2026 +0530
[NO-ISSUE] Upgrade Quarkus from 3.33.3.2 to 3.33.4 (#7153)
* Upgrade Quarkus from 3.33.3.2 to 3.33.4
- Bump version.io.quarkus to 3.33.4 in all three Quarkus roots:
kie-quarkus-build-parent, kogito-quarkus/bom, optaplanner-build-parent
- Bump version.io.netty 4.1.137.Final -> 4.1.138.Final (quarkus-bom 3.33.4
ships 4.1.138)
- Bump version.io.vertx 4.5.31 -> 4.5.34 (quarkus-bom 3.33.4 ships 4.5.34)
- Bump version.io.smallrye.reactive.mutiny-vertx-web-client 3.21.6 -> 3.23.1
(coupled with vertx bump; 3.23.1 was built against vertx 4.5.34)
- Remove CVE-2026-56624 (sshd) pin from kie-parent and
optaplanner-build-parent:
quarkus-bom 3.33.4 now ships sshd 2.19.0 natively
- Remove CVE-2026-59295/59296 (micrometer) pins from
optaplanner-build-parent
and kogito-quarkus/bom: quarkus-bom 3.33.4 ships micrometer 1.16.7
natively
- Update CVE-2026-49844 comments citing quarkus-bom version: 3.33.3.2 ->
3.33.4
- Update MongoDB driver override comments: 3.33.3.2 -> 3.33.4
* CVE-2026-18710: bump MongoDB driver from 5.9.2 to 5.11.1
- kie-parent: version.mongodb-driver-sync 5.9.2 -> 5.11.1
- kogito-quarkus/bom: property + comments updated to 5.11.1;
CVE-2026-18710 (JAVA-6266) explicitly cited with removal condition
- kogito-springboot/bom: comment updated to 5.11.1 with CVE id
and removal condition
quarkus-bom 3.33.4 still ships MongoDB driver 5.6.4;
spring-boot-dependencies 4.1.1 imports mongodb-driver-bom 5.8.1.
Both are below the fixed version. Remove when their respective
BOMs ship >= 5.11.1.
* Remove duplicate version.mongodb-driver-sync property from
kogito-quarkus/bom
Property is already declared in kie-parent and inherited transitively
through
kogito-bom -> kogito-build-no-bom-parent. The dependencyManagement entries
that reference it (lines 162-184) are still needed as the Quarkus-layer BOM
override against quarkus-bom.
Suggested by @yesamer in review of apache/incubator-kie#7153.
---
kie-parent/pom.xml | 24 ++++------------
kie-quarkus-build-parent/pom.xml | 2 +-
kogito-quarkus/bom/pom.xml | 17 ++++--------
kogito-springboot/bom/pom.xml | 6 ++--
optaplanner-build/optaplanner-build-parent/pom.xml | 32 +---------------------
5 files changed, 16 insertions(+), 65 deletions(-)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index be51e1a03ee..3522ca20596 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -144,7 +144,7 @@
<version.io.fabric8.kubernetes-client>7.3.1</version.io.fabric8.kubernetes-client>
<version.io.grpc>1.76.0</version.io.grpc>
<version.io.micrometer>1.16.7</version.io.micrometer>
- <version.io.netty>4.1.137.Final</version.io.netty>
+ <version.io.netty>4.1.138.Final</version.io.netty>
<version.io.opentelemetry>1.0.0-alpha</version.io.opentelemetry>
<version.io.rest-assured>5.5.6</version.io.rest-assured>
<version.io.smallrye-config>3.13.4</version.io.smallrye-config>
