You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomee.apache.org by Richard Zowalla <rz...@apache.org> on 2023/01/17 13:40:11 UTC
[VOTE] TomEE 8.0.14
Hi all,
this is a vote for a release of Apache TomEE 8.0.14.
It is a maintenance release with some bug fixes and dependencies
upgrades.
###############
Maven Repo:
https://repository.apache.org/content/repositories/orgapachetomee-1213/
<repositories>
<repository>
<id>tomee-8.0.14-release-test</id>
<name>Testing TomEE 8.0.14 release candidate</name>
<url>
https://repository.apache.org/content/repositories/orgapachetomee-1213/
</url>
</repository>
</repositories>
###############
Binaries & Source:
https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
###############
Tag:
https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
###############
Release notes:
https://issues.apache.org/jira/projects/TOMEE/versions/12352390
###############
Here is an adoc generated version of the changelog as well:
== Dependency upgrade
[.compact]
- link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
XBean 4.22
- link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
CXF 3.4.10
- link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
CXF 3.4.9
- link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
- link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
HSQLDB 2.7.1
- link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
Hibernate 5.6.14
- link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
Jackson 2.14.0
- link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
Jackson 2.14.1
- link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
SnakeYAML - CVE-2022-1471
- link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
Tomcat 9.0.69
- link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
Tomcat 9.0.70
- link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
Tomcat 9.0.71
- link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
Velocity 2.3
- link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
Woodstox 6.4.0 (CVE-2022-40152)
- link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
bcel component
- link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
commons-compress 1.22
- link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
jackson 2.14.0-rc2
- link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
woodstox-core mitigate CVE-2022-40153
== Bug
[.compact]
- link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
Remote EJB2 BMP Memory Leak
- link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
Performance Regression in bean resolution in EAR files
- link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
Typo with EL22Adaptor implementation in openwebbeans.properties
- link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
TomEE logs SEVERE: Expected ContextBinding to have the method getThreadName()
- link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
TomEE version no longer appearing at default manager page
- link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
Unable to see TomEE version in Tomcat home page with Java 17
- link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth mechanism
- link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
tomee-embedded-maven-plugin fails with NPE
- link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on TomEE's tomcat-websocket.jar
== Improvement
[.compact]
- link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
Remove timing of timing just for logging
== Task
[.compact]
- link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
Apache Parent 29
- link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
JUnit 5.9.2
- link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
Patch Plugin 0.10
== Documentation
[.compact]
- link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
Documentation Website: XA DataSource Configuration: Bug in MySQL Sample Code
== Fixed Common Vulnerabilities and Exposures (CVEs)
[.compact]
- link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
HSQLDB 2.7.1
- link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-46363
- link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
Update woodstox-core to mitigate CVE-2022-40153
- link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
Upgrade bcel component in TomEE
- link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on TomEE's tomcat-websocket.jar
###############
Here is the dependency diff from 8.0.13 to 8.0.14 created with our
release tools:
artifactId from to
------------------------------- ------------ --------
jackson-annotations 2.14.0-rc1 2.14.1
jackson-core 2.14.0-rc1 2.14.1
jackson-databind 2.14.0-rc1 2.14.1
jackson-dataformat-yaml 2.14.0-rc1 2.14.1
woodstox-core 6.2.4 6.4.0
cxf-rt-bindings-soap 3.4.8 3.4.10
cxf-rt-bindings-xml 3.4.8 3.4.10
cxf-rt-frontend-jaxws 3.4.8 3.4.10
cxf-rt-frontend-simple 3.4.8 3.4.10
cxf-rt-management 3.4.8 3.4.10
cxf-rt-rs-extension-providers 3.4.8 3.4.10
cxf-rt-rs-extension-search 3.4.8 3.4.10
cxf-rt-rs-json-basic 3.4.8 3.4.10
cxf-rt-rs-mp-client 3.4.8 3.4.10
cxf-rt-rs-security-cors 3.4.8 3.4.10
cxf-rt-rs-security-jose 3.4.8 3.4.10
cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
cxf-rt-rs-security-oauth2 3.4.8 3.4.10
cxf-rt-rs-service-description 3.4.8 3.4.10
cxf-rt-rs-sse 3.4.8 3.4.10
cxf-rt-security 3.4.8 3.4.10
cxf-rt-security-saml 3.4.8 3.4.10
cxf-rt-ws-addr 3.4.8 3.4.10
cxf-rt-ws-policy 3.4.8 3.4.10
cxf-rt-ws-security 3.4.8 3.4.10
cxf-rt-wsdl 3.4.8 3.4.10
cxf-shade 8.0.13 8.0.14
taglibs-shade 8.0.13 8.0.14
tomee-bootstrap 8.0.13 8.0.14
xbean-asm9-shaded 4.21 4.22
xbean-bundleutils 4.21 4.22
xbean-finder-shaded 4.21 4.22
xbean-naming 4.21 4.22
xbean-reflect 4.21 4.22
###############
Note:
(1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
jackson-dataformat-yaml (which is used in OpenAPI).
According to the Jackson people, they are not affected:
https://github.com/FasterXML/jackson-dataformats-text/issues/361
###############
Please VOTE
[+1] go ship it
[+0] meh, don't care
[-1] stop, there is a ${showstopper}
The VOTE is open for 72h or as long as needed.
Gruß
Richard
[VOTE RESULT] TomEE 8.0.14
Posted by Richard Zowalla <ri...@zowalla.com>.
Hi all,
thanks for voting. Vote passed with 8x +1 and no other votes:
- Daniel
- Thomas
- Jean-Louis (binding)
- Cesar (binding)
- Martin
- Richard (binding)
- Alex
- Jonathan (binding)
I'll proceed with the next steps.
Gruß
Richard
Am Dienstag, dem 17.01.2023 um 14:40 +0100 schrieb Richard Zowalla:
> Hi all,
>
> this is a vote for a release of Apache TomEE 8.0.14.
>
> It is a maintenance release with some bug fixes and dependencies
> upgrades.
>
> ###############
>
> Maven Repo:
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
>
> <repositories>
> <repository>
> <id>tomee-8.0.14-release-test</id>
> <name>Testing TomEE 8.0.14 release candidate</name>
> <url>
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
> </url>
> </repository>
> </repositories>
>
> ###############
>
> Binaries & Source:
>
> https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
>
> ###############
>
> Tag:
>
> https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
>
>
> ###############
>
> Release notes:
>
> https://issues.apache.org/jira/projects/TOMEE/versions/12352390
>
> ###############
>
> Here is an adoc generated version of the changelog as well:
>
> == Dependency upgrade
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> XBean 4.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> CXF 3.4.10
> - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> CXF 3.4.9
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> Hibernate 5.6.14
> - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> Jackson 2.14.0
> - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> Jackson 2.14.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> SnakeYAML - CVE-2022-1471
> - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> Tomcat 9.0.69
> - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> Tomcat 9.0.70
> - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> Tomcat 9.0.71
> - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> Velocity 2.3
> - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> Woodstox 6.4.0 (CVE-2022-40152)
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> bcel component
> - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> commons-compress 1.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> jackson 2.14.0-rc2
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> woodstox-core mitigate CVE-2022-40153
>
> == Bug
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> Remote EJB2 BMP Memory Leak
> - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> Performance Regression in bean resolution in EAR files
> - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> Typo with EL22Adaptor implementation in openwebbeans.properties
> - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> TomEE logs SEVERE: Expected ContextBinding to have the method
> getThreadName()
> - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> TomEE version no longer appearing at default manager page
> - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> Unable to see TomEE version in Tomcat home page with Java 17
> - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> mechanism
> - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> tomee-embedded-maven-plugin fails with NPE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on
> TomEE's tomcat-websocket.jar
>
> == Improvement
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> Remove timing of timing just for logging
>
> == Task
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> Apache Parent 29
> - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> JUnit 5.9.2
> - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> Patch Plugin 0.10
>
> == Documentation
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> Documentation Website: XA DataSource Configuration: Bug in MySQL
> Sample Code
>
> == Fixed Common Vulnerabilities and Exposures (CVEs)
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-
> 46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> Update woodstox-core to mitigate CVE-2022-40153
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> Upgrade bcel component in TomEE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on
> TomEE's tomcat-websocket.jar
>
>
>
>
> ###############
>
> Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> release tools:
>
> artifactId from to
> ------------------------------- ------------ --------
> jackson-annotations 2.14.0-rc1 2.14.1
> jackson-core 2.14.0-rc1 2.14.1
> jackson-databind 2.14.0-rc1 2.14.1
> jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> woodstox-core 6.2.4 6.4.0
> cxf-rt-bindings-soap 3.4.8 3.4.10
> cxf-rt-bindings-xml 3.4.8 3.4.10
> cxf-rt-frontend-jaxws 3.4.8 3.4.10
> cxf-rt-frontend-simple 3.4.8 3.4.10
> cxf-rt-management 3.4.8 3.4.10
> cxf-rt-rs-extension-providers 3.4.8 3.4.10
> cxf-rt-rs-extension-search 3.4.8 3.4.10
> cxf-rt-rs-json-basic 3.4.8 3.4.10
> cxf-rt-rs-mp-client 3.4.8 3.4.10
> cxf-rt-rs-security-cors 3.4.8 3.4.10
> cxf-rt-rs-security-jose 3.4.8 3.4.10
> cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> cxf-rt-rs-service-description 3.4.8 3.4.10
> cxf-rt-rs-sse 3.4.8 3.4.10
> cxf-rt-security 3.4.8 3.4.10
> cxf-rt-security-saml 3.4.8 3.4.10
> cxf-rt-ws-addr 3.4.8 3.4.10
> cxf-rt-ws-policy 3.4.8 3.4.10
> cxf-rt-ws-security 3.4.8 3.4.10
> cxf-rt-wsdl 3.4.8 3.4.10
> cxf-shade 8.0.13 8.0.14
> taglibs-shade 8.0.13 8.0.14
> tomee-bootstrap 8.0.13 8.0.14
> xbean-asm9-shaded 4.21 4.22
> xbean-bundleutils 4.21 4.22
> xbean-finder-shaded 4.21 4.22
> xbean-naming 4.21 4.22
> xbean-reflect 4.21 4.22
>
> ###############
>
> Note:
>
> (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> jackson-dataformat-yaml (which is used in OpenAPI).
