Skip to content

jolokia 1.7.3 - #2908

Closed
rovarga wants to merge 447 commits into
apache:mainfrom
rovarga:jolokia-1.7.3
Closed

jolokia 1.7.3#2908
rovarga wants to merge 447 commits into
apache:mainfrom
rovarga:jolokia-1.7.3

Conversation

@rovarga

@rovarga rovarga commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

jbonofre and others added 30 commits August 3, 2025 07:09
@jbonofre
Update RELEASE-NOTES.md in preparation for 4.4.8 release
aa53f76
@jbonofre
[maven-release-plugin] prepare release karaf-4.4.8
eb23766
@jbonofre
[maven-release-plugin] prepare for next development iteration
cf382a3
@jbonofre
Sync branch (apache#2069)
84cb04e
@jbonofre
KARAF-8001: catch UnsupportedOperationException in LogService as it c…
ee7b015 
…an happen in the case of static distribution (apache#2072)
@jbonofre @rovarga
KARAF-7999: expose JFR packages (apache#2068)
567ab4b 
Expose the three JFR-related packages:
- jdk.jfr from jdk.jfr module.
- jdk.jfr.consumer from jdk.jfr module.
- jdk.management.jfr from jdk.management.jfr module

These are available a commercial features since Java 9, but are
available normally since Java 11.

Signed-off-by: Robert Varga <robert.varga@pantheon.tech>
Co-authored-by: Robert Varga <robert.varga@pantheon.tech>
@jbonofre
Upgrade to Pax Web 8.0.34 / Jetty 9.4.58.v20250814 (apache#2065)
437af1f
@jbonofre @rovarga
KARAF-8000: Update jre.properties correctly export packages (apache#1985
2f41815 
) (apache#2075)

* KARAF-8000: use cascading properties

Inherit JRE packages from previous version, not just jre-9,
almost reverting commit a7f6468, but
minimizing the length of evaluation chain based key releases that
introduced new packages.



* KARAF-8000: expose jdk.nio on Java 11+

This package was introduced in Java 11 as part of
https://bugs.openjdk.org/browse/JDK-8205415.



* KARAF-8000: expose Java 12 packages

Add packages introduced in Java 12:
- java.lang.constant via https://bugs.openjdk.java.net/browse/JDK-8202031
- javax.naming.ldap.spi via https://bugs.openjdk.org/browse/JDK-8192975



* KARAF-8000: expose jdk.nio.mapmode on Java 14+

This package was introduced in Java 14 via
https://bugs.openjdk.org/browse/JDK-8207851.



* KARAF-8000: expose java.lang.foreign on Java 22+

This package was originally introduced as preview in Java 19, but
finalized in Java 22 via https://bugs.openjdk.org/browse/JDK-8310626.



* KARAF-8000: expose Java 24 packages

Add packages introduced in Java 24:
- java.lang.classfile* via https://bugs.openjdk.org/browse/JDK-8334712
- jdk.management via https://bugs.openjdk.org/browse/JDK-8338890



* KARAF-8000: expose javax.sound on Java 25+

This package was introduced in Java 25 via
https://bugs.openjdk.org/browse/JDK-8356200.



* KARAF-8000: correct java.net.http availability

This package was originally introduced as incubating in Java 9, but
finalized in Java 11 via https://bugs.openjdk.org/browse/JDK-8197565.



* KARAF-8000: correct java.lang.runtime availability

This package was originally introduced as a preview in Java 14, but
finalized in Java 16 via https://bugs.openjdk.org/browse/JDK-8246771.

This effectively reverts commit
a674d6b.



* KARAF-8000: correct java.util.random availability

This package was introduced in Java 17 via
https://bugs.openjdk.org/browse/JDK-8255395.



---------

Signed-off-by: Robert Varga <robert.varga@pantheon.tech>
Co-authored-by: Robert Varga <robert.varga@pantheon.tech>
@jbonofre @mattrpav
[KARAF-7671] Fix LDAP cache handling so it does not reset on every lo…
d298313 
…gin attempt (apache#2071)

- Add metrics to the LDAPCache object
 - Fix unit test to _not_ disable cache
 - Update unit test to verify metrics counts and caching are working

Co-authored-by: Matt Pavlovich <mattrpav@apache.org>
@jbonofre @holgerfriedrich
karaf-maven-plugin: Remove try/catch blocks from tests (apache#2074) (a…
764abe5 
…pache#2077)

Error messages including the root cause are now being printed in case the test is failing.

