You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "athirakm94 (via GitHub)" <gi...@apache.org> on 2026/07/16 01:03:28 UTC
[PR] NO-ISSUE: upgrade micrometer-core from 1.14.7 to 1.16.6 in OptaPlanner modules [incubator-kie-drools]
athirakm94 opened a new pull request, #6810:
URL: https://github.com/apache/incubator-kie-drools/pull/6810
**Summary**
quarkus-bom 3.27.4 pulls in micrometer-core 1.14.7 which has a known CVE. Added explicit dependencyManagement overrides for micrometer-core, micrometer-commons and micrometer-observation in optaplanner-build-parent to enforce version 1.16.6 across all OptaPlanner modules.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE: upgrade micrometer-core from 1.14.7 to 1.16.6 in OptaPlanner modules [incubator-kie-drools]
Posted by "yesamer (via GitHub)" <gi...@apache.org>.
yesamer commented on code in PR #6810:
URL: https://github.com/apache/incubator-kie-drools/pull/6810#discussion_r3593396457
##########
optaplanner-build/optaplanner-build-parent/pom.xml:
##########
@@ -135,6 +136,22 @@
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- CVE fix: override micrometer version from quarkus-bom (1.14.7) to 1.16.6 -->
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-core</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-commons</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.micrometer</groupId>
+ <artifactId>micrometer-observation</artifactId>
+ <version>${version.io.micrometer}</version>
+ </dependency>
Review Comment:
Can you please move those declarations under Normal Dependencies versions?
##########
optaplanner-build/optaplanner-build-parent/pom.xml:
##########
@@ -135,6 +136,22 @@
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- CVE fix: override micrometer version from quarkus-bom (1.14.7) to 1.16.6 -->
Review Comment:
@athirakm94 Please specify the quarkus version (3.27.4)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE: upgrade micrometer-core from 1.14.7 to 1.16.6 in OptaPlanner modules [incubator-kie-drools]
Posted by "gitgabrio (via GitHub)" <gi...@apache.org>.
gitgabrio merged PR #6810:
URL: https://github.com/apache/incubator-kie-drools/pull/6810
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org