> According to the Jackson people, they are not affected:
> https://github.com/FasterXML/jackson-dataformats-text/issues/361
>
> ###############
>
>
> Please VOTE
>
> [+1] go ship it
> [+0] meh, don't care
> [-1] stop, there is a ${showstopper}
>
> The VOTE is open for 72h or as long as needed.
>
> Gruß
> Richard
>
Re: [VOTE] TomEE 8.0.14
Posted by Richard Zowalla <rz...@apache.org>.
Thanks Jon!
I created https://issues.apache.org/jira/browse/TOMEE-4179 to track it,
so we can clean it up for 8.0.15
Guess, we need to adjust our excludes to prevent that.
Gruß
Richard
Am Donnerstag, dem 19.01.2023 um 10:37 +0000 schrieb Jonathan
Gallimore:
> +1 (binding)
>
> Additional comment is that we seem to have a few API jars creeping
> in,
> which should be part of the javaee-api jar:
>
> * geronimo-jta_1.1_spec
> * jakarta.annotation-api
> * jakarta.jws-api
> * jakarta.xml.soap-api
> * jakarta.xml.ws-api
>
> Not a blocker for release in my opinion, but worth cleaning up after.
> (I'm
> happy to help with that).
>
> Jon
>
> On Tue, Jan 17, 2023 at 1:40 PM Richard Zowalla <rz...@apache.org>
> wrote:
>
> > Hi all,
> >
> > this is a vote for a release of Apache TomEE 8.0.14.
> >
> > It is a maintenance release with some bug fixes and dependencies
> > upgrades.
> >
> > ###############
> >
> > Maven Repo:
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> >
> > <repositories>
> > <repository>
> > <id>tomee-8.0.14-release-test</id>
> > <name>Testing TomEE 8.0.14 release candidate</name>
> > <url>
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > </url>
> > </repository>
> > </repositories>
> >
> > ###############
> >
> > Binaries & Source:
> >
> > https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
> >
> > ###############
> >
> > Tag:
> >
> > https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
> >
> >
> > ###############
> >
> > Release notes:
> >
> > https://issues.apache.org/jira/projects/TOMEE/versions/12352390
> >
> > ###############
> >
> > Here is an adoc generated version of the changelog as well:
> >
> > == Dependency upgrade
> >
> > [.compact]
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> > XBean 4.22
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> > CXF 3.4.10
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> > CXF 3.4.9
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > HSQLDB 2.7.1
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> > Hibernate 5.6.14
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> > Jackson 2.14.0
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> > Jackson 2.14.1
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> > SnakeYAML - CVE-2022-1471
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> > Tomcat 9.0.69
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> > Tomcat 9.0.70
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> > Tomcat 9.0.71
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> > Velocity 2.3
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> > Woodstox 6.4.0 (CVE-2022-40152)
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > bcel component
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> > commons-compress
> > <
> > https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress
> > >
> > 1.22
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> > jackson 2.14.0-rc2
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > woodstox-core
> > <
> > https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core
> > >
> > mitigate CVE-2022-40153
> >
> > == Bug
> >
> > [.compact]
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> > Remote EJB2 BMP Memory Leak
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> > Performance Regression in bean resolution in EAR files
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> > Typo with EL22Adaptor implementation in openwebbeans.properties
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> > TomEE logs SEVERE: Expected ContextBinding to have the method
> > getThreadName()
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> > TomEE version no longer appearing at default manager page
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> > Unable to see TomEE version in Tomcat home page with Java 17
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> > Backport TOMEE-4065: LoginToContinue interceptor fails on custom
> > auth
> > mechanism
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> > tomee-embedded-maven-plugin
> > <
> > https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin
> > >
> > fails with NPE
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > CVE-2022-45143
> > <
> > https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > >
> > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > tomcat-websocket.jar
> >
> > == Improvement
> >
> > [.compact]
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> > Remove timing of timing just for logging
> >
> > == Task
> >
> > [.compact]
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> > Apache Parent 29
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> > JUnit 5.9.2
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> > Patch Plugin 0.10
> >
> > == Documentation
> >
> > [.compact]
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> > Documentation Website: XA DataSource Configuration: Bug in MySQL
> > Sample
> > Code
> >
> > == Fixed Common Vulnerabilities and Exposures (CVEs)
> >
> > [.compact]
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > HSQLDB 2.7.1
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-
> > 46363
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > Update woodstox-core to mitigate CVE-2022-40153
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > Upgrade bcel component in TomEE
> > - link:
> > https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > CVE-2022-45143
> > <
> > https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > >
> > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > tomcat-websocket.jar
> >
> >
> >
> >
> > ###############
> >
> > Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> > release tools:
> >
> > artifactId from to
> > ------------------------------- ------------ --------
> > jackson-annotations 2.14.0-rc1 2.14.1
> > jackson-core 2.14.0-rc1 2.14.1
> > jackson-databind 2.14.0-rc1 2.14.1
> > jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> > woodstox-core 6.2.4 6.4.0
> > cxf-rt-bindings-soap 3.4.8 3.4.10
> > cxf-rt-bindings-xml 3.4.8 3.4.10
> > cxf-rt-frontend-jaxws 3.4.8 3.4.10
> > cxf-rt-frontend-simple 3.4.8 3.4.10
> > cxf-rt-management 3.4.8 3.4.10
> > cxf-rt-rs-extension-providers 3.4.8 3.4.10
> > cxf-rt-rs-extension-search 3.4.8 3.4.10
> > cxf-rt-rs-json-basic 3.4.8 3.4.10
> > cxf-rt-rs-mp-client 3.4.8 3.4.10
> > cxf-rt-rs-security-cors 3.4.8 3.4.10
> > cxf-rt-rs-security-jose 3.4.8 3.4.10
> > cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> > cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> > cxf-rt-rs-service-description 3.4.8 3.4.10
> > cxf-rt-rs-sse 3.4.8 3.4.10
> > cxf-rt-security 3.4.8 3.4.10
> > cxf-rt-security-saml 3.4.8 3.4.10
> > cxf-rt-ws-addr 3.4.8 3.4.10
> > cxf-rt-ws-policy 3.4.8 3.4.10
> > cxf-rt-ws-security 3.4.8 3.4.10
> > cxf-rt-wsdl 3.4.8 3.4.10
> > cxf-shade 8.0.13 8.0.14
> > taglibs-shade 8.0.13 8.0.14
> > tomee-bootstrap 8.0.13 8.0.14
> > xbean-asm9-shaded 4.21 4.22
> > xbean-bundleutils 4.21 4.22
> > xbean-finder-shaded 4.21 4.22
> > xbean-naming 4.21 4.22
> > xbean-reflect 4.21 4.22
> >
> > ###############
> >
> > Note:
> >
> > (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency
> > of
> > jackson-dataformat-yaml (which is used in OpenAPI).
> > According to the Jackson people, they are not affected:
> > https://github.com/FasterXML/jackson-dataformats-text/issues/361
> >
> > ###############
> >
> >
> > Please VOTE
> >
> > [+1] go ship it
> > [+0] meh, don't care
> > [-1] stop, there is a ${showstopper}
> >
> > The VOTE is open for 72h or as long as needed.
> >
> > Gruß
> > Richard
> >
> >
Re: [VOTE] TomEE 8.0.14
Posted by Jonathan Gallimore <jo...@gmail.com>.
+1 (binding)
Additional comment is that we seem to have a few API jars creeping in,
which should be part of the javaee-api jar:
* geronimo-jta_1.1_spec
* jakarta.annotation-api
* jakarta.jws-api
* jakarta.xml.soap-api
* jakarta.xml.ws-api
Not a blocker for release in my opinion, but worth cleaning up after. (I'm
happy to help with that).
Jon
On Tue, Jan 17, 2023 at 1:40 PM Richard Zowalla <rz...@apache.org> wrote:
> Hi all,
>
> this is a vote for a release of Apache TomEE 8.0.14.
>
> It is a maintenance release with some bug fixes and dependencies
> upgrades.