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
Co-authored-by: Holger Friedrich <mail@holger-friedrich.de>
@jbonofre @holgerfriedrich
Fix incomplete upgrade of commons-lang3 (apache#2073) (apache#2078)
65e33eb 
Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
Co-authored-by: Holger Friedrich <mail@holger-friedrich.de>
@jbonofre
[karaf-4.4.x] Add integration tests execution in the CI (apache#2079)
3c56714 
* Add integration tests execution in the CI

* Skip E2ETest in interceptor impl
@jbonofre @dependabot
Bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.17 (apache#2119)…
a70b63a 
… (apache#2122)

* Bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.17

Bumps org.apache.rat:apache-rat-plugin from 0.16.1 to 0.17.

---
updated-dependencies:
- dependency-name: org.apache.rat:apache-rat-plugin
  dependency-version: '0.17'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...



* Exclude new test files from rat

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump org.eclipse.persistence:javax.persistence from 2.1.0 to 2.2.1 (a…
631d1c2 
…pache#2113) (apache#2120)

Bumps org.eclipse.persistence:javax.persistence from 2.1.0 to 2.2.1.

---
updated-dependencies:
- dependency-name: org.eclipse.persistence:javax.persistence
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump maven.version from 3.8.6 to 3.9.11 (apache#2110) (apache#2124)
386909f 
* Bump maven.version from 3.8.6 to 3.9.11

Bumps `maven.version` from 3.8.6 to 3.9.11.

Updates `org.apache.maven:maven-plugin-api` from 3.8.6 to 3.9.11
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.8.6...maven-3.9.11)

Updates `org.apache.maven:maven-compat` from 3.8.6 to 3.9.11
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.8.6...maven-3.9.11)

Updates `org.apache.maven:maven-core` from 3.8.6 to 3.9.11

Updates `org.apache.maven:maven-artifact` from 3.8.6 to 3.9.11

Updates `org.apache.maven:maven-settings` from 3.8.6 to 3.9.11

Updates `org.apache.maven:maven-settings-builder` from 3.8.6 to 3.9.11

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-plugin-api
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-compat
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-core
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-artifact
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-settings
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-settings-builder
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
...



* Add commons-io dependency in the maven.core test

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump activemq.version from 5.19.0 to 5.19.1 (apache#2111) (apache#2123)
c2334d6 
Bumps `activemq.version` from 5.19.0 to 5.19.1.

Updates `org.apache.activemq:activemq-pool` from 5.19.0 to 5.19.1
- [Commits](apache/activemq@activemq-5.19.0...activemq-5.19.1)

Updates `org.apache.activemq:activemq-karaf` from 5.19.0 to 5.19.1
- [Commits](apache/activemq@activemq-5.19.0...activemq-5.19.1)

---
updated-dependencies:
- dependency-name: org.apache.activemq:activemq-pool
  dependency-version: 5.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.activemq:activemq-karaf
  dependency-version: 5.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre
Bump org.hibernate:hibernate-osgi from 5.6.7.Final to 5.6.15.Final (a…
9460030 
…pache#2001) (apache#2126)
@jbonofre
Update issue tracker (apache#2130)
5abea1e
@jbonofre @dependabot
Bump org.codehaus.mojo:exec-maven-plugin from 3.6.1 to 3.6.2 (apache#…
3ae0282 
…2127) (apache#2131)

Bumps [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) from 3.6.1 to 3.6.2.
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)
- [Commits](mojohaus/exec-maven-plugin@3.6.1...3.6.2)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:exec-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump org.hibernate:hibernate-validator from 7.0.2.Final to 7.0.5.Final (
29ef32a 
apache#2112) (apache#2125)

* Bump org.hibernate:hibernate-validator from 7.0.2.Final to 7.0.5.Final

Bumps org.hibernate:hibernate-validator from 7.0.2.Final to 7.0.5.Final.

