[
https://issues.apache.org/jira/browse/TOMEE-4127?focusedWorklogId=833946&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-833946
]
ASF GitHub Bot logged work on TOMEE-4127:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 15/Dec/22 19:21
Start Date: 15/Dec/22 19:21
Worklog Time Spent: 10m
Work Description: dblevins commented on PR #988:
URL: https://github.com/apache/tomee/pull/988#issuecomment-1353594469
We're currently waiting on TCK results for latest changes against CXF 3.5.4.
The expectation is that the TCK should now be passing and once Jean-Louis'
AroundConstruct PR is merged, we are now full passing all Jakarta EE 9.1 and
MicroProfile 5.0 TCKs!
Let's either wait a few days to merge this so we can confirm those results
or have you run the TCK locally to verify no regressions.
If you want to run locally, here's the latest setup details
The branch we use for TomEE 9:
```
git clone [email protected]:apache/tomee-tck.git
cd tomee-tck
git checkout jakartaee9-tck
```
If you don't have the TCK setup this script should do it:
```
bash setup.sh
```
Then you can run just the JAX-RS tests like so:
```
./runtests -sql skip -ds -w tomee-plume com/sun/ts/tests/jaxrs
```
Issue Time Tracking
-------------------
Worklog Id: (was: 833946)
Time Spent: 20m (was: 10m)
> CXF 3.5.5
> ---------
>
> Key: TOMEE-4127
> URL: https://issues.apache.org/jira/browse/TOMEE-4127
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Affects Versions: 9.0.0.RC1
> Reporter: Richard Zowalla
> Assignee: Richard Zowalla
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> December 13, 2022 - Apache CXF 3.5.5 and 3.4.10 released!
> The Apache CXF team is proud to announce the availability of our latest patch
> releases! Over 9 JIRA issues were fixed for 3.5.5 and 3.4.10. Two new CVEs
> were issued for vulnerabilities fixed in these releases:
> CVE-2022-46363: Apache CXF directory listing / code exfiltration
> CVE-2022-46364: Apache CXF SSRF Vulnerability
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
