[7.67.x-blue] [RHPAM-3709] upgrade maven dependencies to address CVE-2021-26291

[baldimir]

Replacing #2441

Dependent PRs:

• [7.67.x-blue] [RHPAM-3709] upgrade maven dependencies to address CVE-2021-26291 #2444
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 process-migration-service#134
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 appformer#1415
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 jbpm-work-items#298
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291  drools#38
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 kie-soup#276
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 jbpm#2407
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 droolsjbpm-integration#3044
• [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 kie-wb-common#3824
• [7.67.x-blue] [RHPAM-3709] upgrade maven dependencies to address CVE-2021-26291 kie-wb-distributions#1243

[baldimir]

jenkins run fdb

[mareknovotny]

please include in PR description all dependent PRs to be easier for later merge or searching

[yesamer]

jenkins run fdb

[mareknovotny]

i think there needs to be solved the problems in

1. [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 jbpm#2407
2. [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 droolsjbpm-integration#3044,
3. [7.67.x-blue] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 kie-wb-common#3824,

[baldimir]

Yes, thanks for checking.

[mareknovotny]

jenkins do fdb

hopefully final check on the PR set

[mareknovotny]

hmm, unfortunately enforcer complains now at almost latest repository for duplicated classes in business-monitoring-webapp module

[2024-03-28T14:53:48.475Z] org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.0.0-M3:enforce (ban-duplicated-classes) on project business-monitoring-webapp: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed.


[2024-03-28T14:53:48.475Z] [WARNING] Rule 0: org.apache.maven.plugins.enforcer.BanDuplicateClasses failed with message:
[2024-03-28T14:53:48.475Z] Duplicate classes found:
[2024-03-28T14:53:48.475Z] 
[2024-03-28T14:53:48.475Z]   Found in:
[2024-03-28T14:53:48.475Z]     org.codehaus.plexus:plexus-cipher:jar:2.0:compile
[2024-03-28T14:53:48.475Z]     org.sonatype.plexus:plexus-cipher:jar:1.4:test
[2024-03-28T14:53:48.475Z]   Duplicate classes:
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/cipher/PlexusCipherException.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/cipher/PlexusCipher.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/cipher/Base64.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/cipher/DefaultPlexusCipher.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/cipher/PBECipher.class
[2024-03-28T14:53:48.475Z] 
[2024-03-28T14:53:48.475Z]   Found in:
[2024-03-28T14:53:48.475Z]     org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
[2024-03-28T14:53:48.475Z]     org.sonatype.plexus:plexus-sec-dispatcher:jar:1.3:test
[2024-03-28T14:53:48.475Z]   Duplicate classes:
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/DefaultSecDispatcher.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/model/io/xpp3/SecurityConfigurationXpp3Reader.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/SecUtil.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/model/SettingsSecurity.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/model/Config.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/SecDispatcherException.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/model/io/xpp3/SecurityConfigurationXpp3Writer.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/PasswordDecryptor.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/SecDispatcher.class
[2024-03-28T14:53:48.475Z]     org/sonatype/plexus/components/sec/dispatcher/model/ConfigProperty.class

[baldimir]

I created a PR for kie-wb-distributions (Thanks @jstastny-cz for testing the fix). Will retrigger the fdb.

[baldimir]

jenkins run fdb

[baldimir]

I accidentally triggered multiple fdbs :) I am sorry - that means the check here shows failed, however the build actually still runs. It is the build no. 129.

[mareknovotny]

just linking here FDB then https://eng-jenkins-csb-business-automation.apps.ocp-c1.prod.psi.redhat.com/job/KIE/job/7.67.x-blue/job/fdb/job/droolsjbpm-build-bootstrap-7.67.x-blue.fdb/129/console

[mareknovotny]

jenkins do fdb

[mareknovotny]

there is known flaky test failure only org.kie.bc.DeploymentIT.org.kie.bc.DeploymentIT so good to merge