---
updated-dependencies:
- dependency-name: org.hibernate:hibernate-validator
  dependency-version: 7.0.5.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...



* Create feature for hibernate-validator

* Bump activemq.version from 5.19.0 to 5.19.1 (apache#2111)

Bumps `activemq.version` from 5.19.0 to 5.19.1.

Updates `org.apache.activemq:activemq-pool` from 5.19.0 to 5.19.1
- [Commits](apache/activemq@activemq-5.19.0...activemq-5.19.1)

Updates `org.apache.activemq:activemq-karaf` from 5.19.0 to 5.19.1
- [Commits](apache/activemq@activemq-5.19.0...activemq-5.19.1)

---
updated-dependencies:
- dependency-name: org.apache.activemq:activemq-pool
  dependency-version: 5.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.activemq:activemq-karaf
  dependency-version: 5.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...




* Bump maven.version from 3.8.6 to 3.9.11 (apache#2110)

* Bump maven.version from 3.8.6 to 3.9.11

Bumps `maven.version` from 3.8.6 to 3.9.11.

Updates `org.apache.maven:maven-plugin-api` from 3.8.6 to 3.9.11
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.8.6...maven-3.9.11)

Updates `org.apache.maven:maven-compat` from 3.8.6 to 3.9.11
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.8.6...maven-3.9.11)

Updates `org.apache.maven:maven-core` from 3.8.6 to 3.9.11

Updates `org.apache.maven:maven-artifact` from 3.8.6 to 3.9.11

Updates `org.apache.maven:maven-settings` from 3.8.6 to 3.9.11

Updates `org.apache.maven:maven-settings-builder` from 3.8.6 to 3.9.11

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-plugin-api
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-compat
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-core
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-artifact
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-settings
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.maven:maven-settings-builder
  dependency-version: 3.9.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
...



* Add commons-io dependency in the maven.core test

---------





* Add other hibernate-validator features

* Fix typo in features repository xml

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump commons-io:commons-io from 2.20.0 to 2.21.0 (apache#2143) (apach…
4a8b5da 
…e#2145)

Bumps [commons-io:commons-io](https://github.com/apache/commons-io) from 2.20.0 to 2.21.0.
- [Changelog](https://github.com/apache/commons-io/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-io@rel/commons-io-2.20.0...rel/commons-io-2.21.0)

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump xbean.version from 4.27 to 4.28 (apache#2137) (apache#2146)
9c7ebe3 
Bumps `xbean.version` from 4.27 to 4.28.

Updates `org.apache.xbean:xbean-bundleutils` from 4.27 to 4.28

Updates `org.apache.xbean:xbean-finder` from 4.27 to 4.28

Updates `org.apache.xbean:xbean-finder-shaded` from 4.27 to 4.28

Updates `org.apache.xbean:xbean-blueprint` from 4.27 to 4.28

Updates `org.apache.xbean:xbean-naming` from 4.27 to 4.28

Updates `org.apache.xbean:xbean-reflect` from 4.27 to 4.28

---
updated-dependencies:
- dependency-name: org.apache.xbean:xbean-bundleutils
  dependency-version: '4.28'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.xbean:xbean-finder
  dependency-version: '4.28'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.xbean:xbean-finder-shaded
  dependency-version: '4.28'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.xbean:xbean-blueprint
  dependency-version: '4.28'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.xbean:xbean-naming
  dependency-version: '4.28'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.xbean:xbean-reflect
  dependency-version: '4.28'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre
Set features and kar artifact to the corresponding mojo (apache#2114) (…
3659f77 
…apache#2152)

* Deal with Kar packaging and cleanly attach artifact forcing pom packaging.
* Also deal with packaging in the case generation is not enabled.
@jbonofre
Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 (apache#2158
50bbdf0 
)
@jbonofre
Bump cxf.version from 3.6.5 to 3.6.9 (apache#2157)
e23c3ff
@jbonofre @dependabot
Bump asm.version from 9.8 to 9.9 (apache#2159)
e20011f 
Bumps `asm.version` from 9.8 to 9.9.

