Quartz release needs (fall 2024)

[jhouserizer]

I'm looking here to gather a list of "todo" items / needs for making official releases of 2.4.0 and 2.5.0 (both of which had RCA releases a long time ago).

Please list here important needs (bug fixes, library updates, doc clarifications, etc.) that you consider important.

[lprimak]

#1 - Fix CVEs

[melloware]

@lprimak i think @jhouserizer is looking for specifics. Which libraries to upgrade etc.

Example: #1130

[lprimak]

I think as an admin, in GitHub, all security issues automatically show up

[jhouserizer]

everything that dependabot identifies is now fixed.

[jhouserizer]

This PR #1165 looks useful, but there is one change in it that breaks public API. It is a long-glaring spelling error in the public API, so would be nice to have fixed - and a new major GA would be the time to do it. But is it worth causing everyone who upgrades to latest release to fix some code before compile succeeds?

[jhouserizer]

Wen't ahead and accepted / merged it into 2.5.0 line

[wilx]

• Split unrelated functionalities to separate modules to avoid unnecessary dependencies. E.g., split the JBoss stuff from the core, pooling connection providers each to a separate module.

Then there are various cleanup tasks:

• Use placeholders instead of concatenation in SLF4J logging.
• Lots of unnecessary .toString() calls, modifiers, size()==0 instead of isEmpty(), unnecessary boxing/unboxing, etc.

[jhouserizer]

Sure ... lots of historical code - dating literally to Java 1.2 days. PRs welcome. ;)

[bcode2]

I have already a branch with a lot of fixes (.toString() calls, modifiers, size()==0 instead of isEmpty(),etc) and language level migrations. Currently preparing the PR. If accepted will fix other issues I have just found :)

[lahma]

Would it be possible to have a clear announcement about IPR transfer to IBM and who are currently working on the project (if OK to list individuals). I think it would warrant a separate pinned discussion as it's quite interesting development after Terracotta.

[jhouserizer]

Hi Marko! Done: #1195

[lahma]

Awesome, that post clarifies a lot. Thank you for taking the time to elaborate 👍🏻

[mciara]

Fixing triggers getting blocked permanently when using @DisallowConcurrentExecution is very important to us.

We use the latest Quartz version and still have the same issue as described here: #145

[melloware]

@mciara i would open an new ticket since that one is closed with how to reproduce the issue.

[asambol]

A quick 2.4.0 release with fixed CVE's and already merged commits that were available in 2.4.0-RC2 would be ideal.
There is a lot of software triggering security vulnerability scanners due to v2.3.2 and no available alternative.
Additional changes should be postponed to version 2.5.0.

[jhouserizer]

There is a new quartz-2.4.0-rc3 now on maven central with all the latest changes/fixes. if a few people confirm success with it will make a GA.

[jhouserizer]

There is a new quartz-2.5.0-rc2 now on maven central with all the latest changes/fixes. if a few people confirm success with it will make a GA.

[indyaah]

We are seeing decent success with 2.5.0-rc2, long been on 2.2.x chain. Will keep posting more updates!

[bcode2]

This seems promising. I was able to migrate almost all the old code (3 & 4) from the tests to Junit5(5.11.2)

[jixiang8320216]

CVE： CVE-2018-8088 、CVE-2023-39017、CVE-2021-44228、CVE-2021-45046

[jhouserizer]

Those are all already handled. The possible exception being CVE-2023-39017 ... but it is long ago reported disputed.

[jhouserizer]

There are new quartz-2.5.0-rc2 and quartz-2.4.0-rc3 builds now on maven central with all the latest changes/fixes. if a few people confirm success with it will make a GA.

[melloware]

we are testing 2.4.0-rc3 will report back

[melloware]

OK reports back are everything is working all our jobs (which are Oracle JDBC jobs) picked up without issue on 2.4.0

[bcode2]

I will test it next week (2.4.0+oracle-19+Spring5)

[linghengqian]

• I have confirmed at Bump Quartz to 2.4.0-rc3 apache/shardingsphere-elasticjob#2455 that org.quartz-scheduler:quartz:2.4.0-rc3 does not have any bugs that affect CI.

[Advait-47]

Hi, I wanted to know when will the stable version be released?
A tentative date/timeline will suffice.
Thanks a bunch!

[jhouserizer]

See the message immediately before your message: "f a few people confirm success with it will make a GA."

[TarasTielkes]

Any chance for new rc releases containing the changes merged over the last weeks?

[jhouserizer]

Quartz 2.4.0 and 2.5.0 GA builds are now on Maven Central. In the next day or two they will also be on direct download links, etc.

[slawekjaranowski]

One remarks - date for 2.4.0 release notes is Apr 24, 2023 - https://github.com/quartz-scheduler/quartz/releases/tag/quartz-2.4.0
looks not accurate

[melloware]

Great work @jhouserizer kudos all around!

[jhouserizer]

Yes, thanks much to all who contributed - and there were several.

[jhouserizer]

One remarks - date for 2.4.0 release notes is Apr 24, 2023 - https://github.com/quartz-scheduler/quartz/releases/tag/quartz-2.4.0 looks not accurate

That seems to be an unfortunate github "feature" - I can't edit it. I suppose I could delete and re-create the release.