From b1506106495cc04c5c8b1193ca7a40d906d85f30 Mon Sep 17 00:00:00 2001
From: Emmanuel GALLOIS <Emmanuel.gallois@qlik.com>
Date: Tue, 25 Aug 2026 15:35:34 +0200
Subject: [PATCH 1/2] chore(QTDI-3340): Bump cxf.version to fix CVE-2026-50645

Bump the root cxf.version property from 3.5.11 to 3.6.12 to remediate
CVE-2026-50645 (CWE-400 uncontrolled resource consumption / unauthenticated
DoS via unbounded attachment parts per message, CVSS 3.1 7.5 High) in
Apache CXF cxf-core. This single property governs every org.apache.cxf
artifact declared in the reactor's dependencyManagement, remediating all
10 modules that resolve org.apache.cxf transitively or directly
(component-server, vault-client, documentation, talend-component-maven-plugin,
component-starter-server, component-tools, component-tools-webapp,
images/component-server-image, images/component-starter-server-image,
reporting).

Also fix Github.java (documentation module) to catch NoClassDefFoundError
in addition to Exception when reflectively loading the optional CXF
GZIPFeature class. CXF 3.6.x no longer transitively pulls in
jakarta.xml.ws-api (previously supplied via cxf-rt-frontend-jaxrs's own
POM), so classloading org.apache.cxf.feature.AbstractFeature subclasses
(GZIPFeature's superclass hierarchy) now throws NoClassDefFoundError
instead of succeeding. This mirrors the existing defensive pattern already
used in component-server's ComponentServerConfiguration#init for the same
CXF reflection pitfall.

#time 1h

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../src/main/java/org/talend/runtime/documentation/Github.java  | 2 +-
 pom.xml                                                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/documentation/src/main/java/org/talend/runtime/documentation/Github.java b/documentation/src/main/java/org/talend/runtime/documentation/Github.java
index 5b71bf218cb46..93e976ad70ee5 100644
--- a/documentation/src/main/java/org/talend/runtime/documentation/Github.java
+++ b/documentation/src/main/java/org/talend/runtime/documentation/Github.java
@@ -76,7 +76,7 @@ public Collection<Contributor> load() {
                             .currentThread()
                             .getContextClassLoader()
                             .loadClass("org.apache.cxf.transport.common.gzip.GZIPFeature"));
-        } catch (final Exception e) {
+        } catch (final Exception | NoClassDefFoundError e) {
             // not critical
         }
         final WebTarget gravatarBase = client.target(Gravatars.GRAVATAR_BASE);
diff --git a/pom.xml b/pom.xml
index bfca0f19a069b..46ca1587d851b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -174,7 +174,7 @@
     <meecrowave.version>1.2.15</meecrowave.version>
     <owb.version>2.0.27</owb.version>
     <tomcat.version>9.0.118</tomcat.version>
-    <cxf.version>3.5.11</cxf.version>
+    <cxf.version>3.6.12</cxf.version>
 
     <woodstox.version>6.5.0</woodstox.version>
 

From d5884ab3b9540f37a2933d4393f52219fe35d31a Mon Sep 17 00:00:00 2001
From: Emmanuel GALLOIS <Emmanuel.gallois@qlik.com>
Date: Tue, 25 Aug 2026 16:21:05 +0200
Subject: [PATCH 2/2] fix(QTDI-3341): bump netty to 4.1.137

---
 component-runtime-testing/component-runtime-http-junit/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/component-runtime-testing/component-runtime-http-junit/pom.xml b/component-runtime-testing/component-runtime-http-junit/pom.xml
index 36ea6444b24df..1cc1c81ac88f2 100644
--- a/component-runtime-testing/component-runtime-http-junit/pom.xml
+++ b/component-runtime-testing/component-runtime-http-junit/pom.xml
@@ -28,7 +28,7 @@
   <description>JUnit integration to simplify the HTTP API testing/mocking.</description>
 
   <properties>
-    <netty.version>4.1.135.Final</netty.version>
+    <netty.version>4.1.137.Final</netty.version>
     <talend.build.name>${talend.build.name.base}.junit.http</talend.build.name>
   </properties>