Updates `org.ow2.asm:asm` from 9.8 to 9.9

Updates `org.ow2.asm:asm-util` from 9.8 to 9.9

Updates `org.ow2.asm:asm-tree` from 9.8 to 9.9

Updates `org.ow2.asm:asm-analysis` from 9.8 to 9.9

Updates `org.ow2.asm:asm-commons` from 9.8 to 9.9

---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
  dependency-version: '9.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.ow2.asm:asm-util
  dependency-version: '9.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.ow2.asm:asm-tree
  dependency-version: '9.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.ow2.asm:asm-analysis
  dependency-version: '9.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.ow2.asm:asm-commons
  dependency-version: '9.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre @dependabot
Bump bouncycastle.version from 1.81 to 1.82 (apache#2160)
3499275 
Bumps `bouncycastle.version` from 1.81 to 1.82.

Updates `org.bouncycastle:bcprov-jdk18on` from 1.81 to 1.82
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.81 to 1.82
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcutil-jdk18on` from 1.81 to 1.82
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

---
updated-dependencies:
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.82'
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.82'
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: org.bouncycastle:bcutil-jdk18on
  dependency-version: '1.82'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre
Bump jna.version from 5.17.0 to 5.18.1 (apache#2162)
75e9ad8
@jbonofre @dependabot
Bump jackson.version from 2.18.2 to 2.20.0 (apache#2010) (apache#2161)
35b9acf 
* Bump jackson.version from 2.18.2 to 2.20.0

Bumps `jackson.version` from 2.18.2 to 2.20.0.

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.18.2 to 2.20.0
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider` from 2.18.2 to 2.20.0

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...



* Add jackson.annotations.version as jackson-annotations has a specific version

* Use jackson.annotations.version in the examples features

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre
Upgrade to maven-plugin-plugin 3.11.0 (apache#2169)
081a65a
dependabot Bot and others added 27 commits September 8, 2026 06:48
@dependabot
[4.4.x] bump net.bytebuddy:byte-buddy from 1.18.12 to 1.18.13 (apache…
d5da402 
…#2858)

Bumps [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) from 1.18.12 to 1.18.13.
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.18.12...byte-buddy-1.18.13)

---
updated-dependencies:
- dependency-name: net.bytebuddy:byte-buddy
  dependency-version: 1.18.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[4.4.x] bump slf4j.version from 2.0.18 to 2.0.19 (apache#2856)
4277247 
Bumps `slf4j.version` from 2.0.18 to 2.0.19.

Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19

Updates `org.slf4j:slf4j-jdk14` from 2.0.18 to 2.0.19

Updates `org.slf4j:slf4j-nop` from 2.0.18 to 2.0.19

Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19

Updates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19

Updates `org.slf4j:slf4j-log4j12` from 2.0.18 to 2.0.19

---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-jdk14
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-nop
  dependency-version: 2.0.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:jcl-over-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-log4j12
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[4.4.x] bump activemq.version from 5.19.10 to 5.19.11 (apache#2854)
d31cb7d 
Bumps `activemq.version` from 5.19.10 to 5.19.11.

Updates `org.apache.activemq:activemq-pool` from 5.19.10 to 5.19.11
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.19.10...activemq-5.19.11)

Updates `org.apache.activemq:activemq-karaf` from 5.19.10 to 5.19.11
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.19.10...activemq-5.19.11)

---
updated-dependencies:
- dependency-name: org.apache.activemq:activemq-pool
  dependency-version: 5.19.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.activemq:activemq-karaf
  dependency-version: 5.19.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @holgerfriedrich
[4.4.x] bump jackson.version from 2.21.5 to 2.22.2 (apache#2809)
2880f87 
* [4.4.x] bump jackson.version from 2.21.5 to 2.22.2

Bumps `jackson.version` from 2.21.5 to 2.22.2.

