jaedonP opened a new pull request, #4076:
URL: https://github.com/apache/incubator-kie-tools/pull/4076
## Summary
Upgrades build tooling, platform BOMs and transitive dependency overrides to
current patched releases:
- Quarkus 3.33.4 -> 3.33.4.1, a patch release of the 3.33 LTS line. The
`version.quarkus` property in the Quarkus BOM and the default
`QUARKUS_PLATFORM_version` in the root environment are kept in sync.
- Spring Boot 4.1.1 -> 4.1.2, a patch release of the 4.1 line, in the Spring
Boot BOM.
- Go 1.26.7 -> 1.27.3 and Node.js 24.21.0 -> 24.22.1 across the devbox
environment, CI image, GitHub Actions setup and the CORS proxy image.
`devbox.lock` was regenerated with `devbox install`.
- pnpm overrides in `pnpm-workspace.yaml`:
- `axios` is forced to `^1.20.0`, which fixes prototype pollution and
header override vulnerabilities in older 1.x releases.
- `qs` is pinned to `6.16.2` (was `^6.16.0`), which fixes `qs.stringify`
failing to encode the key of an empty array when `allowEmptyArrays` is used.
- `undici` is raised from `^6.29.0` to `^6.29.1`, which includes further
security fixes for the 6.x line.
- `follow-redirects` is pinned to `1.16.2`; it is a transitive dependency
of `axios` and `http-proxy`.
- `express@4>body-parser` is pinned to `~1.20.9` so Express 4 uses a
patched `body-parser` once the lockfile is regenerated.
- `handlebars` is pinned to `4.7.10`. Remove the pin once the parents that
pull in older versions update to a patched release.
- `zod` is forced to `^4.6.7` so all transitive `zod` 4.x consumers use
the latest patched release.
- `uri-js` is replaced with `fast-uri@^3.1.9` for `ajv-formats-draft2019`
and `json-refs`, because `uri-js` is unmaintained and carries a known
vulnerable dependency.
`pnpm-lock.yaml` is not part of this draft and has to be regenerated with
`pnpm bootstrap` (inside `devbox shell`). The `zod` override is a wider bump
for consumers that currently pin an older 4.x version, so compatibility should
be checked once the lockfile is regenerated.
## Changes
| File | Change |
|------|--------|
| packages/quarkus-bom/pom.xml | upgraded `version.quarkus` from 3.33.4 to
3.33.4.1 |
| packages/root-env/env/index.js | upgraded `QUARKUS_PLATFORM_version`
default from 3.33.4 to 3.33.4.1 |
| packages/spring-boot-bom/pom.xml | upgraded
`version.org.springframework.boot` from 4.1.1 to 4.1.2 |
| repo/build-dependencies-versions.json | upgraded go from 1.26.7 to 1.27.3
and node from 24.21.0 to 24.22.1 |
| devbox.json | upgraded go from 1.26.7 to 1.27.3 |
| devbox.lock | regenerated for go 1.27.3 |
| README.md | updated documented Go version to 1.27.3 |
| .ci/incubator-kie-tools-ci-build.Dockerfile | upgraded Node.js to 24.22.1
and Go to 1.27.3 |
| .github/actions/setup-env/action.yml | upgraded Node.js to 24.22.1 and Go
to 1.27.3 |
| .github/workflows/ci_build.yml | upgraded Node.js from 24.21.0 to 24.22.1 |
| packages/cors-proxy-image/Containerfile | upgraded Node.js from v24.21.0
to v24.22.1 |
| pnpm-workspace.yaml | added `axios` `^1.20.0`, `follow-redirects`
`1.16.2`, `express@4>body-parser` `~1.20.9`, `handlebars` `4.7.10`, `zod`
`^4.6.7` and `ajv-formats-draft2019>uri-js` / `json-refs>uri-js` ->
`npm:fast-uri@^3.1.9` overrides; raised `qs` `^6.16.0` -> `6.16.2` and `undici`
`^6.29.0` -> `^6.29.1`; updated the explanatory comments |
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