>
> ###############
>
> Maven Repo:
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
>
> <repositories>
> <repository>
> <id>tomee-8.0.14-release-test</id>
> <name>Testing TomEE 8.0.14 release candidate</name>
> <url>
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
> </url>
> </repository>
> </repositories>
>
> ###############
>
> Binaries & Source:
>
> https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
>
> ###############
>
> Tag:
>
> https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
>
>
> ###############
>
> Release notes:
>
> https://issues.apache.org/jira/projects/TOMEE/versions/12352390
>
> ###############
>
> Here is an adoc generated version of the changelog as well:
>
> == Dependency upgrade
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> XBean 4.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> CXF 3.4.10
> - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> CXF 3.4.9
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> Hibernate 5.6.14
> - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> Jackson 2.14.0
> - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> Jackson 2.14.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> SnakeYAML - CVE-2022-1471
> - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> Tomcat 9.0.69
> - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> Tomcat 9.0.70
> - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> Tomcat 9.0.71
> - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> Velocity 2.3
> - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> Woodstox 6.4.0 (CVE-2022-40152)
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> bcel component
> - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> commons-compress
> <https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress>
> 1.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> jackson 2.14.0-rc2
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> woodstox-core
> <https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core>
> mitigate CVE-2022-40153
>
> == Bug
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> Remote EJB2 BMP Memory Leak
> - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> Performance Regression in bean resolution in EAR files
> - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> Typo with EL22Adaptor implementation in openwebbeans.properties
> - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> TomEE logs SEVERE: Expected ContextBinding to have the method
> getThreadName()
> - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> TomEE version no longer appearing at default manager page
> - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> Unable to see TomEE version in Tomcat home page with Java 17
> - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> mechanism
> - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> tomee-embedded-maven-plugin
> <https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin>
> fails with NPE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143
> <https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143>
> Apache Tomcat - JsonErrorReportValve injection on TomEE's
> tomcat-websocket.jar
>
> == Improvement
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> Remove timing of timing just for logging
>
> == Task
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> Apache Parent 29
> - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> JUnit 5.9.2
> - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> Patch Plugin 0.10
>
> == Documentation
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> Documentation Website: XA DataSource Configuration: Bug in MySQL Sample
> Code
>
> == Fixed Common Vulnerabilities and Exposures (CVEs)
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> Update woodstox-core to mitigate CVE-2022-40153
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> Upgrade bcel component in TomEE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143
> <https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143>
> Apache Tomcat - JsonErrorReportValve injection on TomEE's
> tomcat-websocket.jar
>
>
>
>
> ###############
>
> Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> release tools:
>
> artifactId from to
> ------------------------------- ------------ --------
> jackson-annotations 2.14.0-rc1 2.14.1
> jackson-core 2.14.0-rc1 2.14.1
> jackson-databind 2.14.0-rc1 2.14.1
> jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> woodstox-core 6.2.4 6.4.0
> cxf-rt-bindings-soap 3.4.8 3.4.10
> cxf-rt-bindings-xml 3.4.8 3.4.10
> cxf-rt-frontend-jaxws 3.4.8 3.4.10
> cxf-rt-frontend-simple 3.4.8 3.4.10
> cxf-rt-management 3.4.8 3.4.10
> cxf-rt-rs-extension-providers 3.4.8 3.4.10
> cxf-rt-rs-extension-search 3.4.8 3.4.10
> cxf-rt-rs-json-basic 3.4.8 3.4.10
> cxf-rt-rs-mp-client 3.4.8 3.4.10
> cxf-rt-rs-security-cors 3.4.8 3.4.10
> cxf-rt-rs-security-jose 3.4.8 3.4.10
> cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> cxf-rt-rs-service-description 3.4.8 3.4.10
> cxf-rt-rs-sse 3.4.8 3.4.10
> cxf-rt-security 3.4.8 3.4.10
> cxf-rt-security-saml 3.4.8 3.4.10
> cxf-rt-ws-addr 3.4.8 3.4.10
> cxf-rt-ws-policy 3.4.8 3.4.10
> cxf-rt-ws-security 3.4.8 3.4.10
> cxf-rt-wsdl 3.4.8 3.4.10
> cxf-shade 8.0.13 8.0.14
> taglibs-shade 8.0.13 8.0.14
> tomee-bootstrap 8.0.13 8.0.14
> xbean-asm9-shaded 4.21 4.22
> xbean-bundleutils 4.21 4.22
> xbean-finder-shaded 4.21 4.22
> xbean-naming 4.21 4.22
> xbean-reflect 4.21 4.22
>
> ###############
>
> Note:
>
> (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> jackson-dataformat-yaml (which is used in OpenAPI).
> According to the Jackson people, they are not affected:
> https://github.com/FasterXML/jackson-dataformats-text/issues/361
>
> ###############
>
>
> Please VOTE
>
> [+1] go ship it
> [+0] meh, don't care
> [-1] stop, there is a ${showstopper}
>
> The VOTE is open for 72h or as long as needed.
>
> Gruß
> Richard
>
>
Re: [VOTE] TomEE 8.0.14
Posted by Martin Wiesner <ma...@apache.org>.
+1 (non-binding)
Thanks!
Best
Martin
On 2023/01/18 18:21:15 Cesar Hernandez wrote:
> +1 (binding).
> Thank you!
>
> El mar, 17 ene 2023 a las 16:36, Jean-Louis Monteiro (<
> jlmonteiro@tomitribe.com>) escribió:
>
> > +1 (binding)
> > --
> > Jean-Louis Monteiro
> > http://twitter.com/jlouismonteiro
> > http://www.tomitribe.com
> >
> >
> > On Tue, Jan 17, 2023 at 4:31 PM Thomas Andraschko <
> > andraschko.thomas@gmail.com> wrote:
> >
> > > +1 (non-binding)
> > > our applications are working fine
> > >
> > > Am Di., 17. Jan. 2023 um 14:49 Uhr schrieb Daniel Dias Dos Santos <
> > > daniel.dias.analistati@gmail.com>:
> > >
> > > > Hello,
> > > >
> > > > +1
> > > >
> > > > Thanks
> > > >
> > > > On Tue, Jan 17, 2023, 10:40 Richard Zowalla <rz...@apache.org> wrote:
> > > >
> > > > > Hi all,
> > > > >
> > > > > this is a vote for a release of Apache TomEE 8.0.14.
> > > > >
> > > > > It is a maintenance release with some bug fixes and dependencies
> > > > > upgrades.
> > > > >
> > > > > ###############
> > > > >
> > > > > Maven Repo:
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > > > >
> > > > > <repositories>
> > > > > <repository>
> > > > > <id>tomee-8.0.14-release-test</id>
> > > > > <name>Testing TomEE 8.0.14 release candidate</name>
> > > > > <url>
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > > > > </url>
> > > > > </repository>
> > > > > </repositories>
> > > > >
> > > > > ###############
> > > > >
> > > > > Binaries & Source:
> > > > >
> > > > >
> > > https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
> > > > >
> > > > > ###############
> > > > >
> > > > > Tag:
> > > > >
> > > > > https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
> > > > >
> > > > >
> > > > > ###############
> > > > >
> > > > > Release notes:
> > > > >
> > > > > https://issues.apache.org/jira/projects/TOMEE/versions/12352390
> > > > >
> > > > > ###############
> > > > >
> > > > > Here is an adoc generated version of the changelog as well:
> > > > >
> > > > > == Dependency upgrade
> > > > >
> > > > > [.compact]
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> > > > > XBean 4.22
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> > > > > CXF 3.4.10
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> > > > > CXF 3.4.9
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > > > > CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > > > > HSQLDB 2.7.1
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> > > > > Hibernate 5.6.14
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> > > > > Jackson 2.14.0
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> > > > > Jackson 2.14.1
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> > > > > SnakeYAML - CVE-2022-1471
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> > > > > Tomcat 9.0.69
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> > > > > Tomcat 9.0.70
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> > > > > Tomcat 9.0.71
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> > > > > Velocity 2.3
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> > > > > Woodstox 6.4.0 (CVE-2022-40152)
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > > > > bcel component
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> > > > > commons-compress
> > > > > <
> > > >
> > >
> > https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress
> > > > >
> > > > > 1.22
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> > > > > jackson 2.14.0-rc2
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > > > > woodstox-core
> > > > > <
> > > >
> > >
> > https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core
> > > > >
> > > > > mitigate CVE-2022-40153
> > > > >
> > > > > == Bug
> > > > >
> > > > > [.compact]
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> > > > > Remote EJB2 BMP Memory Leak
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> > > > > Performance Regression in bean resolution in EAR files
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> > > > > Typo with EL22Adaptor implementation in openwebbeans.properties
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> > > > > TomEE logs SEVERE: Expected ContextBinding to have the method
> > > > > getThreadName()
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> > > > > TomEE version no longer appearing at default manager page
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> > > > > Unable to see TomEE version in Tomcat home page with Java 17
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> > > > > Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> > > > > mechanism
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> > > > > tomee-embedded-maven-plugin
> > > > > <
> > > >
> > >
> > https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin
> > > > >
> > > > > fails with NPE
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > > > > CVE-2022-45143
> > > > > <
> > > >
> > >
> > https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > > > >
> > > > > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > > > > tomcat-websocket.jar
> > > > >
> > > > > == Improvement
> > > > >
> > > > > [.compact]
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> > > > > Remove timing of timing just for logging
> > > > >
> > > > > == Task
> > > > >
> > > > > [.compact]
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> > > > > Apache Parent 29
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> > > > > JUnit 5.9.2
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> > > > > Patch Plugin 0.10