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.5 to 2.22.2
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.21.5 to 2.22.2
- [Commits](FasterXML/jackson-dataformat-xml@jackson-dataformat-xml-2.21.5...jackson-dataformat-xml-2.22.2)

Updates `com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider` from 2.21.5 to 2.22.2

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Upgrade jackson.annotatons to 2.22 and stax2 to 4.3.0

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Holger Friedrich <mail@holger-friedrich.de>
@dependabot
[4.4.x] bump org.apache.maven.plugins:maven-plugin-plugin (apache#2877)
d1bfc9e 
Bumps [org.apache.maven.plugins:maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) from 3.15.2 to 3.16.0.
- [Release notes](https://github.com/apache/maven-plugin-tools/releases)
- [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-plugin-plugin
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[4.4.x] bump org.apache.maven.plugin-tools:maven-plugin-annotations (a…
da2a8de 
…pache#2876)

Bumps [org.apache.maven.plugin-tools:maven-plugin-annotations](https://github.com/apache/maven-plugin-tools) from 3.15.2 to 3.16.0.
- [Release notes](https://github.com/apache/maven-plugin-tools/releases)
- [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugin-tools:maven-plugin-annotations
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[4.4.x] bump pax.logging.version from 2.3.4 to 2.3.5 (apache#2802)
47efa80 
Bumps `pax.logging.version` from 2.3.4 to 2.3.5.

Updates `org.ops4j.pax.logging:pax-logging-api` from 2.3.4 to 2.3.5
- [Changelog](https://github.com/ops4j/org.ops4j.pax.logging/blob/main/RELEASE-NOTES.html)
- [Commits](ops4j/org.ops4j.pax.logging@logging-2.3.4...logging-2.3.5)

Updates `org.ops4j.pax.logging:pax-logging-log4j2` from 2.3.4 to 2.3.5
- [Changelog](https://github.com/ops4j/org.ops4j.pax.logging/blob/main/RELEASE-NOTES.html)
- [Commits](ops4j/org.ops4j.pax.logging@logging-2.3.4...logging-2.3.5)

Updates `org.ops4j.pax.logging:pax-logging-log4j2-extra` from 2.3.4 to 2.3.5
- [Changelog](https://github.com/ops4j/org.ops4j.pax.logging/blob/main/RELEASE-NOTES.html)
- [Commits](ops4j/org.ops4j.pax.logging@logging-2.3.4...logging-2.3.5)

Updates `org.ops4j.pax.logging:pax-logging-logback` from 2.3.4 to 2.3.5
- [Changelog](https://github.com/ops4j/org.ops4j.pax.logging/blob/main/RELEASE-NOTES.html)
- [Commits](ops4j/org.ops4j.pax.logging@logging-2.3.4...logging-2.3.5)

---
updated-dependencies:
- dependency-name: org.ops4j.pax.logging:pax-logging-api
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.ops4j.pax.logging:pax-logging-log4j2
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.ops4j.pax.logging:pax-logging-log4j2-extra
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.ops4j.pax.logging:pax-logging-logback
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@holgerfriedrich
fix(itests): Speed up JVM teardown by using TCP communication instead…
9f22eba 
… of stdio (apache#2815) (apache#2882)
@jbonofre
fix(config): restrict config:install to the admin role (apache#2862)
044278e 
config:install writes a file fetched from an arbitrary URL into
${karaf.etc}, which also holds users.properties, keys.properties and the
*.acl.* files. The command had no entry in the org.apache.karaf.command.acl.config
ACL, and the command guard treats an unmatched command as allowed, so any
authenticated shell user could run it.

Add "install = admin" to the config command ACL, consistent with
config:delete and with bundle:install / feature:install / kar:install.
@jbonofre Jean-Baptiste Onofré @claude
[4.4.x] Apply the JMX RBAC guard to MBean lifecycle operations (apach…
6c8c156 
…e#2866)

* fix(management): apply the JMX RBAC guard to MBean lifecycle operations

The KarafMBeanServerGuard only intercepted invoke, getAttribute(s) and
setAttribute(s). createMBean, registerMBean and unregisterMBean went
straight to the delegate MBeanServer, so they were not subject to any
role check and behaved inconsistently with the rest of the guarded API.

