[26.7] Upgrade to Quarkus 3.33.3.1 - #51346
Conversation
| <jboss.spec.javax.xml.bind.jboss-jaxb-api_2.3_spec.version>2.0.1.Final</jboss.spec.javax.xml.bind.jboss-jaxb-api_2.3_spec.version> | ||
| <jboss.spec.javax.servlet.jsp.jboss-jsp-api_2.3_spec.version>2.0.0.Final</jboss.spec.javax.servlet.jsp.jboss-jsp-api_2.3_spec.version> | ||
| <log4j2-api.version>2.25.4</log4j2-api.version> <!-- Odd name needs to align with Quarkus --> | ||
| <log4j2-api.version>2.25.3</log4j2-api.version> <!-- Odd name needs to align with Quarkus --> |
There was a problem hiding this comment.
There is no reason to align with Quarkus just to bump to Quarkus 3.33.3. I described details here #50158 (review). The reason why we bumped it was that @ahus1 said in a Slack comment https://ibm-cloud.slack.com/archives/C09CRPLBTFW/p1781904382015629 that this "depedanbot wants to fix CVE". Of course it wasn't actual CVE which affected us, but we silenced scanners. I cannot see anything linked to that Dependabot PR, but I remember I was inspecting something linked at the top of that PR, so GitHub just dropped it in the meanwhile I guess.
There was a problem hiding this comment.
Right, so you basically write the same thing in the description and still propose this. I am -1, but no problem, I'll let others decide.
There was a problem hiding this comment.
@michalvavrik I acknowledged this specifically in the PR description, with a link to the issue attached.
This is what set-quarkus-version script produced and the same scipt runs during quarkus-next workflow.
I thought that the general approach is to be aligned with Quarkus and that in cases like this we should just let the security team know that it is a false positive as they can supress those.
Anyway, that's just my thought process out loud, I don't have strong opinions here. I can revert it if there's a common agreement. 😉
There was a problem hiding this comment.
I would not downgrade the depency if we already manually overridden it and upgraded it, that would be odd. That said, since it's not directly used by KC, I don't think we should've overridden the version in the first place. Created #51388 to investigate as a follow-up.
There was a problem hiding this comment.
It's reverted back now.
92d05b3 to
776c9e0
Compare
Closes: keycloak#51344 Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
776c9e0 to
0b1d27a
Compare
Closes: #51344
Closes: #50955
Note: log4j2-api 2.25.4 was bumped by Dependabot independently of the Quarkus BOM. I reverted it to 2.25.3 to stay aligned with Quarkus 3.33.3. Log4j is not used by Keycloak, it's only managed to avoid false positives from security scanners, see the discussion #50158.