> > > > >
> > > > > == Documentation
> > > > >
> > > > > [.compact]
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> > > > > Documentation Website: XA DataSource Configuration: Bug in MySQL
> > Sample
> > > > > Code
> > > > >
> > > > > == Fixed Common Vulnerabilities and Exposures (CVEs)
> > > > >
> > > > > [.compact]
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > > > > HSQLDB 2.7.1
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > > > > Update Apache CXF versions to mitigate CVE-2022-46364 and
> > > CVE-2022-46363
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > > > > Update woodstox-core to mitigate CVE-2022-40153
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > > > > Upgrade bcel component in TomEE
> > > > > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > > > > CVE-2022-45143
> > > > > <
> > > >
> > >
> > https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > > > >
> > > > > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > > > > tomcat-websocket.jar
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > ###############
> > > > >
> > > > > Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> > > > > release tools:
> > > > >
> > > > > artifactId from to
> > > > > ------------------------------- ------------ --------
> > > > > jackson-annotations 2.14.0-rc1 2.14.1
> > > > > jackson-core 2.14.0-rc1 2.14.1
> > > > > jackson-databind 2.14.0-rc1 2.14.1
> > > > > jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> > > > > woodstox-core 6.2.4 6.4.0
> > > > > cxf-rt-bindings-soap 3.4.8 3.4.10
> > > > > cxf-rt-bindings-xml 3.4.8 3.4.10
> > > > > cxf-rt-frontend-jaxws 3.4.8 3.4.10
> > > > > cxf-rt-frontend-simple 3.4.8 3.4.10
> > > > > cxf-rt-management 3.4.8 3.4.10
> > > > > cxf-rt-rs-extension-providers 3.4.8 3.4.10
> > > > > cxf-rt-rs-extension-search 3.4.8 3.4.10
> > > > > cxf-rt-rs-json-basic 3.4.8 3.4.10
> > > > > cxf-rt-rs-mp-client 3.4.8 3.4.10
> > > > > cxf-rt-rs-security-cors 3.4.8 3.4.10
> > > > > cxf-rt-rs-security-jose 3.4.8 3.4.10
> > > > > cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> > > > > cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> > > > > cxf-rt-rs-service-description 3.4.8 3.4.10
> > > > > cxf-rt-rs-sse 3.4.8 3.4.10
> > > > > cxf-rt-security 3.4.8 3.4.10
> > > > > cxf-rt-security-saml 3.4.8 3.4.10
> > > > > cxf-rt-ws-addr 3.4.8 3.4.10
> > > > > cxf-rt-ws-policy 3.4.8 3.4.10
> > > > > cxf-rt-ws-security 3.4.8 3.4.10
> > > > > cxf-rt-wsdl 3.4.8 3.4.10
> > > > > cxf-shade 8.0.13 8.0.14
> > > > > taglibs-shade 8.0.13 8.0.14
> > > > > tomee-bootstrap 8.0.13 8.0.14
> > > > > xbean-asm9-shaded 4.21 4.22
> > > > > xbean-bundleutils 4.21 4.22
> > > > > xbean-finder-shaded 4.21 4.22
> > > > > xbean-naming 4.21 4.22
> > > > > xbean-reflect 4.21 4.22
> > > > >
> > > > > ###############
> > > > >
> > > > > Note:
> > > > >
> > > > > (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> > > > > jackson-dataformat-yaml (which is used in OpenAPI).
> > > > > According to the Jackson people, they are not affected:
> > > > > https://github.com/FasterXML/jackson-dataformats-text/issues/361
> > > > >
> > > > > ###############
> > > > >
> > > > >
> > > > > Please VOTE
> > > > >
> > > > > [+1] go ship it
> > > > > [+0] meh, don't care
> > > > > [-1] stop, there is a ${showstopper}
> > > > >
> > > > > The VOTE is open for 72h or as long as needed.
> > > > >
> > > > > Gruß
> > > > > Richard
> > > > >
> > > > >
> > > >
> > >
> >
>
>
> --
> Atentamente:
> César Hernández.
>
Re: [VOTE] TomEE 8.0.14
Posted by Cesar Hernandez <ce...@gmail.com>.
+1 (binding).
Thank you!
El mar, 17 ene 2023 a las 16:36, Jean-Louis Monteiro (<
jlmonteiro@tomitribe.com>) escribió:
> +1 (binding)
> --
> Jean-Louis Monteiro
> http://twitter.com/jlouismonteiro
> http://www.tomitribe.com
>
>
> On Tue, Jan 17, 2023 at 4:31 PM Thomas Andraschko <
> andraschko.thomas@gmail.com> wrote:
>
> > +1 (non-binding)
> > our applications are working fine
> >
> > Am Di., 17. Jan. 2023 um 14:49 Uhr schrieb Daniel Dias Dos Santos <
> > daniel.dias.analistati@gmail.com>:
> >
> > > Hello,
> > >
> > > +1
> > >
> > > Thanks
> > >
> > > On Tue, Jan 17, 2023, 10:40 Richard Zowalla <rz...@apache.org> wrote:
> > >
> > > > Hi all,
> > > >
> > > > this is a vote for a release of Apache TomEE 8.0.14.
> > > >
> > > > It is a maintenance release with some bug fixes and dependencies
> > > > upgrades.
> > > >
> > > > ###############
> > > >
> > > > Maven Repo:
> > > >
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > > >
> > > > <repositories>
> > > > <repository>
> > > > <id>tomee-8.0.14-release-test</id>
> > > > <name>Testing TomEE 8.0.14 release candidate</name>
> > > > <url>
> > > >
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > > > </url>
> > > > </repository>
> > > > </repositories>
> > > >
> > > > ###############
> > > >
> > > > Binaries & Source:
> > > >
> > > >
> > https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
> > > >
> > > > ###############
> > > >
> > > > Tag:
> > > >
> > > > https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
> > > >
> > > >
> > > > ###############
> > > >
> > > > Release notes:
> > > >
> > > > https://issues.apache.org/jira/projects/TOMEE/versions/12352390
> > > >
> > > > ###############
> > > >
> > > > Here is an adoc generated version of the changelog as well:
> > > >
> > > > == Dependency upgrade
> > > >
> > > > [.compact]
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> > > > XBean 4.22
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> > > > CXF 3.4.10
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> > > > CXF 3.4.9
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > > > CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > > > HSQLDB 2.7.1
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> > > > Hibernate 5.6.14
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> > > > Jackson 2.14.0
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> > > > Jackson 2.14.1
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> > > > SnakeYAML - CVE-2022-1471
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> > > > Tomcat 9.0.69
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> > > > Tomcat 9.0.70
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> > > > Tomcat 9.0.71
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> > > > Velocity 2.3
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> > > > Woodstox 6.4.0 (CVE-2022-40152)
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > > > bcel component
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> > > > commons-compress
> > > > <
> > >
> >
> https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress
> > > >
> > > > 1.22
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> > > > jackson 2.14.0-rc2
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > > > woodstox-core
> > > > <
> > >
> >
> https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core
> > > >
> > > > mitigate CVE-2022-40153
> > > >
> > > > == Bug
> > > >
> > > > [.compact]
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> > > > Remote EJB2 BMP Memory Leak
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> > > > Performance Regression in bean resolution in EAR files
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> > > > Typo with EL22Adaptor implementation in openwebbeans.properties
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> > > > TomEE logs SEVERE: Expected ContextBinding to have the method
> > > > getThreadName()
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> > > > TomEE version no longer appearing at default manager page
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> > > > Unable to see TomEE version in Tomcat home page with Java 17
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> > > > Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> > > > mechanism
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> > > > tomee-embedded-maven-plugin
> > > > <
> > >
> >
> https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin
> > > >
> > > > fails with NPE
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > > > CVE-2022-45143
> > > > <
> > >
> >
> https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > > >
> > > > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > > > tomcat-websocket.jar
> > > >
> > > > == Improvement
> > > >
> > > > [.compact]
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> > > > Remove timing of timing just for logging
> > > >
> > > > == Task
> > > >
> > > > [.compact]
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> > > > Apache Parent 29
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> > > > JUnit 5.9.2
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> > > > Patch Plugin 0.10
> > > >
> > > > == Documentation
> > > >
> > > > [.compact]
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> > > > Documentation Website: XA DataSource Configuration: Bug in MySQL
> Sample
> > > > Code
> > > >
> > > > == Fixed Common Vulnerabilities and Exposures (CVEs)
> > > >
> > > > [.compact]
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > > > HSQLDB 2.7.1
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > > > Update Apache CXF versions to mitigate CVE-2022-46364 and
> > CVE-2022-46363
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > > > Update woodstox-core to mitigate CVE-2022-40153
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > > > Upgrade bcel component in TomEE
> > > > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > > > CVE-2022-45143
> > > > <
> > >
> >
> https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > > >
> > > > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > > > tomcat-websocket.jar
> > > >
> > > >
> > > >
> > > >
> > > > ###############
> > > >
> > > > Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> > > > release tools:
> > > >
> > > > artifactId from to
> > > > ------------------------------- ------------ --------
> > > > jackson-annotations 2.14.0-rc1 2.14.1
> > > > jackson-core 2.14.0-rc1 2.14.1
> > > > jackson-databind 2.14.0-rc1 2.14.1
> > > > jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> > > > woodstox-core 6.2.4 6.4.0
> > > > cxf-rt-bindings-soap 3.4.8 3.4.10
> > > > cxf-rt-bindings-xml 3.4.8 3.4.10
> > > > cxf-rt-frontend-jaxws 3.4.8 3.4.10
> > > > cxf-rt-frontend-simple 3.4.8 3.4.10
> > > > cxf-rt-management 3.4.8 3.4.10
> > > > cxf-rt-rs-extension-providers 3.4.8 3.4.10
> > > > cxf-rt-rs-extension-search 3.4.8 3.4.10
> > > > cxf-rt-rs-json-basic 3.4.8 3.4.10
> > > > cxf-rt-rs-mp-client 3.4.8 3.4.10
> > > > cxf-rt-rs-security-cors 3.4.8 3.4.10
> > > > cxf-rt-rs-security-jose 3.4.8 3.4.10
> > > > cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> > > > cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> > > > cxf-rt-rs-service-description 3.4.8 3.4.10
> > > > cxf-rt-rs-sse 3.4.8 3.4.10
> > > > cxf-rt-security 3.4.8 3.4.10
> > > > cxf-rt-security-saml 3.4.8 3.4.10
> > > > cxf-rt-ws-addr 3.4.8 3.4.10
> > > > cxf-rt-ws-policy 3.4.8 3.4.10
> > > > cxf-rt-ws-security 3.4.8 3.4.10
> > > > cxf-rt-wsdl 3.4.8 3.4.10
> > > > cxf-shade 8.0.13 8.0.14
> > > > taglibs-shade 8.0.13 8.0.14
> > > > tomee-bootstrap 8.0.13 8.0.14
> > > > xbean-asm9-shaded 4.21 4.22
> > > > xbean-bundleutils 4.21 4.22
> > > > xbean-finder-shaded 4.21 4.22
> > > > xbean-naming 4.21 4.22
> > > > xbean-reflect 4.21 4.22
> > > >
> > > > ###############
> > > >
> > > > Note:
> > > >
> > > > (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> > > > jackson-dataformat-yaml (which is used in OpenAPI).
> > > > According to the Jackson people, they are not affected:
> > > > https://github.com/FasterXML/jackson-dataformats-text/issues/361
> > > >
> > > > ###############
> > > >
> > > >
> > > > Please VOTE
> > > >
> > > > [+1] go ship it
> > > > [+0] meh, don't care
> > > > [-1] stop, there is a ${showstopper}
> > > >
> > > > The VOTE is open for 72h or as long as needed.
> > > >
> > > > Gruß
> > > > Richard
> > > >
> > > >
> > >
> >
>
--
Atentamente:
César Hernández.
Re: [VOTE] TomEE 8.0.14
Posted by Jean-Louis Monteiro <jl...@tomitribe.com>.
+1 (binding)
--
Jean-Louis Monteiro
http://twitter.com/jlouismonteiro
http://www.tomitribe.com
On Tue, Jan 17, 2023 at 4:31 PM Thomas Andraschko <
andraschko.thomas@gmail.com> wrote:
> +1 (non-binding)
> our applications are working fine
>
> Am Di., 17. Jan. 2023 um 14:49 Uhr schrieb Daniel Dias Dos Santos <
> daniel.dias.analistati@gmail.com>:
>
> > Hello,
> >
> > +1
> >
> > Thanks
> >
> > On Tue, Jan 17, 2023, 10:40 Richard Zowalla <rz...@apache.org> wrote:
> >
> > > Hi all,
> > >
> > > this is a vote for a release of Apache TomEE 8.0.14.
> > >
> > > It is a maintenance release with some bug fixes and dependencies
> > > upgrades.
> > >
> > > ###############
> > >
> > > Maven Repo:
> > >
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > >
> > > <repositories>
> > > <repository>
> > > <id>tomee-8.0.14-release-test</id>
> > > <name>Testing TomEE 8.0.14 release candidate</name>
> > > <url>
> > >
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > > </url>
> > > </repository>
> > > </repositories>
> > >
> > > ###############
> > >
> > > Binaries & Source:
> > >
> > >
> https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
> > >
> > > ###############
> > >
> > > Tag:
> > >
> > > https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
> > >
> > >
> > > ###############
> > >
> > > Release notes:
> > >
> > > https://issues.apache.org/jira/projects/TOMEE/versions/12352390
> > >
> > > ###############
> > >
> > > Here is an adoc generated version of the changelog as well:
> > >
> > > == Dependency upgrade
> > >
> > > [.compact]
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> > > XBean 4.22
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> > > CXF 3.4.10
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> > > CXF 3.4.9
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > > CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > > HSQLDB 2.7.1
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> > > Hibernate 5.6.14
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> > > Jackson 2.14.0
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> > > Jackson 2.14.1
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> > > SnakeYAML - CVE-2022-1471
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> > > Tomcat 9.0.69
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> > > Tomcat 9.0.70
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> > > Tomcat 9.0.71
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> > > Velocity 2.3
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> > > Woodstox 6.4.0 (CVE-2022-40152)
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > > bcel component
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> > > commons-compress
> > > <
> >
> https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress
> > >
> > > 1.22
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> > > jackson 2.14.0-rc2
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > > woodstox-core
> > > <
> >
> https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core
> > >
> > > mitigate CVE-2022-40153
> > >
> > > == Bug
> > >
> > > [.compact]
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> > > Remote EJB2 BMP Memory Leak
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> > > Performance Regression in bean resolution in EAR files
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> > > Typo with EL22Adaptor implementation in openwebbeans.properties
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> > > TomEE logs SEVERE: Expected ContextBinding to have the method
> > > getThreadName()
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> > > TomEE version no longer appearing at default manager page
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> > > Unable to see TomEE version in Tomcat home page with Java 17
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> > > Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> > > mechanism
> > > - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> > > tomee-embedded-maven-plugin
> > > <
> >
> https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin
> > >
> > > fails with NPE
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > > CVE-2022-45143
> > > <
> >
> https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > >
> > > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > > tomcat-websocket.jar
> > >
> > > == Improvement
> > >
> > > [.compact]
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> > > Remove timing of timing just for logging
> > >
> > > == Task
> > >
> > > [.compact]
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> > > Apache Parent 29
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> > > JUnit 5.9.2
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> > > Patch Plugin 0.10
> > >
> > > == Documentation
> > >
> > > [.compact]
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> > > Documentation Website: XA DataSource Configuration: Bug in MySQL Sample
> > > Code
> > >
> > > == Fixed Common Vulnerabilities and Exposures (CVEs)
> > >
> > > [.compact]
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > > HSQLDB 2.7.1
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > > Update Apache CXF versions to mitigate CVE-2022-46364 and
> CVE-2022-46363
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > > Update woodstox-core to mitigate CVE-2022-40153
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > > Upgrade bcel component in TomEE
> > > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > > CVE-2022-45143
> > > <
> >
> https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> > >
> > > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > > tomcat-websocket.jar
> > >
> > >
> > >
> > >
> > > ###############
> > >
> > > Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> > > release tools:
> > >
> > > artifactId from to
> > > ------------------------------- ------------ --------
> > > jackson-annotations 2.14.0-rc1 2.14.1
> > > jackson-core 2.14.0-rc1 2.14.1
> > > jackson-databind 2.14.0-rc1 2.14.1
> > > jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> > > woodstox-core 6.2.4 6.4.0
> > > cxf-rt-bindings-soap 3.4.8 3.4.10
> > > cxf-rt-bindings-xml 3.4.8 3.4.10
> > > cxf-rt-frontend-jaxws 3.4.8 3.4.10
> > > cxf-rt-frontend-simple 3.4.8 3.4.10
> > > cxf-rt-management 3.4.8 3.4.10
> > > cxf-rt-rs-extension-providers 3.4.8 3.4.10
> > > cxf-rt-rs-extension-search 3.4.8 3.4.10
> > > cxf-rt-rs-json-basic 3.4.8 3.4.10
> > > cxf-rt-rs-mp-client 3.4.8 3.4.10
> > > cxf-rt-rs-security-cors 3.4.8 3.4.10
> > > cxf-rt-rs-security-jose 3.4.8 3.4.10
> > > cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> > > cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> > > cxf-rt-rs-service-description 3.4.8 3.4.10
> > > cxf-rt-rs-sse 3.4.8 3.4.10
> > > cxf-rt-security 3.4.8 3.4.10
> > > cxf-rt-security-saml 3.4.8 3.4.10
> > > cxf-rt-ws-addr 3.4.8 3.4.10
> > > cxf-rt-ws-policy 3.4.8 3.4.10
> > > cxf-rt-ws-security 3.4.8 3.4.10
> > > cxf-rt-wsdl 3.4.8 3.4.10
> > > cxf-shade 8.0.13 8.0.14
> > > taglibs-shade 8.0.13 8.0.14
> > > tomee-bootstrap 8.0.13 8.0.14
> > > xbean-asm9-shaded 4.21 4.22
> > > xbean-bundleutils 4.21 4.22
> > > xbean-finder-shaded 4.21 4.22
> > > xbean-naming 4.21 4.22
> > > xbean-reflect 4.21 4.22
> > >
> > > ###############
> > >
> > > Note:
> > >
> > > (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> > > jackson-dataformat-yaml (which is used in OpenAPI).
> > > According to the Jackson people, they are not affected:
> > > https://github.com/FasterXML/jackson-dataformats-text/issues/361
> > >
> > > ###############
> > >
> > >
> > > Please VOTE
> > >
> > > [+1] go ship it
> > > [+0] meh, don't care
> > > [-1] stop, there is a ${showstopper}
> > >
> > > The VOTE is open for 72h or as long as needed.
> > >
> > > Gruß
> > > Richard
> > >
> > >
> >
>
Re: [VOTE] TomEE 8.0.14
Posted by Thomas Andraschko <an...@gmail.com>.
+1 (non-binding)
our applications are working fine
Am Di., 17. Jan. 2023 um 14:49 Uhr schrieb Daniel Dias Dos Santos <
daniel.dias.analistati@gmail.com>:
> Hello,
>
> +1
>
> Thanks
>
> On Tue, Jan 17, 2023, 10:40 Richard Zowalla <rz...@apache.org> wrote:
>
> > Hi all,
> >
> > this is a vote for a release of Apache TomEE 8.0.14.
> >
> > It is a maintenance release with some bug fixes and dependencies
> > upgrades.
> >
> > ###############
> >
> > Maven Repo:
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> >
> > <repositories>
> > <repository>
> > <id>tomee-8.0.14-release-test</id>
> > <name>Testing TomEE 8.0.14 release candidate</name>
> > <url>
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > </url>
> > </repository>
> > </repositories>
> >
> > ###############
> >
> > Binaries & Source:
> >
> > https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
> >
> > ###############
> >
> > Tag:
> >
> > https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
> >
> >
> > ###############
> >
> > Release notes:
> >
> > https://issues.apache.org/jira/projects/TOMEE/versions/12352390
> >
> > ###############
> >
> > Here is an adoc generated version of the changelog as well:
> >
> > == Dependency upgrade
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> > XBean 4.22
> > - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> > CXF 3.4.10
> > - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> > CXF 3.4.9
> > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > HSQLDB 2.7.1
> > - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> > Hibernate 5.6.14
> > - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> > Jackson 2.14.0
> > - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> > Jackson 2.14.1
> > - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> > SnakeYAML - CVE-2022-1471
> > - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> > Tomcat 9.0.69
> > - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> > Tomcat 9.0.70
> > - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> > Tomcat 9.0.71
> > - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> > Velocity 2.3
> > - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> > Woodstox 6.4.0 (CVE-2022-40152)
> > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > bcel component
> > - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> > commons-compress
> > <
> https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress
> >
> > 1.22
> > - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> > jackson 2.14.0-rc2
> > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > woodstox-core
> > <
> https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core
> >
> > mitigate CVE-2022-40153
> >
> > == Bug
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> > Remote EJB2 BMP Memory Leak
> > - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> > Performance Regression in bean resolution in EAR files
> > - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> > Typo with EL22Adaptor implementation in openwebbeans.properties
> > - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> > TomEE logs SEVERE: Expected ContextBinding to have the method
> > getThreadName()
> > - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> > TomEE version no longer appearing at default manager page
> > - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> > Unable to see TomEE version in Tomcat home page with Java 17
> > - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> > Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> > mechanism
> > - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> > tomee-embedded-maven-plugin
> > <
> https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin
> >
> > fails with NPE
> > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > CVE-2022-45143
> > <
> https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> >
> > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > tomcat-websocket.jar
> >
> > == Improvement
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> > Remove timing of timing just for logging
> >
> > == Task
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> > Apache Parent 29
> > - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> > JUnit 5.9.2
> > - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> > Patch Plugin 0.10
> >
> > == Documentation
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> > Documentation Website: XA DataSource Configuration: Bug in MySQL Sample
> > Code
> >
> > == Fixed Common Vulnerabilities and Exposures (CVEs)
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > HSQLDB 2.7.1
> > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-46363
> > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > Update woodstox-core to mitigate CVE-2022-40153
> > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > Upgrade bcel component in TomEE
> > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > CVE-2022-45143
> > <
> https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143
> >
> > Apache Tomcat - JsonErrorReportValve injection on TomEE's
> > tomcat-websocket.jar
> >
> >
> >
> >
> > ###############
> >
> > Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> > release tools:
> >
> > artifactId from to
> > ------------------------------- ------------ --------
> > jackson-annotations 2.14.0-rc1 2.14.1
> > jackson-core 2.14.0-rc1 2.14.1
> > jackson-databind 2.14.0-rc1 2.14.1
> > jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> > woodstox-core 6.2.4 6.4.0
> > cxf-rt-bindings-soap 3.4.8 3.4.10
> > cxf-rt-bindings-xml 3.4.8 3.4.10
> > cxf-rt-frontend-jaxws 3.4.8 3.4.10
> > cxf-rt-frontend-simple 3.4.8 3.4.10
> > cxf-rt-management 3.4.8 3.4.10
> > cxf-rt-rs-extension-providers 3.4.8 3.4.10
> > cxf-rt-rs-extension-search 3.4.8 3.4.10
> > cxf-rt-rs-json-basic 3.4.8 3.4.10
> > cxf-rt-rs-mp-client 3.4.8 3.4.10
> > cxf-rt-rs-security-cors 3.4.8 3.4.10
> > cxf-rt-rs-security-jose 3.4.8 3.4.10
> > cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> > cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> > cxf-rt-rs-service-description 3.4.8 3.4.10
> > cxf-rt-rs-sse 3.4.8 3.4.10
> > cxf-rt-security 3.4.8 3.4.10
> > cxf-rt-security-saml 3.4.8 3.4.10
> > cxf-rt-ws-addr 3.4.8 3.4.10
> > cxf-rt-ws-policy 3.4.8 3.4.10
> > cxf-rt-ws-security 3.4.8 3.4.10
> > cxf-rt-wsdl 3.4.8 3.4.10
> > cxf-shade 8.0.13 8.0.14
> > taglibs-shade 8.0.13 8.0.14
> > tomee-bootstrap 8.0.13 8.0.14
> > xbean-asm9-shaded 4.21 4.22
> > xbean-bundleutils 4.21 4.22
> > xbean-finder-shaded 4.21 4.22
> > xbean-naming 4.21 4.22
> > xbean-reflect 4.21 4.22
> >
> > ###############
> >
> > Note:
> >
> > (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> > jackson-dataformat-yaml (which is used in OpenAPI).
> > According to the Jackson people, they are not affected:
> > https://github.com/FasterXML/jackson-dataformats-text/issues/361
> >
> > ###############
> >
> >
> > Please VOTE
> >
> > [+1] go ship it
> > [+0] meh, don't care
> > [-1] stop, there is a ${showstopper}
> >
> > The VOTE is open for 72h or as long as needed.
> >
> > Gruß
> > Richard
> >
> >
>
Re: [VOTE] TomEE 8.0.14
Posted by Daniel Dias Dos Santos <da...@gmail.com>.
Hello,
+1
Thanks
On Tue, Jan 17, 2023, 10:40 Richard Zowalla <rz...@apache.org> wrote:
> Hi all,
>
> this is a vote for a release of Apache TomEE 8.0.14.
>
> It is a maintenance release with some bug fixes and dependencies
> upgrades.
