Skip to content

JCR-5022: Update derby dependency to 10.15.2.0#157

Merged
reschke merged 1 commit into
trunkfrom
JCR-5022
Jan 29, 2024
Merged

JCR-5022: Update derby dependency to 10.15.2.0#157
reschke merged 1 commit into
trunkfrom
JCR-5022

Conversation

@reschke
Copy link
Copy Markdown
Contributor

@reschke reschke commented Jan 29, 2024

No description provided.

@reschke reschke merged commit d32af89 into trunk Jan 29, 2024
@reschke reschke deleted the JCR-5022 branch January 29, 2024 13:43
Comment thread jackrabbit-webapp/pom.xml
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change of the scope resulted in the Derby database driver no longer being delivered as part of the WAR (under WEB-INF/lib)

  1. https://archive.apache.org/dist/jackrabbit/2.20.17/jackrabbit-webapp-2.20.17.war - Derby driver is included
  2. https://archive.apache.org/dist/jackrabbit/2.22.0/jackrabbit-webapp-2.22.0.war - no Derby driver included

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's likely caused by the change to make Derby just a test depency when updating the version.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, would you like me to update the patch then, with some likeliness of going forward with it?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Derby change to a test depency was intentional (AFAIR, due to https://www.cve.org/CVERecord?id=CVE-2022-46337).

So I would prefer to keep it out of the WAR we generate.

And no, I really can't estimate if or when we can merge this, because I'm still not sure that this is the best way forward.

Would it be ok to have this only in the BETA branch for now?

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the DerbyPersistenceManager is still there, I only need to include the Derby JARs in a WAR overlay.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants