Hi all, I would like to propose removing the BIRT plugin (plugins/birt) from trunk. It has been disabled on every maintained branch since May 2023 (OFBIZ-12824), when the only available response to CVE-2022-25371 in the bundled BIRT 4.5.0 viewer was to switch the component off, and nothing has changed since. Anyone who wants it today has to re-enable a known-vulnerable viewer by hand.
Re-enabling it properly would mean moving from a 2015 BIRT release to a current one and reworking the viewer integration. Feature work on the plugin ended in 2017, its later commits are almost all project-wide sweeps, it has eight unresolved JIRA issues going back to 2013, and nobody has offered to take on the upgrade in the three years since the CVE. Meanwhile it leaves dead code around the tree: the scrum plugin's eight BIRT charts have been broken since the plugin was disabled, and several reports, labels and docs still refer to it. If there are no objections, I will file a JIRA and open a pull request that also deals with the scrum charts. Thanks, Mridul Pathak
