[
https://issues.apache.org/jira/browse/AMQ-9388?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17785701#comment-17785701
]
ASF subversion and git services commented on AMQ-9388:
------------------------------------------------------
Commit cbe7c6a832794bde4a20a03086c0d9e1af4e7d7c in activemq's branch
refs/heads/main from Christopher L. Shannon
[ https://gitbox.apache.org/repos/asf?p=activemq.git;h=cbe7c6a83 ]
Merge pull request #1117 from cshannon/AMQ-9388
AMQ-9388 - Exclude activemq-client-jakarta from camel-activemq
> camel-activemq transitively pulls in activemq-client-jakarta
> ------------------------------------------------------------
>
> Key: AMQ-9388
> URL: https://issues.apache.org/jira/browse/AMQ-9388
> Project: ActiveMQ
> Issue Type: Bug
> Components: Broker
> Reporter: Christopher L. Shannon
> Assignee: Christopher L. Shannon
> Priority: Blocker
> Fix For: 6.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> While reviewing the 6.0.0 release I noticed that the newly added
> {{camel-activemq}} module pulls in {{activemq-client-jakarta}} as a
> transitive dependency. This makes sense since the version used is based on
> ActiveMQ 5.18.2 as 6.0.0 isn't released yet.
> We need to exclude this because with version 6.0.0 this module no longer
> exists so is not needed and secondly the 5.18.2 version has a CVE against it.
> The dependency in the current release is not included in the tar distribution
> but since it is transitively being pulled in with maven if someone has a
> dependency on the apache-activemq pom they will have the jar pulled into
> their build.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
