Skip to content

Bump hazelcast orbit bundle to 5.3.7.wso2v2 - #4630

Closed
sadilchamishka wants to merge 1 commit into
wso2:4.12.xfrom
sadilchamishka:vuln/hazelcast-5.3.6-wso2v2
Closed

sadilchamishka wants to merge 1 commit into
wso2:4.12.xfrom
sadilchamishka:vuln/hazelcast-5.3.6-wso2v2

Conversation

@sadilchamishka

@sadilchamishka sadilchamishka commented Sep 4, 2026 •

Copy link
Copy Markdown

Purpose

Pick up hazelcast 5.3.7.wso2v2, which re-shades jackson to 2.22.2 in place of the copy upstream
hazelcast embeds in com.hazelcast.shaded.com.fasterxml.jackson. That version is not reachable from
any pom property, so the fix is a new orbit bundle rather than a version bump here.

Approach

parent/pom.xml: orbit.version.hazelcast 5.3.6.wso2v1 → 5.3.7.wso2v2.

Hazelcast itself moves 5.3.6 → 5.3.7, a patch release. Its embedded dependency set is unchanged from
5.3.6 — everit-json-schema 1.14.3, HikariCP 4.0.3, classgraph 4.8.158, org.json 20231013,
snakeyaml-engine 2.6 — so jackson is the only thing that changes.

5.3.7.wso2v2's OSGi manifest is identical to 5.3.7.wso2v1's when both are built with the same
toolchain: 654 Import-Package and 571 Export-Package entries, same sets, no mandatory imports.

Blocked on

wso2/orbit#1407 — needs 5.3.7.wso2v2 released to Nexus before this can build. Draft until then.

@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Comment @coderabbitai help to get the list of available commands.

@sadilchamishka
sadilchamishka force-pushed the vuln/hazelcast-5.3.6-wso2v2 branch from 4ef59cf to 4bf18a0 Compare September 7, 2026 02:47
@sadilchamishka sadilchamishka changed the title Bump hazelcast orbit bundle to 5.3.6.wso2v2 Bump hazelcast orbit bundle to 5.4.0.wso2v2 Sep 7, 2026
@sadilchamishka
sadilchamishka force-pushed the vuln/hazelcast-5.3.6-wso2v2 branch from 4bf18a0 to 8ead56f Compare September 7, 2026 02:57
5.3.7.wso2v2 re-shades jackson to 2.22.2 in place of the copy hazelcast
embeds, which is not reachable from any pom property. This also moves
hazelcast itself 5.3.6 -> 5.3.7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@sadilchamishka
sadilchamishka force-pushed the vuln/hazelcast-5.3.6-wso2v2 branch from 8ead56f to 0d0a61a Compare September 7, 2026 03:32
@sadilchamishka sadilchamishka changed the title Bump hazelcast orbit bundle to 5.4.0.wso2v2 Bump hazelcast orbit bundle to 5.3.7.wso2v2 Sep 7, 2026
@sadilchamishka

Copy link
Copy Markdown
Author

Closed in favour of #4631, same change on a correctly named branch.

@sadilchamishka
sadilchamishka deleted the vuln/hazelcast-5.3.6-wso2v2 branch September 7, 2026 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant