Rolling out odlparent-8.1.0
as I mentioned in November, I would like to roll out odlparent-8.1.0 to
replace the original MRI odlparent-8.0.x stream.
The reason for this is karaf-4.3.0 and its support for two things:
OSGi Release 7
This is a major upgrade to Release 6 shipped in the 4.2.x series. The
details are summed up nicely here:
The most important items are:
- JAX-RS support (finally)
- HTTP whiteboard update (to support JAX-RS)
- Declarative Service updates (constructor injection)
- Bundle Annotations (allowing to ditch a lot of maven-bundle-plugin
This is a relatively minor upgrade, summed up here:
The absolutely most important is support for safe Polymorphic
deserialization, which should put a stop to all those CVEs around
serialization gadgets we have seen in the last two or three years.
With that, the MRI projects are spinning releases integrating this, I
expect all of it to be ready this evening CET.
The preliminary patches to adopt these are living over here:
Preliminary testing did not find anything broken, and if that gets
confirmed through a multipatch-build, I will ask for supercommitter
rights and merge it up either tomorrow (Tuesday) or on Wednesday.
If anybody has objections, please holler now :)
On 25/01/2021 16:16, Robert Varga wrote:
The patches are out there.
Preliminary testing did not find anything broken, and if that getsmutlitpatch-build seems to fail in lispflowmapping, not sure why. I have
tried the complete series locally and it works like a charm. I'd say
just merge it :)
Guillaume, can we put this up for a quick vote on the TSC call today?