@@ -154,12 +154,12 @@
<version.io.smallrye.mutiny>2.9.5</version.io.smallrye.mutiny>
<version.io.smallrye.openapi.core>4.0.12</version.io.smallrye.openapi.core>
<version.io.smallrye.reactive.messaging.in.memory>4.28.0</version.io.smallrye.reactive.messaging.in.memory>
-
<version.io.smallrye.reactive.mutiny-vertx-web-client>3.21.6</version.io.smallrye.reactive.mutiny-vertx-web-client>
+
<version.io.smallrye.reactive.mutiny-vertx-web-client>3.23.1</version.io.smallrye.reactive.mutiny-vertx-web-client>
<!-- Mutiny Zero Flow Adapters -->
<version.io.smallrye.reactive.mutiny-zero>1.1.1</version.io.smallrye.reactive.mutiny-zero>
<version.io.swagger.core.v3>2.2.38</version.io.swagger.core.v3>
<version.io.swagger.parser.v3>2.1.34</version.io.swagger.parser.v3>
- <version.io.vertx>4.5.31</version.io.vertx>
+ <version.io.vertx>4.5.34</version.io.vertx>
<version.it.unimi.dsi.fastutil>8.5.11</version.it.unimi.dsi.fastutil>
<version.jacoco.plugin>0.8.11</version.jacoco.plugin>
<version.jakarta.activation>2.0.3</version.jakarta.activation>
@@ -197,7 +197,7 @@
<version.maven.plugin>3.15.1</version.maven.plugin>
<version.maven.project>2.2.1</version.maven.project>
<version.maven.resolver.api>1.9.27</version.maven.resolver.api>
- <version.mongodb-driver-sync>5.9.2</version.mongodb-driver-sync>
+ <version.mongodb-driver-sync>5.11.1</version.mongodb-driver-sync>
<version.nashorn>15.3</version.nashorn>
<version.native2ascii-maven-plugin>1.0-beta-1</version.native2ascii-maven-plugin>
<version.net.byte-buddy>1.17.6</version.net.byte-buddy>
@@ -222,12 +222,10 @@
<version.org.apache.httpcomponents.httpcore>4.4.16</version.org.apache.httpcomponents.httpcore>
<version.org.apache.kafka>4.1.2</version.org.apache.kafka>
<!-- CVE-2026-49844: poi-ooxml:5.4.1 pulls log4j-api:2.24.3 transitively
via log4j-bom:2.24.3.
- quarkus-bom:3.33.3.2 promotes it to 2.25.3. Both are below the
minimum safe version 2.25.5.
+ quarkus-bom:3.33.4 promotes it to 2.25.3. Both are below the minimum
safe version 2.25.5.
This managed entry forces 2.26.1 across all modules inheriting
kie-parent.
https://logging.apache.org/security.html#CVE-2026-49844 -->
<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
- <!-- CVE-2026-56624: Apache MINA SSHD fixed version -->
- <version.org.apache.sshd>2.19.0</version.org.apache.sshd>
<version.org.apache.maven>3.9.16</version.org.apache.maven>
<version.org.apache.maven.resolver>1.9.27</version.org.apache.maven.resolver>
<version.org.apache.maven.wagon>3.5.3</version.org.apache.maven.wagon>
@@ -1321,7 +1319,7 @@
</dependency>
<dependency>
<!-- CVE-2026-49844: override log4j-api version pulled in transitively
by poi-ooxml:5.4.1
- (via log4j-bom:2.24.3) and promoted by quarkus-bom:3.33.3.2 (to
2.25.3).
+ (via log4j-bom:2.24.3) and promoted by quarkus-bom:3.33.4 (to
2.25.3).
Both are vulnerable; this pins the version to 2.26.1 for all
inheriting modules. -->
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
@@ -1810,16 +1808,6 @@
<artifactId>infinispan-server-testdriver-core</artifactId>
<version>${version.org.infinispan}</version>
</dependency>
- <dependency>
- <groupId>org.apache.sshd</groupId>
- <artifactId>sshd-common</artifactId>
- <version>${version.org.apache.sshd}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.sshd</groupId>
- <artifactId>sshd-core</artifactId>
- <version>${version.org.apache.sshd}</version>
- </dependency>
<dependency>
<groupId>org.infinispan.protostream</groupId>
<artifactId>protostream</artifactId>
diff --git a/kie-quarkus-build-parent/pom.xml b/kie-quarkus-build-parent/pom.xml
index e2f3e6a1a55..554174d800c 100644
--- a/kie-quarkus-build-parent/pom.xml
+++ b/kie-quarkus-build-parent/pom.xml
@@ -39,7 +39,7 @@
</description>
<properties>
- <version.io.quarkus>3.33.3.2</version.io.quarkus>
+ <version.io.quarkus>3.33.4</version.io.quarkus>
<version.io.quarkus.camel>3.33.2</version.io.quarkus.camel>
<!-- Quarkus-platform-aligned pin. kie-parent keeps the Spring Boot /
framework-neutral value;
this tree needs the platform one (smallrye-reactive-messaging 4.33.0
requires Mutiny 3). -->
diff --git a/kogito-quarkus/bom/pom.xml b/kogito-quarkus/bom/pom.xml
index 96f8ebd4e3f..de2b43ba4b5 100644
--- a/kogito-quarkus/bom/pom.xml
+++ b/kogito-quarkus/bom/pom.xml
@@ -31,7 +31,7 @@
<!-- Used to define which poms are allowed to have dependencyManagement
sections. This is to enforce the convention that only the root pom should have
dependencyManagement, and all other poms should inherit from it. -->
<allowedPomsList>org.kie.kogito:kogito-quarkus-bom</allowedPomsList>
<quarkus.logging.manager>org.jboss.logmanager.LogManager</quarkus.logging.manager>
- <version.io.quarkus>3.33.3.2</version.io.quarkus>
+ <version.io.quarkus>3.33.4</version.io.quarkus>
<version.io.quarkus.quarkus-test>${version.io.quarkus}</version.io.quarkus.quarkus-test>
<version.io.quarkiverse.jackson-jq>2.4.0</version.io.quarkiverse.jackson-jq>
<version.io.quarkiverse.openapi.generator>2.17.0-lts</version.io.quarkiverse.openapi.generator>
@@ -55,8 +55,6 @@
<!-- quarkus-bom alignment; smallrye-open-api 4.2.4 requires jandex 3.5,
so it is pinned in the same scope as jandex. -->
<version.io.smallrye-open-api>4.2.4</version.io.smallrye-open-api>
<version.io.smallrye.openapi.core>4.2.4</version.io.smallrye.openapi.core>
- <!-- Override: quarkus-bom 3.33.3.2 ships MongoDB driver 5.6.4; pin to
5.9.2. -->
- <version.mongodb-driver-sync>5.9.2</version.mongodb-driver-sync>
<!-- Framework-specific pins moved out of kie-parent: only this tree
declares these artifacts. -->
<version.io.smallrye-health>4.3.0</version.io.smallrye-health>
<version.com.github.stephenc.jcip>1.0-1</version.com.github.stephenc.jcip>
@@ -149,20 +147,15 @@
<artifactId>quarkus-reactive-messaging-http-deployment</artifactId>
<version>${version.io.quarkiverse.reactivemessaging.http}</version>
</dependency>
- <!-- CVE-2026-59296: micrometer-registry-statsd 1.16.6 (via Quarkus
3.33.x) -->
- <dependency>
- <groupId>io.micrometer</groupId>
- <artifactId>micrometer-registry-statsd</artifactId>
- <version>${version.io.micrometer}</version>
- </dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
<version>${version.io.projectreactor}</version>
</dependency>
- <!-- Override: quarkus-bom:3.33.3.2 ships MongoDB driver artifacts at
5.6.4.
- Pin to 5.9.2 (version.mongodb-driver-sync). Must appear before the
quarkus-bom
- import to take precedence (first explicit entry wins in Maven
dependencyManagement). -->
+ <!-- CVE-2026-18710 (JAVA-6266): quarkus-bom:3.33.4 ships MongoDB driver
artifacts at 5.6.4.
+ Pin to 5.11.1 (version.mongodb-driver-sync). Remove when
quarkus-bom ships >= 5.11.1.
+ Must appear before the quarkus-bom import to take precedence
+ (first explicit entry wins in Maven dependencyManagement). -->
<dependency>
<groupId>org.mongodb</groupId>
<artifactId>mongodb-driver-sync</artifactId>
diff --git a/kogito-springboot/bom/pom.xml b/kogito-springboot/bom/pom.xml
index 2e2ce45d02a..4de143915d8 100644
--- a/kogito-springboot/bom/pom.xml
+++ b/kogito-springboot/bom/pom.xml
@@ -89,9 +89,9 @@
<type>pom</type>
<scope>import</scope>
</dependency>
- <!-- CVE fix: spring-boot-dependencies:4.1.1 imports
mongodb-driver-bom:5.8.1 which pins
- mongodb-driver-core and bson to 5.8.1. Override to match
mongodb-driver-sync:5.9.2.
- https://jira.mongodb.org/browse/JAVA-6266 -->
+ <!-- CVE-2026-18710 (JAVA-6266): spring-boot-dependencies:4.1.1 imports
mongodb-driver-bom:5.8.1
+ which pins mongodb-driver-core and bson to 5.8.1. Override to
5.11.1 (version.mongodb-driver-sync).
+ Remove when spring-boot-dependencies imports mongodb-driver-bom >=
5.11.1. -->
<dependency>
<groupId>org.mongodb</groupId>
<artifactId>mongodb-driver-core</artifactId>
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index 48262397c66..a1ab007ceb3 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -49,7 +49,7 @@
<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
<version.com.thoughtworks.xstream>1.4.21</version.com.thoughtworks.xstream>
<version.io.quarkiverse.operatorsdk>6.6.7</version.io.quarkiverse.operatorsdk>
- <version.io.quarkus>3.33.3.2</version.io.quarkus>
+ <version.io.quarkus>3.33.4</version.io.quarkus>
<version.org.apache.commons.math3>3.6.1</version.org.apache.commons.math3>
<version.org.apache.commons.text>1.14.0</version.org.apache.commons.text>
<version.org.apache.openjpa>4.0.0</version.org.apache.openjpa>
@@ -58,12 +58,9 @@
<version.org.freemarker>2.3.34</version.org.freemarker>
<version.org.jdom2>2.0.6.1</version.org.jdom2>
<version.org.jfree.jfreechart>1.5.4</version.org.jfree.jfreechart>
- <version.io.micrometer>1.16.7</version.io.micrometer>
<version.org.openrewrite.recipe>1.19.3</version.org.openrewrite.recipe>
<version.org.slf4j>2.0.17</version.org.slf4j><!-- TODO keep in sync with
quarkus-bom -->
<version.org.eclipse.parsson>1.1.8</version.org.eclipse.parsson>
- <!-- CVE-2026-56624: Apache MINA SSHD fixed version -->
- <version.org.apache.sshd>2.19.0</version.org.apache.sshd>
<version.org.springframework>7.0.9</version.org.springframework>
<version.org.springframework.boot>4.1.1</version.org.springframework.boot>
<version.com.fasterxml.jackson.databind>2.22.2</version.com.fasterxml.jackson.databind>
@@ -143,17 +140,6 @@
<scope>import</scope>
</dependency>
<!-- Normal dependencies versions-->
- <!-- CVE-2026-56624: override sshd-common and sshd-core pinned at 2.17.1
by quarkus-bom -->
- <dependency>
- <groupId>org.apache.sshd</groupId>
- <artifactId>sshd-common</artifactId>
- <version>${version.org.apache.sshd}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.sshd</groupId>
- <artifactId>sshd-core</artifactId>
- <version>${version.org.apache.sshd}</version>
- </dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
@@ -164,22 +150,6 @@
<artifactId>logback-classic</artifactId>
<version>${version.ch.qos.logback}</version>
</dependency>
- <!-- CVE-2026-59295, CVE-2026-59296: micrometer-core/commons/observation
pinned at 1.16.6 by quarkus-bom 3.33.x; upgrade to 1.16.7 -->
- <dependency>
- <groupId>io.micrometer</groupId>
- <artifactId>micrometer-core</artifactId>
- <version>${version.io.micrometer}</version>
- </dependency>
- <dependency>
- <groupId>io.micrometer</groupId>
- <artifactId>micrometer-commons</artifactId>
- <version>${version.io.micrometer}</version>
- </dependency>
- <dependency>
- <groupId>io.micrometer</groupId>
- <artifactId>micrometer-observation</artifactId>
- <version>${version.io.micrometer}</version>
- </dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
