[
https://issues.apache.org/jira/browse/TOMEE-4678?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla closed TOMEE-4678.
----------------------------------
Resolution: Fixed
Fixed on tomee-10.x via ecc7775b7e: micrometer 1.12.5 -> 1.15.12, with the
Prometheus registry switched to micrometer-registry-prometheus-simpleclient
because micrometer 1.13 moved PrometheusMeterRegistry to
io.micrometer.prometheusmetrics while smallrye-metrics 5.1.0 still uses
io.micrometer.prometheus. The MicroProfile Metrics TCK passes against a
distribution built with it, 178 tests, no failures.
main is not affected: MicroProfile 7 dropped Metrics, so 11.x ships neither
micrometer nor smallrye-metrics.
> Upgrade micrometer-core jar
> ---------------------------
>
> Key: TOMEE-4678
> URL: https://issues.apache.org/jira/browse/TOMEE-4678
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Affects Versions: 10.2.0
> Reporter: RAJU THANNEERU
> Priority: Major
> Fix For: 10.3.0
>
>
> |[CVE-2026-40984|https://nvd.nist.gov/vuln/detail/CVE-2026-40984]|7.5|high|fixed
> in 1.16.6, 1.15.12|2026-08-07 05:23:22 +0000
> UTC|[io.micrometer_micrometer-core_1.12.5|http://10.96.74.60:6066/gitlab-ui/api/projects/131760/html-report?artifact=twistlock-appworks.html#sha256:605259df88676786462dc8161fa3b454c4079a314fc27b916b9a2e604863155c_io.micrometer_micrometer-core_1.12.5]|this
> image|/usr/local/tomee/lib/micrometer-core-1.12.5.jar|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
