You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by ya...@apache.org on 2026/10/05 10:20:13 UTC
(incubator-kie) branch main updated: [NO-ISSUE] pin opentelemetry-api to 1.62.0 and opentelemetry-instrumentation-bom-alpha to 2.28.1-alpha (#7112)
This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 079a819b11d [NO-ISSUE] pin opentelemetry-api to 1.62.0 and opentelemetry-instrumentation-bom-alpha to 2.28.1-alpha (#7112)
079a819b11d is described below
commit 079a819b11ddd692f0577e78e5c6e30c22a10656
Author: ANN JOY <an...@gmail.com>
AuthorDate: Mon Oct 5 15:50:06 2026 +0530
[NO-ISSUE] pin opentelemetry-api to 1.62.0 and opentelemetry-instrumentation-bom-alpha to 2.28.1-alpha (#7112)
opentelemetry-api 1.57.0 is pulled in transitively via smallrye-reactive-messaging-otel
in both kie-quarkus-build-parent and kogito-quarkus/bom module trees.
Without the instrumentation BOM pin, opentelemetry-instrumentation-api:2.23.0
(shipped by quarkus-bom 3.33.3.2, compiled against opentelemetry-api:1.57.0)
conflicts with the pinned 1.62.0 API, causing GraalVM native-image pointsto
analysis failures in dmn-event-driven-quarkus and ruleunit-event-driven-quarkus.
- kie-quarkus-build-parent/pom.xml: added version.io.opentelemetry.api and
version.io.opentelemetry.instrumentation properties; pinned opentelemetry-api
and imported opentelemetry-instrumentation-bom-alpha before quarkus-bom
- kogito-quarkus/bom/pom.xml: same additions
Pins should be removed in a future Quarkus upgrade that ships
OpenTelemetry >= 1.62.0 and instrumentation >= 2.28.1.
---
kie-quarkus-build-parent/pom.xml | 19 +++++++++++++++++++
kogito-quarkus/bom/pom.xml | 19 +++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git a/kie-quarkus-build-parent/pom.xml b/kie-quarkus-build-parent/pom.xml
index 554174d800c..e73faed0471 100644
--- a/kie-quarkus-build-parent/pom.xml
+++ b/kie-quarkus-build-parent/pom.xml
@@ -39,6 +39,13 @@
</description>
<properties>
+ <!--
+ [CVE-2026-45292] opentelemetry-api 1.57.0 pulled in via smallrye-reactive-messaging-otel.
+ Pin to 1.62.0 before quarkus-bom import so this value takes precedence.
+ Should be removed in future Quarkus upgrades that include OpenTelemetry >= 1.62.0
+ -->
+ <version.io.opentelemetry.api>1.62.0</version.io.opentelemetry.api>
+ <version.io.opentelemetry.instrumentation>2.28.1-alpha</version.io.opentelemetry.instrumentation>
<version.io.quarkus>3.33.4</version.io.quarkus>
<version.io.quarkus.camel>3.33.2</version.io.quarkus.camel>
<!-- Quarkus-platform-aligned pin. kie-parent keeps the Spring Boot / framework-neutral value;
@@ -60,6 +67,18 @@
<dependencyManagement>
<dependencies>
+ <dependency>
+ <groupId>io.opentelemetry.instrumentation</groupId>
+ <artifactId>opentelemetry-instrumentation-bom-alpha</artifactId>
+ <version>${version.io.opentelemetry.instrumentation}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
+ <dependency>
+ <groupId>io.opentelemetry</groupId>
+ <artifactId>opentelemetry-api</artifactId>
+ <version>${version.io.opentelemetry.api}</version>
+ </dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-bom</artifactId>
diff --git a/kogito-quarkus/bom/pom.xml b/kogito-quarkus/bom/pom.xml
index de2b43ba4b5..8c6a6233e5e 100644
--- a/kogito-quarkus/bom/pom.xml
+++ b/kogito-quarkus/bom/pom.xml
@@ -31,6 +31,13 @@
<!-- Used to define which poms are allowed to have dependencyManagement sections. This is to enforce the convention that only the root pom should have dependencyManagement, and all other poms should inherit from it. -->
<allowedPomsList>org.kie.kogito:kogito-quarkus-bom</allowedPomsList>
<quarkus.logging.manager>org.jboss.logmanager.LogManager</quarkus.logging.manager>
+ <!--
+ [CVE-2026-45292] opentelemetry-api 1.57.0 pulled in via smallrye-reactive-messaging-otel.
+ Pin to 1.62.0 before quarkus-bom import so this value takes precedence.
+ Should be removed in future Quarkus upgrades that include OpenTelemetry >= 1.62.0
+ -->
+ <version.io.opentelemetry.api>1.62.0</version.io.opentelemetry.api>
+ <version.io.opentelemetry.instrumentation>2.28.1-alpha</version.io.opentelemetry.instrumentation>
<version.io.quarkus>3.33.4</version.io.quarkus>
<version.io.quarkus.quarkus-test>${version.io.quarkus}</version.io.quarkus.quarkus-test>
<version.io.quarkiverse.jackson-jq>2.4.0</version.io.quarkiverse.jackson-jq>
@@ -181,6 +188,18 @@
<artifactId>bson-record-codec</artifactId>
<version>${version.mongodb-driver-sync}</version>
</dependency>
+ <dependency>
+ <groupId>io.opentelemetry.instrumentation</groupId>
+ <artifactId>opentelemetry-instrumentation-bom-alpha</artifactId>
+ <version>${version.io.opentelemetry.instrumentation}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
+ <dependency>
+ <groupId>io.opentelemetry</groupId>
+ <artifactId>opentelemetry-api</artifactId>
+ <version>${version.io.opentelemetry.api}</version>
+ </dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-bom</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org