[OpenNMS/opennms] bc7d37: NMS-20093: Restore xstream and kotlin-stdlib depen...

  Branch: refs/heads/mm/NMS-20098-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: bc7d374e8c5155b323f52ee4b1f43f374e5cf250
      https://github.com/OpenNMS/opennms/commit/bc7d374e8c5155b323f52ee4b1f43f374e5cf250
  Author: Marshall Massengill <[email protected]>
  Date:   2026-07-28 (Tue, 28 Jul 2026)

  Changed paths:
    M pom.xml

  Log Message:
  -----------
  NMS-20093: Restore xstream and kotlin-stdlib dependencyManagement pins

NMS-20085 removed these as unused, but they were pinning the versions
of transitive dependencies that ship in $OPENNMS_HOME/lib: removing
them downgraded xstream 1.4.21 -> 1.4.20 (via drools-xml-support;
1.4.21 was a CVE-motivated bump) and kotlin-stdlib/-common
1.9.10 -> 1.4.10 (via okhttp). CI stayed green because the transitive
consumers declare and work with the older releases - the pins exist to
override them with patched versions. The restored entries carry
comments naming the transitive consumer they govern. Verified via
dependency:tree on opennms-base-assembly, which is the resolution that
populates lib/.


  Commit: a51e1be3eb392ad2bd3b98a8d4ad740182fc024c
      https://github.com/OpenNMS/opennms/commit/a51e1be3eb392ad2bd3b98a8d4ad740182fc024c
  Author: Marshall Massengill <[email protected]>
  Date:   2026-07-28 (Tue, 28 Jul 2026)

  Changed paths:
    M pom.xml

  Log Message:
  -----------
  NMS-20093: Restore junit-jupiter-api and junit-platform-engine pins

Third casualty of the NMS-20085 pin removal, this one on the test
classpath: without the managed version, junit-jupiter-api resolves to
a transitive's 5.6.2, skewing junit-platform-commons (1.6.2) against
the still-pinned vintage-engine (5.9.2 / platform 1.9.2). The
surefire/failsafe JUnit Platform provider then fails at startup with
NoClassDefFoundError: ClassNamePatternFilterUtils in
features.kafka.producer and features.flows.itests - surfaced by CI on
PR 8683, whose branch is based on the merged NMS-20085. Local builds
with -DskipTests never exercise this. Verified: dependency:tree shows
5.9.2/1.9.2 restored and the kafka producer test suite runs green.


  Commit: 7a6bcc5db8defe63bb9466dd511937fa228d09cf
      https://github.com/OpenNMS/opennms/commit/7a6bcc5db8defe63bb9466dd511937fa228d09cf
  Author: Marshall Massengill <[email protected]>
  Date:   2026-07-29 (Wed, 29 Jul 2026)

  Changed paths:
    M pom.xml

  Log Message:
  -----------
  Merge pull request #8684 from OpenNMS/mm/NMS-20093-smoke

NMS-20093: Restore xstream and kotlin-stdlib dependencyManagement pins


  Commit: 41df8a8d54a30178847f5264fdea4450ed01c63c
      https://github.com/OpenNMS/opennms/commit/41df8a8d54a30178847f5264fdea4450ed01c63c
  Author: Marshall Massengill <[email protected]>
  Date:   2026-07-30 (Thu, 30 Jul 2026)

  Changed paths:
    M pom.xml

  Log Message:
  -----------
  Merge remote-tracking branch 'upstream/release-36.x' into mm/NMS-20098-smoke


Compare: https://github.com/OpenNMS/opennms/compare/c5066e49617b...41df8a8d54a3

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs