This is an automated email from the ASF dual-hosted git repository.
tzimanyi pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-drools.git
The following commit(s) were added to refs/heads/main by this push:
new 1fd8480a9d [NO-ISSUE] Spring Boot 3.4.10 and other libraries update to
fix vulnerabilities. (#6471)
1fd8480a9d is described below
commit 1fd8480a9d0f762e6db8f74f67542ec90e783629
Author: Tibor Zimányi <[email protected]>
AuthorDate: Mon Oct 6 09:59:33 2025 +0200
[NO-ISSUE] Spring Boot 3.4.10 and other libraries update to fix
vulnerabilities. (#6471)
* Upgrade netty to 4.1.126.Final.
* Align with Spring Boot 3.4.10 upgrade.
---
build-parent/pom.xml | 136 +++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 126 insertions(+), 10 deletions(-)
diff --git a/build-parent/pom.xml b/build-parent/pom.xml
index dba3c552eb..4f6a6a5193 100644
--- a/build-parent/pom.xml
+++ b/build-parent/pom.xml
@@ -70,10 +70,10 @@
<version.com.thoughtworks.xstream>1.4.21</version.com.thoughtworks.xstream>
<version.guru.nidi>0.18.0</version.guru.nidi>
<version.info.picocli>4.7.5</version.info.picocli>
- <version.io.micrometer>1.14.8</version.io.micrometer>
- <version.io.quarkus>3.20.1</version.io.quarkus>
- <version.io.netty>4.1.122.Final</version.io.netty>
- <version.io.smallrye.openapi.core>4.0.10</version.io.smallrye.openapi.core>
+ <version.io.micrometer>1.14.11</version.io.micrometer>
+ <version.io.quarkus>3.20.2.2</version.io.quarkus>
+ <version.io.netty>4.1.127.Final</version.io.netty>
+ <version.io.smallrye.openapi.core>4.0.11</version.io.smallrye.openapi.core>
<version.io.smallrye.config.core>3.11.4</version.io.smallrye.config.core>
<version.org.apache.kafka>3.9.1</version.org.apache.kafka>
@@ -84,7 +84,7 @@
<version.org.antlr>3.5.2</version.org.antlr>
<version.org.antlr.ST4>4.0.7</version.org.antlr.ST4>
<version.org.apache.ant>1.10.11</version.org.apache.ant>
- <version.org.apache.commons.lang3>3.14.0</version.org.apache.commons.lang3>
+ <version.org.apache.commons.lang3>3.18.0</version.org.apache.commons.lang3>
<version.org.apache.commons.math3>3.4.1</version.org.apache.commons.math3>
<version.org.apache.httpcomponents.httpcore>4.4.16</version.org.apache.httpcomponents.httpcore>
<version.org.apache.maven>3.9.6</version.org.apache.maven>
@@ -100,7 +100,7 @@
<!--This needs to be in sync with JUnit-->
<version.org.hamcrest>2.2</version.org.hamcrest>
<version.org.hsqldb>2.3.0</version.org.hsqldb>
- <version.org.infinispan>15.0.15.Final</version.org.infinispan>
+ <version.org.infinispan>15.0.21.Final</version.org.infinispan>
<version.org.infinispan.protostream>5.0.13.Final</version.org.infinispan.protostream>
<version.org.javassist>3.26.0-GA</version.org.javassist>
<version.org.jboss.narayana.tomcat>7.0.2.Final</version.org.jboss.narayana.tomcat>
@@ -109,8 +109,8 @@
<version.org.jboss.weld.weld>3.1.6.Final</version.org.jboss.weld.weld>
<version.org.eclipse.microprofile.config>3.1</version.org.eclipse.microprofile.config>
<version.jakarta.enterprise.cdi-api>4.0.1</version.jakarta.enterprise.cdi-api>
- <version.jakarta.activation>2.0.1</version.jakarta.activation>
- <version.jakarta.activation-api>2.1.2</version.jakarta.activation-api>
+ <version.jakarta.activation>2.0.3</version.jakarta.activation>
+ <version.jakarta.activation-api>2.1.4</version.jakarta.activation-api>
<version.jakarta.inject-api>2.0.1</version.jakarta.inject-api>
<version.jakarta.annotation-api>2.1.1</version.jakarta.annotation-api>
<version.jakarta.transaction-api>2.0.1</version.jakarta.transaction-api>
@@ -142,7 +142,7 @@
<version.io.swagger.core.v3>2.2.19</version.io.swagger.core.v3>
<version.io.swagger.parser.v3>2.1.19</version.io.swagger.parser.v3>
<version.io.swagger.swagger-parser>1.0.55</version.io.swagger.swagger-parser>
- <version.org.xmlunit>2.10.2</version.org.xmlunit>
+ <version.org.xmlunit>2.10.4</version.org.xmlunit>
<!-- therefore the property is rewritten in that repository parent -->
<version.org.asciidoctor.asciidoctorj>2.2.0</version.org.asciidoctor.asciidoctorj>
<version.org.asciidoctor.asciidoctorj-pdf>1.5.0</version.org.asciidoctor.asciidoctorj-pdf>
@@ -307,9 +307,70 @@
<version>${version.com.fasterxml.jackson}</version>
</dependency>
+ <!-- Forced version of the majority of general netty dependencies. This
is to enforce an aligned netty libraries version in transitive dependencies,
due to possible CVEs. -->
<dependency>
<groupId>io.netty</groupId>
- <artifactId>netty-handler</artifactId>
+ <artifactId>netty-buffer</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-dns</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-haproxy</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-http</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-http2</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-memcache</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-mqtt</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-redis</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-smtp</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-socks</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-stomp</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-codec-xml</artifactId>
<version>${version.io.netty}</version>
</dependency>
<dependency>
@@ -317,6 +378,61 @@
<artifactId>netty-common</artifactId>
<version>${version.io.netty}</version>
</dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-dev-tools</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-handler</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-handler-proxy</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-handler-ssl-ocsp</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-resolver</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-resolver-dns</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-transport</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-transport-rxtx</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-transport-sctp</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-transport-udt</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-all</artifactId>
+ <version>${version.io.netty}</version>
+ </dependency>
<dependency>
<groupId>com.github.victools</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
