You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "nrknithin (via GitHub)" <gi...@apache.org> on 2026/02/20 01:36:36 UTC
[PR] [incubator-kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
nrknithin opened a new pull request, #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454
Ticket
https://github.com/apache/incubator-kie-issues/issues/2204
## Summary
Upgrade Quarkus to 3.27.2 and Spring Boot to 3.5.10, update transitive dependencies, remove unused imports, and adapt to breaking API changes.
## Changes
### Quarkus Upgrade
Upgraded Quarkus from 3.20.3 to 3.27.2
Java compiler release updated from 11 to 17 (required by Quarkus 3.x)
### Spring Boot Upgrade
Upgraded spring-boot-maven-plugin from 2.7.1 to 3.5.10
### Dependency Version Bumps (Aligned with Quarkus 3.27.2 + Spring Boot 3.5.10 BOMs)
io.netty: 4.1.129.Final -> 4.1.130.Final
nimbus-jose-jwt: 9.37.4 -> 10.4.2
io.vertx: 4.5.22 -> 4.5.23
org.apache.mime4j: 0.8.11 -> 0.8.12
tomcat-embed-core: 10.1.48 -> 10.1.50 (aligned with Spring Boot 3.5.10 BOM)
lz4-java: relocated from org.lz4 to at.yawk.lz4, version 1.8.1 -> 1.10.1
### API Migration
Replaced getRunTimeDefaultValues() with getRunTimeValues() in DevConsoleProcessor.java
### Cleanup
Removed unused ConfigItem imports from devui config classes (DevConsoleRuntimeConfig.java, UserConfig.java)
Removed -AlegacyConfigRoot=true compiler argument (legacy config classes no longer supported since Quarkus 3.25)
### Affected Packages
packages/dev-deployment-quarkus-blank-app
packages/jbpm-quarkus-devui
packages/maven-base
packages/root-env
packages/sonataflow-quarkus-devui
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "tiagobento (via GitHub)" <gi...@apache.org>.
tiagobento merged PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [incubator-kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "yesamer (via GitHub)" <gi...@apache.org>.
yesamer commented on code in PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454#discussion_r2833112495
##########
packages/dev-deployment-quarkus-blank-app/pom.xml:
##########
@@ -60,13 +60,13 @@
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
<version.commons-io>2.16.1</version.commons-io>
<version.com.google.protobuf>3.25.5</version.com.google.protobuf>
- <version.io.netty>4.1.129.Final</version.io.netty>
+ <version.io.netty>4.1.130.Final</version.io.netty>
<!-- These versions are overrides for transitive dependencies, to fix security vulnerabilities.
They need to be checked with Quarkus and Spring Boot upgrades and eventually removed, if they are not needed anymore. -->
<version.angus.mail>2.0.5</version.angus.mail>
- <version.nimbus.jose.jwt>9.37.4</version.nimbus.jose.jwt>
- <version.io.vertx>4.5.22</version.io.vertx>
+ <version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
+ <version.io.vertx>4.5.23</version.io.vertx>
Review Comment:
@nrknithin As the comment explain, those dependencies are transitive dependencies declared just to fix CVEs. That means are not directly used in the code. I guess we can remove
```
<version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
<version.io.vertx>4.5.23</version.io.vertx>
```
declaration at all.
Can you please check if now the <version.angus.mail> transitively imports 2.0.5 or higher? In that case, you can remove <version.angus.mail>2.0.5</version.angus.mail> as well. If not, please keep it.
After removing them PLEASE CHECK if the transitively iimported version is the expected one!!!
Thanks!
##########
packages/serverless-workflow-vscode-extension/e2e-tests/resources/greeting-flow/pom.xml:
##########
@@ -28,11 +28,11 @@
<version>1.0</version>
<properties>
<compiler-plugin.version>3.13.0</compiler-plugin.version>
- <maven.compiler.release>11</maven.compiler.release>
+ <maven.compiler.release>17</maven.compiler.release>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<quarkus.platform.artifact-id>quarkus-bom</quarkus.platform.artifact-id>
- <version.quarkus>2.13.1.Final</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<skipITs>true</skipITs>
<surefire-plugin.version>3.0.0-M7</surefire-plugin.version>
Review Comment:
@nrknithin Can you please update this old surefire version (3.5.0)?
##########
packages/dev-deployment-quarkus-blank-app/pom.xml:
##########
@@ -60,13 +60,13 @@
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
<version.commons-io>2.16.1</version.commons-io>
Review Comment:
@nrknithin We updated that version to 2.20.0 in drools. https://github.com/apache/incubator-kie-drools/pull/6575/changes#diff-150bdf617c2dc80dc5a9d5f1313f44a73950a96ca7b166b79a35b15f4c84f193R58
Please check all dependencies for consistency with drools and runtimes repos.