Route these three operations through the guard as well:

* MBeanInvocationHandler adds them to the guarded operation list.
* KarafMBeanServerGuard resolves the required roles from the jmx.acl*
  configuration by ObjectName and operation name (the target MBean is
  not, or not yet, registered so no MBeanInfo introspection is done).
  For createMBean/registerMBean the class name is passed as the
  operation argument so ACL rules can match on it, e.g.
  createMBean(java.lang.String)[/javax\.management\.loading\..*/] = admin
* A null ObjectName falls back to the generic jmx.acl configuration.
* The default jmx.acl.cfg maps createMBean/registerMBean/unregisterMBean
  to the admin role (the existing "* = admin" already covered them).

(cherry picked from commit 87c1426)

* Fix Javadoc comment prematurely terminated by regex example

The ACL regex example in the handleRegistration Javadoc contained the
literal sequence */ (from \..*/]), which closed the block comment early
and broke compilation of org.apache.karaf.management.server. Escape the
trailing slash as &apache#47; so the comment terminates where intended.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017MZQYyrYzSQHdHeD6AEGXT

---------

Co-authored-by: Jean-Baptiste Onofré <jbonofre@MacBookAir.local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
@jbonofre
Escape %u/%dn/%fqdn substitutions in LDAP search filters (CWE-90) (ap…
8e69e00 
…ache#2881)

LDAPCache and LDAPBackingEngine.lookupUser built search filters by
substituting %u/%dn/%fqdn and only doubling backslashes, which does not
escape *, (, ), or NUL. LDAPLoginModule and LDAPPubkeyLoginModule masked
this by pre-escaping the username themselves, but GSSAPILdapLoginModule
and LDAPBackingEngine.lookupUser did not, so filter metacharacters in a
login name could widen a search (e.g. a username of "*" matches any
entry) and potentially over-grant roles.

Centralize proper RFC 4515 filter escaping in LDAPCache/LDAPBackingEngine
using the existing Util.doRFC2254Encoding helper, and drop the redundant
pre-escaping in LDAPLoginModule/LDAPPubkeyLoginModule so escaping happens
exactly once, at the point filters are built.
@dependabot
[4.4.x] bump org.jline:jline from 3.30.16 to 3.30.17 (apache#2887)
7aee295 
Bumps [org.jline:jline](https://github.com/jline/jline3) from 3.30.16 to 3.30.17.
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.16...jline-3.30.17)

---
updated-dependencies:
- dependency-name: org.jline:jline
  dependency-version: 3.30.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jbonofre
[4.4.x] Reject shell metacharacters in instance javaOpts and add miss…
4576eaa 
…ing instance ACL (apache#2879)

* Reject shell metacharacters in instance javaOpts and add missing instance ACL

InstanceServiceImpl builds the child-instance launch command by concatenating
the caller-supplied javaOpts unquoted into a string that is ultimately handed
to /bin/sh (via ScriptUtils/ProcessImpl), so a javaOpts value containing shell
metacharacters was executed as an OS command rather than passed to the JVM.
This was reachable through instance:create, instance:start, instance:restart
and instance:change-opts (and the corresponding JMX operations).

Reject any javaOpts value that isn't valid JVM-option syntax before it is
used to build the launch command, in both doStart() and the self-restart
branch of restartInstance().

Also ship org.apache.karaf.command.acl.instance.cfg, since the instance
subshell had no ACL config at all and therefore failed open: any
authenticated shell user could invoke instance:* commands regardless of
role. The new ACL restricts state-changing operations to admin and
read-only ones (list/status) to viewer, matching the pattern used by the
other command ACLs.

* Fix InstanceTest to authenticate with admin/viewer roles for new instance ACL

The new org.apache.karaf.command.acl.instance.cfg restricts instance:*
commands to the admin (and list/status to viewer) role. InstanceTest was
invoking these commands without any role principal, so the secured shell
rejected them as CommandNotFoundException, failing CI.
@jbonofre
Ensure configuration files are always written within ${karaf.etc} (ap…
024e4cb 
…ache#2868)

