bvolpato opened a new pull request, #37944: URL: https://github.com/apache/beam/pull/37944
## Summary Upgrades ActiveMQ from **5.14.5** to **5.19.2** to remediate critical security vulnerabilities. ActiveMQ is used exclusively as a **test dependency** in Beam (embedded broker for JMS, MQTT, and AMQP IO connector tests). ### CVEs Fixed | CVE | CVSS | Severity | Description | |-----|------|----------|-------------| | [CVE-2023-46604](https://www.cve.org/CVERecord?id=CVE-2023-46604) | **10.0** | 🔴 Critical | Remote Code Execution via ClassInfo manipulation in OpenWire protocol. **Actively exploited in the wild by ransomware.** | | [CVE-2022-41678](https://www.cve.org/CVERecord?id=CVE-2022-41678) | **8.8** | 🔴 High | RCE via Jolokia and REST API | ### Changes Required for Compatibility 1. **JMS spec upgrade** (JMS IO): `geronimo-jms_1.1_spec:1.1.1` → `geronimo-jms_2.0_spec:1.0-alpha-2` - ActiveMQ 5.19.x uses JMS 2.0 API internally (`setJMSDeliveryTime`). JMS 2.0 is fully backward-compatible with JMS 1.1 — only adds new methods. 2. **MockNonSerializableConnectionFactory** (JMS IO test): Added JMS 2.0 `createContext()` stubs. 3. **proton-j exclusion** (AMQP IO): Excluded transitive `proton-j:0.34.1` from `activemq-amqp` to avoid conflict with the directly declared `proton-j:0.16.0`. ### Testing All three affected test modules pass locally: - ✅ `:sdks:java:io:jms:test` (54 tests) - ✅ `:sdks:java:io:mqtt:test` - ✅ `:sdks:java:io:amqp:test` Fixes #37943 ------------------------ Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily: - [x] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment `fixes #<ISSUE NUMBER>` instead. - [x] Update `CHANGES.md` with noteworthy changes. - [ ] If this contribution is large, please file an Apache [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). See the [Contributor Guide](https://beam.apache.org/contribute) for more tips on [how to make review process smoother](https://github.com/apache/beam/blob/master/CONTRIBUTING.md#make-the-reviewers-job-easier). To check the build health, please visit [https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md](https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md) GitHub Actions Tests Status (on master branch) ------------------------------------------------------------------------------------------------ [](https://github.com/apache/beam/actions?query=workflow%3A%22Build+python+source+distribution+and+wheels%22+branch%3Amaster+event%3Aschedule) [](https://github.com/apache/beam/actions?query=workflow%3A%22Python+Tests%22+branch%3Amaster+event%3Aschedule) [](https://github.com/apache/beam/actions?query=workflow%3A%22Java+Tests%22+branch%3Amaster+event%3Aschedule) [](https://github.com/apache/beam/actions?query=workflow%3A%22Go+tests%22+branch%3Amaster+event%3Aschedule) See [CI.md](https://github.com/apache/beam/blob/master/CI.md) for more information about GitHub Actions CI or the [workflows README](https://github.com/apache/beam/blob/master/.github/workflows/README.md) to see a list of phrases to trigger workflows. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