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
Review Comment:
@nrknithin This should be 2.3.34 https://github.com/apache/incubator-kie-drools/pull/6575/changes#diff-150bdf617c2dc80dc5a9d5f1313f44a73950a96ca7b166b79a35b15f4c84f193R98
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
<version.org.assertj>3.27.7</version.org.assertj>
<version.org.junit.jupiter>5.12.2</version.org.junit.jupiter>
<version.org.mockito>4.11.0</version.org.mockito>
<version.org.kie.j2cl.tools.yaml.mapper>0.4</version.org.kie.j2cl.tools.yaml.mapper>
- <version.io.netty>4.1.129.Final</version.io.netty>
+ <version.io.netty>4.1.130.Final</version.io.netty>
<!-- These versions are overrides for transitive dependencies, to fix security vulnerabilities.
They need to be checked with Quarkus and Spring Boot upgrades and eventually removed, if they are not needed anymore. -->
- <version.tomcat.embed.core>10.1.48</version.tomcat.embed.core>
+ <version.tomcat.embed.core>10.1.50</version.tomcat.embed.core>
<version.apache.commons.lang3>3.18.0</version.apache.commons.lang3>
<version.angus.mail>2.0.5</version.angus.mail>
- <version.nimbus.jose.jwt>9.37.4</version.nimbus.jose.jwt>
- <version.io.vertx>4.5.22</version.io.vertx>
- <version.org.lz4.java>1.8.1</version.org.lz4.java>
+ <version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
+ <version.io.vertx>4.5.23</version.io.vertx>
+ <version.at.yawk.lz4.java>1.10.1</version.at.yawk.lz4.java>
Review Comment:
@nrknithin Same of https://github.com/apache/incubator-kie-tools/pull/3454/changes#r2833112495 .
All updated versions could be removed.
After removing them PLEASE CHECK if the transitively imported version is the expected one!!!
Thanks!
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
<version.org.assertj>3.27.7</version.org.assertj>
<version.org.junit.jupiter>5.12.2</version.org.junit.jupiter>
Review Comment:
@nrknithin This should be 5.13.4 https://github.com/apache/incubator-kie-drools/pull/6575/changes#diff-150bdf617c2dc80dc5a9d5f1313f44a73950a96ca7b166b79a35b15f4c84f193R124
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "nrknithin (via GitHub)" <gi...@apache.org>.
nrknithin commented on code in PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454#discussion_r2834450255
##########
packages/dev-deployment-quarkus-blank-app/pom.xml:
##########
@@ -60,13 +60,13 @@
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
<version.commons-io>2.16.1</version.commons-io>
<version.com.google.protobuf>3.25.5</version.com.google.protobuf>
- <version.io.netty>4.1.129.Final</version.io.netty>
+ <version.io.netty>4.1.130.Final</version.io.netty>
<!-- These versions are overrides for transitive dependencies, to fix security vulnerabilities.
They need to be checked with Quarkus and Spring Boot upgrades and eventually removed, if they are not needed anymore. -->
<version.angus.mail>2.0.5</version.angus.mail>
- <version.nimbus.jose.jwt>9.37.4</version.nimbus.jose.jwt>
- <version.io.vertx>4.5.22</version.io.vertx>
+ <version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
+ <version.io.vertx>4.5.23</version.io.vertx>
Review Comment:
Removed nimbus-jose-jwt and vertx-web overrides
Checked angus-mail — the Quarkus 3.27.2 BOM only provides 2.0.4, so kept the 2.0.5 override.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "nrknithin (via GitHub)" <gi...@apache.org>.
nrknithin commented on code in PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454#discussion_r2834448442
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
<version.org.assertj>3.27.7</version.org.assertj>
<version.org.junit.jupiter>5.12.2</version.org.junit.jupiter>
<version.org.mockito>4.11.0</version.org.mockito>
<version.org.kie.j2cl.tools.yaml.mapper>0.4</version.org.kie.j2cl.tools.yaml.mapper>
- <version.io.netty>4.1.129.Final</version.io.netty>
+ <version.io.netty>4.1.130.Final</version.io.netty>
<!-- These versions are overrides for transitive dependencies, to fix security vulnerabilities.
They need to be checked with Quarkus and Spring Boot upgrades and eventually removed, if they are not needed anymore. -->
- <version.tomcat.embed.core>10.1.48</version.tomcat.embed.core>
+ <version.tomcat.embed.core>10.1.50</version.tomcat.embed.core>
<version.apache.commons.lang3>3.18.0</version.apache.commons.lang3>
<version.angus.mail>2.0.5</version.angus.mail>
- <version.nimbus.jose.jwt>9.37.4</version.nimbus.jose.jwt>
- <version.io.vertx>4.5.22</version.io.vertx>
- <version.org.lz4.java>1.8.1</version.org.lz4.java>
+ <version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
+ <version.io.vertx>4.5.23</version.io.vertx>
+ <version.at.yawk.lz4.java>1.10.1</version.at.yawk.lz4.java>
Review Comment:
Removed nimbus-jose-jwt, vertx-web, and at.yawk.lz4:lz4-java overrides
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
<version.org.assertj>3.27.7</version.org.assertj>
<version.org.junit.jupiter>5.12.2</version.org.junit.jupiter>
Review Comment:
Updated to 5.13.4.
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
Review Comment:
Updated to 2.3.34.
##########
packages/dev-deployment-quarkus-blank-app/pom.xml:
##########
@@ -60,13 +60,13 @@
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
<version.commons-io>2.16.1</version.commons-io>
Review Comment:
Aligned all dependency versions with drools build-parent (apache/incubator-kie-drools#6575):
commons-io: 2.16.1 → 2.20.0
commons-compress: 1.27.1 → 1.28.0
io.netty: 4.1.130.Final → 4.1.131.Final
freemarker: 2.3.32 → 2.3.34
junit-jupiter: 5.12.2 → 5.13.4
mockito: 4.11.0 → 5.18.0
Verified via mvn dependency:tree.
##########
packages/serverless-workflow-vscode-extension/e2e-tests/resources/greeting-flow/pom.xml:
##########
@@ -28,11 +28,11 @@
<version>1.0</version>
<properties>
<compiler-plugin.version>3.13.0</compiler-plugin.version>
- <maven.compiler.release>11</maven.compiler.release>
+ <maven.compiler.release>17</maven.compiler.release>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<quarkus.platform.artifact-id>quarkus-bom</quarkus.platform.artifact-id>
- <version.quarkus>2.13.1.Final</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<skipITs>true</skipITs>
<surefire-plugin.version>3.0.0-M7</surefire-plugin.version>
Review Comment:
Updated surefire-plugin.version from 3.0.0-M7 to 3.5.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "nrknithin (via GitHub)" <gi...@apache.org>.
nrknithin commented on PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454#issuecomment-3936347737
- maven-base/pom.xml — All version bumps live here. Verify they match the drools build-parent.
- CVE override removals (dev-deployment-quarkus-blank-app, kie-sandbox-accelerator-quarkus) — Quarkus 3.27.2 BOM now ships the fixed versions (nimbus-jose-jwt, vertx-web, lz4-java), so these manual overrides are dead code.
- Mockito 4 → 5 (serverless-workflow-diagram-editor, stunner-editors, vscode-java-code-completion-extension-plugin) — mockito-inline merged into mockito-core in 5.x. Artifact swap only, no test code changes.
- Freemarker jar references (vscode-java-code-completion-extension-plugin) — build.properties and MANIFEST.MF updated to match the 2.3.32 → 2.3.34 filename change.
- Surefire 3.0.0-M7 → 3.5.0 (greeting-flow e2e test POM) — Old milestone had compatibility issues with JUnit 5.13.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "nrknithin (via GitHub)" <gi...@apache.org>.
nrknithin commented on code in PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454#discussion_r2834446885
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
<version.org.assertj>3.27.7</version.org.assertj>
<version.org.junit.jupiter>5.12.2</version.org.junit.jupiter>
<version.org.mockito>4.11.0</version.org.mockito>
<version.org.kie.j2cl.tools.yaml.mapper>0.4</version.org.kie.j2cl.tools.yaml.mapper>
- <version.io.netty>4.1.129.Final</version.io.netty>
+ <version.io.netty>4.1.130.Final</version.io.netty>
<!-- These versions are overrides for transitive dependencies, to fix security vulnerabilities.
They need to be checked with Quarkus and Spring Boot upgrades and eventually removed, if they are not needed anymore. -->
- <version.tomcat.embed.core>10.1.48</version.tomcat.embed.core>
+ <version.tomcat.embed.core>10.1.50</version.tomcat.embed.core>
<version.apache.commons.lang3>3.18.0</version.apache.commons.lang3>
<version.angus.mail>2.0.5</version.angus.mail>
- <version.nimbus.jose.jwt>9.37.4</version.nimbus.jose.jwt>
- <version.io.vertx>4.5.22</version.io.vertx>
- <version.org.lz4.java>1.8.1</version.org.lz4.java>
+ <version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
+ <version.io.vertx>4.5.23</version.io.vertx>
+ <version.at.yawk.lz4.java>1.10.1</version.at.yawk.lz4.java>
Review Comment:
- maven-base/pom.xml — All version bumps live here. Verify they match the drools build-parent.