ConfigRepositoryImpl derived the target file from caller-supplied input
(the felix.fileinstall.filename property and the PID / factory alias used
to build the file name) without checking that the result stayed inside
${karaf.etc}. Add a canonical-path containment check, shared through a new
org.apache.karaf.util.PathUtils helper, and reuse it in
ConfigMBeanImpl.install() and the config:install command in place of the
weaker finalname.contains("..") string check.
@jbonofre
fix(jdbc,jms): add command ACLs for the jdbc and jms scopes (karaf-4.…
8ee4009 
…4.x) (apache#2863)

* fix(jdbc,jms): add command ACLs for the jdbc and jms scopes

The jdbc and jms command scopes had no org.apache.karaf.command.acl.*
configuration. The command guard treats an unmatched command as allowed,
so any authenticated shell user (viewer role included) could run every
jdbc:* and jms:* command.

jdbc:ds-create and jms:create store a user-supplied URL into a
pax-jdbc-config / pax-jms-config factory configuration that is turned
into a live DataSource / ConnectionFactory. Several JDBC drivers run
code at connection time based on URL parameters (for instance H2
INIT=RUNSCRIPT), so creating a datasource is equivalent to arbitrary
code execution. jdbc:execute / jdbc:query run arbitrary SQL, and
jms:send / jms:consume / jms:move write to or destructively drain
broker destinations.

Add an ACL for each scope, provided by the jdbc / jms feature via a
<config> element under a shell conditional (same mechanism as the kar
and maven scopes):

  jdbc: ds-create, ds-delete, execute, query = admin;
        ds-list, ds-info, ds-factories, tables = viewer
  jms:  create, delete, send, consume, move = admin;
        connectionfactories, info, queues, topics, count, browse = viewer

This is consistent with shell:exec and config:install, which are
already restricted to admin. Add SSH command security itests for both
scopes.

* fix(jdbc,jms): grant admin/viewer roles in itests using jdbc/jms shell commands

KarafTestSupport.executeCommand() runs without a Subject when no Principal
is passed, so XATest, JmsTest and JmsExampleTest were being denied by the
new jdbc/jms command ACLs with a misleading CommandNotFoundException.
@jbonofre
fix: port security improvement (XSS) from Felix WebConsole (apache#2729)
65bab00
@holgerfriedrich
Drop guava 23 (apache#2889) (apache#2891)
e46152b 
Remove outdated guava version from Karaf. The only use was in itests and could
be replaced by JDK methods.
@holgerfriedrich
Align jetty dependency in tests (apache#2890)
279e8cf
@jbonofre
[karaf-4.4.x] Restrict feature:repo-add -i and feature:repo-remove -u…
73c1df0 
… to admin role (apache#2884)

* Restrict feature:repo-add -i and feature:repo-remove -u to admin role

feature:repo-add -i and feature:repo-remove -u call
FeaturesServiceImpl.addRepository()/removeRepository() with the
install/uninstall flag set, which installs or uninstalls every
feature in the repository. Neither command had an ACL entry, so
any SSH user with just the viewer role could reach this and have
Karaf install and start an arbitrary attacker-supplied feature
repository, bypassing the admin-only ACL on feature:install and
feature:uninstall.

Add option-specific ACL rules (same pattern already used for
bundle:refresh -f and friends) so only -i/-u require admin, while
plain repo-add/repo-remove stay open as before.

Backport of apache#2883 to karaf-4.4.x.

* Fix CI: add open fallback ACL rule for plain feature:repo-add/repo-remove

Same issue as apache#2883: the regex-conditioned ACL rules
(repo-add[/.*[-][i].*/], repo-remove[/.*[-][u].*/]) had no fallback entry for
the plain command. Karaf's ACL guard treats a command name that has at least
one ACL entry but no rule matching the current invocation as "no roles
allowed" (empty role list), which denies everyone -- including admin --
rather than leaving it unrestricted. This broke feature:repo-add/
feature:repo-remove without -i/-u for all callers, causing FeatureTest and
FeatureSshCommandSecurityTest to fail in CI with CommandNotFoundException.

Add an explicit "repo-add = viewer" / "repo-remove = viewer" fallback,
mirroring the existing pattern used for bundle:refresh -f, so the plain
commands remain open while -i/-u stay admin-only.