>
> ###############
>
> Maven Repo:
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
>
> <repositories>
> <repository>
> <id>tomee-8.0.14-release-test</id>
> <name>Testing TomEE 8.0.14 release candidate</name>
> <url>
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
> </url>
> </repository>
> </repositories>
>
> ###############
>
> Binaries & Source:
>
> https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
>
> ###############
>
> Tag:
>
> https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
>
>
> ###############
>
> Release notes:
>
> https://issues.apache.org/jira/projects/TOMEE/versions/12352390
>
> ###############
>
> Here is an adoc generated version of the changelog as well:
>
> == Dependency upgrade
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> XBean 4.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> CXF 3.4.10
> - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> CXF 3.4.9
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> Hibernate 5.6.14
> - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> Jackson 2.14.0
> - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> Jackson 2.14.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> SnakeYAML - CVE-2022-1471
> - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> Tomcat 9.0.69
> - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> Tomcat 9.0.70
> - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> Tomcat 9.0.71
> - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> Velocity 2.3
> - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> Woodstox 6.4.0 (CVE-2022-40152)
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> bcel component
> - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> commons-compress
> <https://issues.apache.org/jira/browse/TOMEE-4130%5BTOMEE-4130%5Dcommons-compress>
> 1.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> jackson 2.14.0-rc2
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> woodstox-core
> <https://issues.apache.org/jira/browse/TOMEE-4103%5BTOMEE-4103%5Dwoodstox-core>
> mitigate CVE-2022-40153
>
> == Bug
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> Remote EJB2 BMP Memory Leak
> - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> Performance Regression in bean resolution in EAR files
> - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> Typo with EL22Adaptor implementation in openwebbeans.properties
> - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> TomEE logs SEVERE: Expected ContextBinding to have the method
> getThreadName()
> - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> TomEE version no longer appearing at default manager page
> - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> Unable to see TomEE version in Tomcat home page with Java 17
> - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> mechanism
> - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> tomee-embedded-maven-plugin
> <https://issues.apache.org/jira/browse/TOMEE-3779%5BTOMEE-3779%5Dtomee-embedded-maven-plugin>
> fails with NPE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143
> <https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143>
> Apache Tomcat - JsonErrorReportValve injection on TomEE's
> tomcat-websocket.jar
>
> == Improvement
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> Remove timing of timing just for logging
>
> == Task
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> Apache Parent 29
> - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> JUnit 5.9.2
> - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> Patch Plugin 0.10
>
> == Documentation
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> Documentation Website: XA DataSource Configuration: Bug in MySQL Sample
> Code
>
> == Fixed Common Vulnerabilities and Exposures (CVEs)
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> Update woodstox-core to mitigate CVE-2022-40153
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> Upgrade bcel component in TomEE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143
> <https://issues.apache.org/jira/browse/TOMEE-4176%5BTOMEE-4176%5DCVE-2022-45143>
> Apache Tomcat - JsonErrorReportValve injection on TomEE's
> tomcat-websocket.jar
>
>
>
>
> ###############
>
> Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> release tools:
>
> artifactId from to
> ------------------------------- ------------ --------
> jackson-annotations 2.14.0-rc1 2.14.1
> jackson-core 2.14.0-rc1 2.14.1
> jackson-databind 2.14.0-rc1 2.14.1
> jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> woodstox-core 6.2.4 6.4.0
> cxf-rt-bindings-soap 3.4.8 3.4.10
> cxf-rt-bindings-xml 3.4.8 3.4.10
> cxf-rt-frontend-jaxws 3.4.8 3.4.10
> cxf-rt-frontend-simple 3.4.8 3.4.10
> cxf-rt-management 3.4.8 3.4.10
> cxf-rt-rs-extension-providers 3.4.8 3.4.10
> cxf-rt-rs-extension-search 3.4.8 3.4.10
> cxf-rt-rs-json-basic 3.4.8 3.4.10
> cxf-rt-rs-mp-client 3.4.8 3.4.10
> cxf-rt-rs-security-cors 3.4.8 3.4.10
> cxf-rt-rs-security-jose 3.4.8 3.4.10
> cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> cxf-rt-rs-service-description 3.4.8 3.4.10
> cxf-rt-rs-sse 3.4.8 3.4.10
> cxf-rt-security 3.4.8 3.4.10
> cxf-rt-security-saml 3.4.8 3.4.10
> cxf-rt-ws-addr 3.4.8 3.4.10
> cxf-rt-ws-policy 3.4.8 3.4.10
> cxf-rt-ws-security 3.4.8 3.4.10
> cxf-rt-wsdl 3.4.8 3.4.10
> cxf-shade 8.0.13 8.0.14
> taglibs-shade 8.0.13 8.0.14
> tomee-bootstrap 8.0.13 8.0.14
> xbean-asm9-shaded 4.21 4.22
> xbean-bundleutils 4.21 4.22
> xbean-finder-shaded 4.21 4.22
> xbean-naming 4.21 4.22
> xbean-reflect 4.21 4.22
>
> ###############
>
> Note:
>
> (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> jackson-dataformat-yaml (which is used in OpenAPI).
> According to the Jackson people, they are not affected:
> https://github.com/FasterXML/jackson-dataformats-text/issues/361
>
> ###############
>
>
> Please VOTE
>
> [+1] go ship it
> [+0] meh, don't care
> [-1] stop, there is a ${showstopper}
>
> The VOTE is open for 72h or as long as needed.
>
> Gruß
> Richard
>
>
Re: [VOTE] TomEE 8.0.14
Posted by Alex The Rocker <al...@gmail.com>.
Here's my +1 (non-binding)
Alex
Le jeu. 19 janv. 2023 à 15:54, Richard Zowalla <rz...@apache.org> a écrit :
>
> Here is my own +1 (binding)
>
> Am Dienstag, dem 17.01.2023 um 14:40 +0100 schrieb Richard Zowalla:
> > Hi all,
> >
> > this is a vote for a release of Apache TomEE 8.0.14.
> >
> > It is a maintenance release with some bug fixes and dependencies
> > upgrades.
> >
> > ###############
> >
> > Maven Repo:
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> >
> > <repositories>
> > <repository>
> > <id>tomee-8.0.14-release-test</id>
> > <name>Testing TomEE 8.0.14 release candidate</name>
> > <url>
> > https://repository.apache.org/content/repositories/orgapachetomee-1213/
> > </url>
> > </repository>
> > </repositories>
> >
> > ###############
> >
> > Binaries & Source:
> >
> > https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
> >
> > ###############
> >
> > Tag:
> >
> > https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
> >
> >
> > ###############
> >
> > Release notes:
> >
> > https://issues.apache.org/jira/projects/TOMEE/versions/12352390
> >
> > ###############
> >
> > Here is an adoc generated version of the changelog as well:
> >
> > == Dependency upgrade
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> > XBean 4.22
> > - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> > CXF 3.4.10
> > - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> > CXF 3.4.9
> > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > HSQLDB 2.7.1
> > - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> > Hibernate 5.6.14
> > - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> > Jackson 2.14.0
> > - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> > Jackson 2.14.1
> > - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> > SnakeYAML - CVE-2022-1471
> > - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> > Tomcat 9.0.69
> > - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> > Tomcat 9.0.70
> > - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> > Tomcat 9.0.71
> > - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> > Velocity 2.3
> > - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> > Woodstox 6.4.0 (CVE-2022-40152)
> > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > bcel component
> > - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> > commons-compress 1.22
> > - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> > jackson 2.14.0-rc2
> > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > woodstox-core mitigate CVE-2022-40153
> >
> > == Bug
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> > Remote EJB2 BMP Memory Leak
> > - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> > Performance Regression in bean resolution in EAR files
> > - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> > Typo with EL22Adaptor implementation in openwebbeans.properties
> > - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> > TomEE logs SEVERE: Expected ContextBinding to have the method
> > getThreadName()
> > - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> > TomEE version no longer appearing at default manager page
> > - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> > Unable to see TomEE version in Tomcat home page with Java 17
> > - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> > Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> > mechanism
> > - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> > tomee-embedded-maven-plugin fails with NPE
> > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on
> > TomEE's tomcat-websocket.jar
> >
> > == Improvement
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> > Remove timing of timing just for logging
> >
> > == Task
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> > Apache Parent 29
> > - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> > JUnit 5.9.2
> > - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> > Patch Plugin 0.10
> >
> > == Documentation
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> > Documentation Website: XA DataSource Configuration: Bug in MySQL
> > Sample Code
> >
> > == Fixed Common Vulnerabilities and Exposures (CVEs)
> >
> > [.compact]
> > - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> > HSQLDB 2.7.1
> > - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> > Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-
> > 46363
> > - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> > Update woodstox-core to mitigate CVE-2022-40153
> > - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> > Upgrade bcel component in TomEE
> > - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> > CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on
> > TomEE's tomcat-websocket.jar
> >
> >
> >
> >
> > ###############
> >
> > Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> > release tools:
> >
> > artifactId from to
> > ------------------------------- ------------ --------
> > jackson-annotations 2.14.0-rc1 2.14.1
> > jackson-core 2.14.0-rc1 2.14.1
> > jackson-databind 2.14.0-rc1 2.14.1
> > jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> > woodstox-core 6.2.4 6.4.0
> > cxf-rt-bindings-soap 3.4.8 3.4.10
> > cxf-rt-bindings-xml 3.4.8 3.4.10
> > cxf-rt-frontend-jaxws 3.4.8 3.4.10
> > cxf-rt-frontend-simple 3.4.8 3.4.10
> > cxf-rt-management 3.4.8 3.4.10
> > cxf-rt-rs-extension-providers 3.4.8 3.4.10
> > cxf-rt-rs-extension-search 3.4.8 3.4.10
> > cxf-rt-rs-json-basic 3.4.8 3.4.10
> > cxf-rt-rs-mp-client 3.4.8 3.4.10
> > cxf-rt-rs-security-cors 3.4.8 3.4.10
> > cxf-rt-rs-security-jose 3.4.8 3.4.10
> > cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> > cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> > cxf-rt-rs-service-description 3.4.8 3.4.10
> > cxf-rt-rs-sse 3.4.8 3.4.10
> > cxf-rt-security 3.4.8 3.4.10
> > cxf-rt-security-saml 3.4.8 3.4.10
> > cxf-rt-ws-addr 3.4.8 3.4.10
> > cxf-rt-ws-policy 3.4.8 3.4.10
> > cxf-rt-ws-security 3.4.8 3.4.10
> > cxf-rt-wsdl 3.4.8 3.4.10
> > cxf-shade 8.0.13 8.0.14
> > taglibs-shade 8.0.13 8.0.14
> > tomee-bootstrap 8.0.13 8.0.14
> > xbean-asm9-shaded 4.21 4.22
> > xbean-bundleutils 4.21 4.22
> > xbean-finder-shaded 4.21 4.22
> > xbean-naming 4.21 4.22
> > xbean-reflect 4.21 4.22
> >
> > ###############
> >
> > Note:
> >
> > (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> > jackson-dataformat-yaml (which is used in OpenAPI).
