[jira] [Commented] (KARAF-6078) Misaligned versions of jetty between pax-web and standard features

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KARAF-6078?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16736925#comment-16736925 ] 

ASF GitHub Bot commented on KARAF-6078:
---------------------------------------

rovarga commented on pull request #713: [KARAF-6078] bump jetty to 9.3.24.v20180605
URL: https://github.com/apache/karaf/pull/713
 
 
   This aligns jetty version used by features/standard with the version used by pas-web-6.0.11.
 
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


> Misaligned versions of jetty between pax-web and standard features
> ------------------------------------------------------------------
>
>                 Key: KARAF-6078
>                 URL: https://issues.apache.org/jira/browse/KARAF-6078
>             Project: Karaf
>          Issue Type: Dependency upgrade
>          Components: karaf
>    Affects Versions: 4.1.6, 4.1.7
>            Reporter: Robert Varga
>            Priority: Major
>
> KARAF-5860 upgraded the jetty version brought it by pax-web, but did not upgrade the version provided in features/standard, which was left at 9.3.21.
> This means that depending on which feature downstreams are using, they may end up with a vulnerable jetty version.
> Furthermore, an offline distribution (like the one created for OpenDaylight) will end up having both versions, leadining to unnecessary bloat.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)