+1 Jacopo
On Mon, Oct 26, 2026 at 7:00 AM Mridul Pathak <[email protected]> wrote: > Hi all, > > I would like to propose removing the BIRT plugin (plugins/birt) from trunk. > It has been disabled on every maintained branch since May 2023 > (OFBIZ-12824), when the only available response to CVE-2022-25371 in the > bundled BIRT 4.5.0 viewer was to switch the component off, and nothing has > changed since. Anyone who wants it today has to re-enable a > known-vulnerable viewer by hand. > > Re-enabling it properly would mean moving from a 2015 BIRT release to a > current one and reworking the viewer integration. Feature work on the > plugin ended in 2017, its later commits are almost all project-wide sweeps, > it has eight unresolved JIRA issues going back to 2013, and nobody has > offered to take on the upgrade in the three years since the CVE. Meanwhile > it leaves dead code around the tree: the scrum plugin's eight BIRT charts > have been broken since the plugin was disabled, and several reports, labels > and docs still refer to it. > > If there are no objections, I will file a JIRA and open a pull request that > also deals with the scrum charts. > > Thanks, > Mridul Pathak >
