rzo1 opened a new pull request, #3011: URL: https://github.com/apache/tomee/pull/3011
Bumps `version.activemq` from 6.2.10 to 6.3.2 on tomee-10.x to fix [CVE-2026-74761](https://nvd.nist.gov/vuln/detail/CVE-2026-74761). The CVE affects all 6.x releases before 6.3.2, and there is no fixed 6.2.x release. 6.3 is normally the TomEE 11 line. For the ActiveMQ modules TomEE 10 ships (broker, client, jdbc-store, openwire-legacy, ra), the runtime spec dependencies are unchanged from 6.2.10: Jakarta Messaging 3.1, Connector, and Annotation, all provided by TomEE at EE 10 levels. Both lines target Java 17. The EE 11 dependencies in 6.3 (Servlet 6.1, EL 6.0, Jetty 12, Spring 7) belong to the web console and HTTP transport, which TomEE does not ship. CI only compiles this change, so the JMS tests and the arquillian JMS tests are where any runtime regression would show up. https://issues.apache.org/jira/browse/TOMEE-4721 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