- CVE override removals (dev-deployment-quarkus-blank-app, kie-sandbox-accelerator-quarkus) — Quarkus 3.27.2 BOM now ships the fixed versions (nimbus-jose-jwt, vertx-web, lz4-java), so these manual overrides are dead code.
- Mockito 4 → 5 (serverless-workflow-diagram-editor, stunner-editors, vscode-java-code-completion-extension-plugin) — mockito-inline merged into mockito-core in 5.x. Artifact swap only, no test code changes.
- Freemarker jar references (vscode-java-code-completion-extension-plugin) — build.properties and MANIFEST.MF updated to match the 2.3.32 → 2.3.34 filename change.
- Surefire 3.0.0-M7 → 3.5.0 (greeting-flow e2e test POM) — Old milestone had compatibility issues with JUnit 5.13.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [kie-issues#2204] Quarkus upgrade 3.27 and Spring Boot to 3.5.10 [incubator-kie-tools]
Posted by "nrknithin (via GitHub)" <gi...@apache.org>.
nrknithin commented on code in PR #3454:
URL: https://github.com/apache/incubator-kie-tools/pull/3454#discussion_r2834446885
##########
packages/maven-base/pom.xml:
##########
@@ -122,31 +122,31 @@
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<!-- Apache KIE -->
- <version.org.kie.kogito>999-20260206-local</version.org.kie.kogito>
+ <version.org.kie.kogito>999-20260220-local</version.org.kie.kogito>
<!-- Quarkus -->
- <version.quarkus>3.20.3</version.quarkus>
+ <version.quarkus>3.27.2</version.quarkus>
<!-- 3rd party dependencies -->
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.27.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
- <version.org.apache.mime4j>0.8.11</version.org.apache.mime4j>
+ <version.org.apache.mime4j>0.8.12</version.org.apache.mime4j>
<version.org.freemarker>2.3.32</version.org.freemarker>
<version.org.assertj>3.27.7</version.org.assertj>
<version.org.junit.jupiter>5.12.2</version.org.junit.jupiter>
<version.org.mockito>4.11.0</version.org.mockito>
<version.org.kie.j2cl.tools.yaml.mapper>0.4</version.org.kie.j2cl.tools.yaml.mapper>
- <version.io.netty>4.1.129.Final</version.io.netty>
+ <version.io.netty>4.1.130.Final</version.io.netty>
<!-- These versions are overrides for transitive dependencies, to fix security vulnerabilities.
They need to be checked with Quarkus and Spring Boot upgrades and eventually removed, if they are not needed anymore. -->
- <version.tomcat.embed.core>10.1.48</version.tomcat.embed.core>
+ <version.tomcat.embed.core>10.1.50</version.tomcat.embed.core>
<version.apache.commons.lang3>3.18.0</version.apache.commons.lang3>
<version.angus.mail>2.0.5</version.angus.mail>
- <version.nimbus.jose.jwt>9.37.4</version.nimbus.jose.jwt>
- <version.io.vertx>4.5.22</version.io.vertx>
- <version.org.lz4.java>1.8.1</version.org.lz4.java>
+ <version.nimbus.jose.jwt>10.4.2</version.nimbus.jose.jwt>
+ <version.io.vertx>4.5.23</version.io.vertx>
+ <version.at.yawk.lz4.java>1.10.1</version.at.yawk.lz4.java>
Review Comment:
- maven-base/pom.xml — All version bumps live here. Verify they match the drools build-parent.
- CVE override removals (dev-deployment-quarkus-blank-app, kie-sandbox-accelerator-quarkus) — Quarkus 3.27.2 BOM now ships the fixed versions (nimbus-jose-jwt, vertx-web, lz4-java), so these manual overrides are dead code.
- Mockito 4 → 5 (serverless-workflow-diagram-editor, stunner-editors, vscode-java-code-completion-extension-plugin) — mockito-inline merged into mockito-core in 5.x. Artifact swap only, no test code changes.
- Freemarker jar references (vscode-java-code-completion-extension-plugin) — build.properties and MANIFEST.MF updated to match the 2.3.32 → 2.3.34 filename change.
- Surefire 3.0.0-M7 → 3.5.0 (greeting-flow e2e test POM) — Old milestone had compatibility issues with JUnit 5.13.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org