> > According to the Jackson people, they are not affected:
> > https://github.com/FasterXML/jackson-dataformats-text/issues/361
> >
> > ###############
> >
> >
> > Please VOTE
> >
> > [+1] go ship it
> > [+0] meh, don't care
> > [-1] stop, there is a ${showstopper}
> >
> > The VOTE is open for 72h or as long as needed.
> >
> > Gruß
> > Richard
> >
Re: [VOTE] TomEE 8.0.14
Posted by Richard Zowalla <rz...@apache.org>.
Here is my own +1 (binding)
Am Dienstag, dem 17.01.2023 um 14:40 +0100 schrieb Richard Zowalla:
> Hi all,
>
> this is a vote for a release of Apache TomEE 8.0.14.
>
> It is a maintenance release with some bug fixes and dependencies
> upgrades.
>
> ###############
>
> Maven Repo:
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
>
> <repositories>
> <repository>
> <id>tomee-8.0.14-release-test</id>
> <name>Testing TomEE 8.0.14 release candidate</name>
> <url>
> https://repository.apache.org/content/repositories/orgapachetomee-1213/
> </url>
> </repository>
> </repositories>
>
> ###############
>
> Binaries & Source:
>
> https://dist.apache.org/repos/dist/dev/tomee/staging-1213/tomee-8.0.14/
>
> ###############
>
> Tag:
>
> https://github.com/apache/tomee/releases/tag/tomee-project-8.0.14
>
>
> ###############
>
> Release notes:
>
> https://issues.apache.org/jira/projects/TOMEE/versions/12352390
>
> ###############
>
> Here is an adoc generated version of the changelog as well:
>
> == Dependency upgrade
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4100[TOMEE-4100]
> XBean 4.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4126[TOMEE-4126]
> CXF 3.4.10
> - link:https://issues.apache.org/jira/browse/TOMEE-4118[TOMEE-4118]
> CXF 3.4.9
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> CXF versions mitigate CVE-2022-46364 and CVE-2022-46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4170[TOMEE-4170]
> Hibernate 5.6.14
> - link:https://issues.apache.org/jira/browse/TOMEE-4107[TOMEE-4107]
> Jackson 2.14.0
> - link:https://issues.apache.org/jira/browse/TOMEE-4129[TOMEE-4129]
> Jackson 2.14.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4169[TOMEE-4169]
> SnakeYAML - CVE-2022-1471
> - link:https://issues.apache.org/jira/browse/TOMEE-4116[TOMEE-4116]
> Tomcat 9.0.69
> - link:https://issues.apache.org/jira/browse/TOMEE-4121[TOMEE-4121]
> Tomcat 9.0.70
> - link:https://issues.apache.org/jira/browse/TOMEE-4173[TOMEE-4173]
> Tomcat 9.0.71
> - link:https://issues.apache.org/jira/browse/TOMEE-4109[TOMEE-4109]
> Velocity 2.3
> - link:https://issues.apache.org/jira/browse/TOMEE-4110[TOMEE-4110]
> Woodstox 6.4.0 (CVE-2022-40152)
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> bcel component
> - link:https://issues.apache.org/jira/browse/TOMEE-4130[TOMEE-4130]
> commons-compress 1.22
> - link:https://issues.apache.org/jira/browse/TOMEE-4094[TOMEE-4094]
> jackson 2.14.0-rc2
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> woodstox-core mitigate CVE-2022-40153
>
> == Bug
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4120[TOMEE-4120]
> Remote EJB2 BMP Memory Leak
> - link:https://issues.apache.org/jira/browse/TOMEE-4122[TOMEE-4122]
> Performance Regression in bean resolution in EAR files
> - link:https://issues.apache.org/jira/browse/TOMEE-4101[TOMEE-4101]
> Typo with EL22Adaptor implementation in openwebbeans.properties
> - link:https://issues.apache.org/jira/browse/TOMEE-4102[TOMEE-4102]
> TomEE logs SEVERE: Expected ContextBinding to have the method
> getThreadName()
> - link:https://issues.apache.org/jira/browse/TOMEE-4106[TOMEE-4106]
> TomEE version no longer appearing at default manager page
> - link:https://issues.apache.org/jira/browse/TOMEE-4014[TOMEE-4014]
> Unable to see TomEE version in Tomcat home page with Java 17
> - link:https://issues.apache.org/jira/browse/TOMEE-4108[TOMEE-4108]
> Backport TOMEE-4065: LoginToContinue interceptor fails on custom auth
> mechanism
> - link:https://issues.apache.org/jira/browse/TOMEE-3779[TOMEE-3779]
> tomee-embedded-maven-plugin fails with NPE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on
> TomEE's tomcat-websocket.jar
>
> == Improvement
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4124[TOMEE-4124]
> Remove timing of timing just for logging
>
> == Task
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4171[TOMEE-4171]
> Apache Parent 29
> - link:https://issues.apache.org/jira/browse/TOMEE-4172[TOMEE-4172]
> JUnit 5.9.2
> - link:https://issues.apache.org/jira/browse/TOMEE-4177[TOMEE-4177]
> Patch Plugin 0.10
>
> == Documentation
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4104[TOMEE-4104]
> Documentation Website: XA DataSource Configuration: Bug in MySQL
> Sample Code
>
> == Fixed Common Vulnerabilities and Exposures (CVEs)
>
> [.compact]
> - link:https://issues.apache.org/jira/browse/TOMEE-4086[TOMEE-4086]
> HSQLDB 2.7.1
> - link:https://issues.apache.org/jira/browse/TOMEE-4125[TOMEE-4125]
> Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-
> 46363
> - link:https://issues.apache.org/jira/browse/TOMEE-4103[TOMEE-4103]
> Update woodstox-core to mitigate CVE-2022-40153
> - link:https://issues.apache.org/jira/browse/TOMEE-4111[TOMEE-4111]
> Upgrade bcel component in TomEE
> - link:https://issues.apache.org/jira/browse/TOMEE-4176[TOMEE-4176]
> CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on
> TomEE's tomcat-websocket.jar
>
>
>
>
> ###############
>
> Here is the dependency diff from 8.0.13 to 8.0.14 created with our
> release tools:
>
> artifactId from to
> ------------------------------- ------------ --------
> jackson-annotations 2.14.0-rc1 2.14.1
> jackson-core 2.14.0-rc1 2.14.1
> jackson-databind 2.14.0-rc1 2.14.1
> jackson-dataformat-yaml 2.14.0-rc1 2.14.1
> woodstox-core 6.2.4 6.4.0
> cxf-rt-bindings-soap 3.4.8 3.4.10
> cxf-rt-bindings-xml 3.4.8 3.4.10
> cxf-rt-frontend-jaxws 3.4.8 3.4.10
> cxf-rt-frontend-simple 3.4.8 3.4.10
> cxf-rt-management 3.4.8 3.4.10
> cxf-rt-rs-extension-providers 3.4.8 3.4.10
> cxf-rt-rs-extension-search 3.4.8 3.4.10
> cxf-rt-rs-json-basic 3.4.8 3.4.10
> cxf-rt-rs-mp-client 3.4.8 3.4.10
> cxf-rt-rs-security-cors 3.4.8 3.4.10
> cxf-rt-rs-security-jose 3.4.8 3.4.10
> cxf-rt-rs-security-jose-jaxrs 3.4.8 3.4.10
> cxf-rt-rs-security-oauth2 3.4.8 3.4.10
> cxf-rt-rs-service-description 3.4.8 3.4.10
> cxf-rt-rs-sse 3.4.8 3.4.10
> cxf-rt-security 3.4.8 3.4.10
> cxf-rt-security-saml 3.4.8 3.4.10
> cxf-rt-ws-addr 3.4.8 3.4.10
> cxf-rt-ws-policy 3.4.8 3.4.10
> cxf-rt-ws-security 3.4.8 3.4.10
> cxf-rt-wsdl 3.4.8 3.4.10
> cxf-shade 8.0.13 8.0.14
> taglibs-shade 8.0.13 8.0.14
> tomee-bootstrap 8.0.13 8.0.14
> xbean-asm9-shaded 4.21 4.22
> xbean-bundleutils 4.21 4.22
> xbean-finder-shaded 4.21 4.22
> xbean-naming 4.21 4.22
> xbean-reflect 4.21 4.22
>
> ###############
>
> Note:
>
> (1) CVE-2022-1471 (snakeyaml): Snakeyaml is a transient dependency of
> jackson-dataformat-yaml (which is used in OpenAPI).
> According to the Jackson people, they are not affected:
> https://github.com/FasterXML/jackson-dataformats-text/issues/361
>
> ###############
>
>
> Please VOTE
>
> [+1] go ship it
> [+0] meh, don't care
> [-1] stop, there is a ${showstopper}
>
> The VOTE is open for 72h or as long as needed.
>
> Gruß
> Richard
>