Hi all, Thank you all for the +1s. The BIRT plugin is now removed from trunk under OFBIZ-13763 (https://issues.apache.org/jira/browse/OFBIZ-13763), merged in https://github.com/apache/ofbiz-plugins/pull/482 and https://github.com/apache/ofbiz-framework/pull/2476.
Thanks, Mridul Pathak On Mon, Oct 26, 2026 at 3:02 PM Jacopo Cappellato < [email protected]> wrote: > +1 > > Jacopo > > On Mon, Oct 26, 2026 at 7:00 AM Mridul Pathak <[email protected]> > wrote: > > > Hi all, > > > > I would like to propose removing the BIRT plugin (plugins/birt) from > trunk. > > It has been disabled on every maintained branch since May 2023 > > (OFBIZ-12824), when the only available response to CVE-2022-25371 in the > > bundled BIRT 4.5.0 viewer was to switch the component off, and nothing > has > > changed since. Anyone who wants it today has to re-enable a > > known-vulnerable viewer by hand. > > > > Re-enabling it properly would mean moving from a 2015 BIRT release to a > > current one and reworking the viewer integration. Feature work on the > > plugin ended in 2017, its later commits are almost all project-wide > sweeps, > > it has eight unresolved JIRA issues going back to 2013, and nobody has > > offered to take on the upgrade in the three years since the CVE. > Meanwhile > > it leaves dead code around the tree: the scrum plugin's eight BIRT charts > > have been broken since the plugin was disabled, and several reports, > labels > > and docs still refer to it. > > > > If there are no objections, I will file a JIRA and open a pull request > that > > also deals with the scrum charts. > > > > Thanks, > > Mridul Pathak > > >
