I'm not sure, although I think you're on the right track with your javax.jws:jsr181-api theory. Eduardo/Jim/Rebecca, if I'm on the wrong track here, please let us know. :)

The boms project itself only changed the version of the WildFly server it used to generate the boms -- see [1].

The server code itself didn't have any change specific to jakarta.jws:jakarta.jws-api -- see [2].

I'm not sure specifically how jakarta.jws:jakarta.jws-api was in the bom previously. There is no specific reference to it in the boms project, unlike javax.jws:jsr181-api which is specifically declared at [3]]. AIUI that means it appeared in the bom previously due to a transitive dependency on it by something that is declared in the boms project. So if something changed in the transitive dependency tree that could explain why it disappeared from the bom. The most relevant change is the CXF upgrade[4] that fixed the key CVE that inspired the release. Another possibility is is the JAXB update[5], but that seems less likely as it's less intuitive that that would have jws dependencies, plus the change itself was very small.

[1] https://github.com/wildfly/boms/compare/26.1.2.Final...26.1.3.Final#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8R78

[2] https://github.com/wildfly/wildfly/compare/26.1.2.Final...26.1.3.Final

[3] https://github.com/wildfly/boms/blob/6fe75955e2f5522bd9d1f00dd6625bcbc10c263b/jakartaee8/pom.xml#L143-L146

[4] https://github.com/wildfly/wildfly/pull/16440

[5] https://github.com/wildfly/wildfly/pull/16453

Best regards,

Brian

On Mon, Feb 6, 2023 at 2:14 AM Alex Lutsenko <krazilek@gmail.com> wrote:

Greetings to WildFly team!

As part of new product development, I've initiated an upgrade from Java 8 to Java 11. Was pleased to know that WildFly 26 supports both 8 and 11 versions (not saying about 17 which is really great).
Last year I've started development process with 26.1.2. Last week I've read about 26.1.3 release, listing security fixes and went comparing Jakarta EE POMs in Maven repository (https://mvnrepository.com/artifact/org.wildfly.bom/wildfly-jakartaee8/26.1.2.Final https://mvnrepository.com/artifact/org.wildfly.bom/wildfly-jakartaee8/26.1.3.Final )

My question is, why jakarta.jws:jakarta.jws-api:2.1.0 dependency was removed?
Is it somehow related to javax.jws:jsr181-api (is present in both POMs)? According to https://github.com/jakartaee/jws-api/issues/1 " Jsr181-api.jar is just the wrong name of javax.jws-api.jar" and " current (and correct) artifact now from this repo is going to be jakarta.jws:jakarta.jws-api:2.1.0"

P.S. I don't know if it's an appropriate channel to ask such question; if not, please provide a proper resource.

--
Best regards,
Alex Lutsenko

_______________________________________________
wildfly-dev mailing list -- wildfly-dev@lists.jboss.org
To unsubscribe send an email to wildfly-dev-leave@lists.jboss.org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s