This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 079a819b11d [NO-ISSUE] pin opentelemetry-api to 1.62.0 and
opentelemetry-instrumentation-bom-alpha to 2.28.1-alpha (#7112)
079a819b11d is described below
commit 079a819b11ddd692f0577e78e5c6e30c22a10656
Author: ANN JOY <[email protected]>
AuthorDate: Mon Oct 5 15:50:06 2026 +0530
[NO-ISSUE] pin opentelemetry-api to 1.62.0 and
opentelemetry-instrumentation-bom-alpha to 2.28.1-alpha (#7112)
opentelemetry-api 1.57.0 is pulled in transitively via
smallrye-reactive-messaging-otel
in both kie-quarkus-build-parent and kogito-quarkus/bom module trees.
Without the instrumentation BOM pin,
opentelemetry-instrumentation-api:2.23.0
(shipped by quarkus-bom 3.33.3.2, compiled against opentelemetry-api:1.57.0)
conflicts with the pinned 1.62.0 API, causing GraalVM native-image pointsto
analysis failures in dmn-event-driven-quarkus and
ruleunit-event-driven-quarkus.
- kie-quarkus-build-parent/pom.xml: added version.io.opentelemetry.api and
version.io.opentelemetry.instrumentation properties; pinned
opentelemetry-api
and imported opentelemetry-instrumentation-bom-alpha before quarkus-bom
- kogito-quarkus/bom/pom.xml: same additions
Pins should be removed in a future Quarkus upgrade that ships
OpenTelemetry >= 1.62.0 and instrumentation >= 2.28.1.
---
kie-quarkus-build-parent/pom.xml | 19 +++++++++++++++++++
kogito-quarkus/bom/pom.xml | 19 +++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git a/kie-quarkus-build-parent/pom.xml b/kie-quarkus-build-parent/pom.xml
index 554174d800c..e73faed0471 100644
--- a/kie-quarkus-build-parent/pom.xml
+++ b/kie-quarkus-build-parent/pom.xml
@@ -39,6 +39,13 @@
</description>
<properties>
+ <!--
+ [CVE-2026-45292] opentelemetry-api 1.57.0 pulled in via
smallrye-reactive-messaging-otel.
+ Pin to 1.62.0 before quarkus-bom import so this value takes precedence.
+ Should be removed in future Quarkus upgrades that include OpenTelemetry
>= 1.62.0
+ -->
+ <version.io.opentelemetry.api>1.62.0</version.io.opentelemetry.api>
+
<version.io.opentelemetry.instrumentation>2.28.1-alpha</version.io.opentelemetry.instrumentation>
<version.io.quarkus>3.33.4</version.io.quarkus>
<version.io.quarkus.camel>3.33.2</version.io.quarkus.camel>
<!-- Quarkus-platform-aligned pin. kie-parent keeps the Spring Boot /
framework-neutral value;
@@ -60,6 +67,18 @@
<dependencyManagement>
<dependencies>
+ <dependency>
+ <groupId>io.opentelemetry.instrumentation</groupId>
+ <artifactId>opentelemetry-instrumentation-bom-alpha</artifactId>
+ <version>${version.io.opentelemetry.instrumentation}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
+ <dependency>
+ <groupId>io.opentelemetry</groupId>
+ <artifactId>opentelemetry-api</artifactId>
+ <version>${version.io.opentelemetry.api}</version>
+ </dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-bom</artifactId>
diff --git a/kogito-quarkus/bom/pom.xml b/kogito-quarkus/bom/pom.xml
index de2b43ba4b5..8c6a6233e5e 100644
--- a/kogito-quarkus/bom/pom.xml
+++ b/kogito-quarkus/bom/pom.xml
@@ -31,6 +31,13 @@
<!-- Used to define which poms are allowed to have dependencyManagement
sections. This is to enforce the convention that only the root pom should have
dependencyManagement, and all other poms should inherit from it. -->
<allowedPomsList>org.kie.kogito:kogito-quarkus-bom</allowedPomsList>
<quarkus.logging.manager>org.jboss.logmanager.LogManager</quarkus.logging.manager>
+ <!--
+ [CVE-2026-45292] opentelemetry-api 1.57.0 pulled in via
smallrye-reactive-messaging-otel.
+ Pin to 1.62.0 before quarkus-bom import so this value takes precedence.
+ Should be removed in future Quarkus upgrades that include OpenTelemetry
>= 1.62.0
+ -->
+ <version.io.opentelemetry.api>1.62.0</version.io.opentelemetry.api>
+
<version.io.opentelemetry.instrumentation>2.28.1-alpha</version.io.opentelemetry.instrumentation>
<version.io.quarkus>3.33.4</version.io.quarkus>
<version.io.quarkus.quarkus-test>${version.io.quarkus}</version.io.quarkus.quarkus-test>
<version.io.quarkiverse.jackson-jq>2.4.0</version.io.quarkiverse.jackson-jq>
@@ -181,6 +188,18 @@
<artifactId>bson-record-codec</artifactId>
<version>${version.mongodb-driver-sync}</version>
</dependency>
+ <dependency>
+ <groupId>io.opentelemetry.instrumentation</groupId>
+ <artifactId>opentelemetry-instrumentation-bom-alpha</artifactId>
+ <version>${version.io.opentelemetry.instrumentation}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
+ <dependency>
+ <groupId>io.opentelemetry</groupId>
+ <artifactId>opentelemetry-api</artifactId>
+ <version>${version.io.opentelemetry.api}</version>
+ </dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-bom</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