* Restore viewer access to plain feature:repo-add/repo-remove

Same fix as apache#2883. The previous "Fix CI" commit here added
the "repo-add = viewer" / "repo-remove = viewer" fallback needed to keep
the plain command visible to non-admin sessions (Karaf's shell guard
decides command visibility before it knows the actual arguments, so a
command with only a regex/exact-arg ACL entry is otherwise treated as
requiring that entry's role for every invocation). That part fixed
FeatureSshCommandSecurityTest, but the pre-existing FeatureTest cases
that called repo-add/repo-remove with no role at all (fine previously,
since the commands had no ACL entry) still failed: once a command has
any ACL entry, invoking it requires holding a role.

Pass an explicit viewer RolePrincipal from those three FeatureTest cases,
and document the viewer/admin split in security.adoc.
@holgerfriedrich
Align jetty dependency (apache#2894)
79d3a31 
Follow-up to apache#2890, handling feature files as well.
@holgerfriedrich
Upgrade org.eclipse.osgi from 3.18.0 to 3.18.600 (apache#2893)
734e36b
@holgerfriedrich
Upgrade bouncycastle from 1.85 to 1.86 (apache#2895)
0c27a7b 
Changelog:
https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md
@jbonofre
apacheGH-2741: Clean the OSGi bundle cache on JDK version change (apa…
033286e 
…che#2899)

The bundle cache under data/cache can persist a bundle wiring that was
resolved against a different JDK. After a JDK major version
upgrade/downgrade, reusing that stale wiring can silently leave core
bundles (e.g. Configuration Admin, File Install) without expected
wires, so filesystem/config changes stop being detected with no error
reported.

Karaf now records the JDK specification version used on the previous
start in data/jdk_version. On startup, if the recorded version differs
from the current one, the bundle cache is cleaned before the framework
is created, forcing a full re-resolution. This can be disabled with
-Dkaraf.clean.cache.on.jdk.change=false.
@jbonofre
[karaf-4.4.x] Fix race condition corrupting cfg files when updating a…
625c96c 
…n existing configuration (apache#2900)

* Fix race condition corrupting cfg files when updating an existing configuration

FeatureConfigInstaller.updateExistingConfig() wrote directly to the target
cfg file when appending to / overriding an existing configuration. Since
cfg.update() also triggers fileinstall to persist the same configuration
on the CM Event Dispatcher thread, two unsynchronized writers could hit the
same file at once, producing torn/corrupted content. The "new file" path
already avoided this by writing to a temp file and renaming it atomically
into place (KARAF-7389); this applies the same pattern to the
existing-file path.

Fixes apache#2805

(cherry picked from commit a9ca73a)

* apacheGH-2805: Use Files.move with REPLACE_EXISTING instead of File.renameTo

File.renameTo() silently fails (returns false, no exception) on Windows
when the destination already exists, leaving the cfg file stale and the
temp file orphaned. This broke updateExistingConfig() since it is only
called when the target file already exists, causing the Windows CI job
to fail (AppendTest).

(cherry picked from commit d5badd0)

* Add fallback for atomic file move

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit 741ff3b)

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@dependabot
[4.4.x] bump org.codehaus.mojo:build-helper-maven-plugin (apache#2904)
58b1c27 
Bumps [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) from 3.6.1 to 3.6.2.
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.1...3.6.2)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@holgerfriedrich
Upgrade jackson 2.18 legacy features to 2.18.10 (apache#2901)
31f1b3f 
Fixes CVE-2026-54513.
@rovarga
Bump Jolokia to 1.7.3
813bb3f 
https://github.com/jolokia/jolokia/releases/tag/v1.7.2
https://github.com/jolokia/jolokia/milestone/45?closed=1

Signed-off-by: Robert Varga <robert.varga@pantheon.tech>
@rovarga rovarga closed this Sep 15, 2026
@rovarga
rovarga deleted the jolokia-1.7.3 branch September 15, 2026 18:35
@rovarga
rovarga restored the jolokia-1.7.3 branch September 15, 2026 18:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Error displayed when starting Karaf

6 participants

@rovarga @jbonofre @elilja @mattrpav @holgerfriedrich @CptBartender