I agree: my point is that Spring 4.3.29 fixes all open CVE up to know. Now, I’m working on Spring 5.x upgrade.
So, just wait a bit and we will have it very soon (it’s almost done, just have to polish some changes ;)). Regards JB > Le 2 déc. 2020 à 15:35, ragul rangarajan <ragulrangara...@gmail.com> a écrit : > > Thanks for the update JB. > > But my concern for the need for Spring 5 Upgrade is more on that* Spring > 4.3.x release going to reach it EOF* than CVE fixes > FYI: Spring Framework Versions · spring-projects/spring-framework Wiki · > GitHub > <https://github.com/spring-projects/spring-framework/wiki/Spring-Framework-Versions#supported-versions> > > > - 4.3.x is the last feature branch of the 4th generation, with active > maintenance until October 2020. *4.3.x will reach its official EOL > (end-of-life) on December 31st, 2020.* > > Looking forward to your update on Spring 5 upgrade. > > Thanks & Regards, > Ragul > > On Tue, Dec 1, 2020 at 9:27 PM ragul rangarajan <ragulrangara...@gmail.com> > wrote: > >> Hi all, >> >> https://issues.apache.org/jira/browse/AMQ-8026 >> Interested to have an update on the above ticket. Does anyone have a >> tentative release date for 5.17.0? >> >> Sry to create a separate thread. Unable to continue on the below thread. >> >> http://activemq.2283324.n4.nabble.com/Need-spring-upgrade-in-ActiveMQ-tc4759365.html >> >> Regards >> Ragul >> >> On Mon, Nov 9, 2020 at 1:24 PM ragul rangarajan <ragulrangara...@gmail.com> >> wrote: >> >>> Hi all, >>> >>> I am using apache ActiveMQ with the Spring framework. >>> >>> Where we now trying to upgrade spring to 5.2 latest since its older >>> releases reach the end of life. >>> >>> While upgrading spring, we got stuck with below exception. >>> >>> >>> 2020-10-22 15:48:54,094 | ERROR | Failed to load: class path resource >>> [activemq.xml], reason: Error creating bean with name 'statusService' >>> defined in class path resource [activemq.xml]: Initialization of bean >>> failed; nested exception is java.lang.NoSuchMethodError: >>> org.springframework.core.annotation.AnnotationUtils.isCandidateClass(Ljava/lang/Class;Ljava/lang/Class;)Z >>> | org.apache.activemq.xbean.XBeanBrokerFactory | main2020-10-22 >>> 15:48:54,094 | ERROR | Failed to load: class path resource [activemq.xml], >>> reason: Error creating bean with name 'statusService' defined in class path >>> resource [activemq.xml]: Initialization of bean failed; nested exception is >>> java.lang.NoSuchMethodError: >>> org.springframework.core.annotation.AnnotationUtils.isCandidateClass(Ljava/lang/Class;Ljava/lang/Class;)Z >>> | org.apache.activemq.xbean.XBeanBrokerFactory | >>> mainorg.springframework.beans.factory.BeanCreationException: Error creating >>> bean with name 'statusService' defined in class path resource >>> [activemq.xml]: Initialization of bean failed; nested exception is >>> java.lang.NoSuchMethodError: >>> org.springframework.core.annotation.AnnotationUtils.isCandidateClass(Ljava/lang/Class;Ljava/lang/Class;)Z >>> at >>> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:562)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:481)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:312)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:308)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:757)[spring-beans-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:867)[spring-context-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:542)[spring-context-4.3.26.RELEASE.jar:4.3.26.RELEASE] >>> at >>> org.apache.xbean.spring.context.ResourceXmlApplicationContext.<init>(ResourceXmlApplicationContext.java:64)[xbean-spring-4.17.jar:4.17] >>> at >>> org.apache.xbean.spring.context.ResourceXmlApplicationContext.<init>(ResourceXmlApplicationContext.java:52)[xbean-spring-4.17.jar:4.17] >>> at >>> org.apache.activemq.xbean.XBeanBrokerFactory$1.<init>(XBeanBrokerFactory.java:104)[activemq-spring-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.xbean.XBeanBrokerFactory.createApplicationContext(XBeanBrokerFactory.java:104)[activemq-spring-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.xbean.XBeanBrokerFactory.createBroker(XBeanBrokerFactory.java:67)[activemq-spring-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.broker.BrokerFactory.createBroker(BrokerFactory.java:71)[activemq-broker-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.broker.BrokerFactory.createBroker(BrokerFactory.java:54)[activemq-broker-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.console.command.StartCommand.runTask(StartCommand.java:87)[activemq-console-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.console.command.AbstractCommand.execute(AbstractCommand.java:63)[activemq-console-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.console.command.ShellCommand.runTask(ShellCommand.java:154)[activemq-console-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.console.command.AbstractCommand.execute(AbstractCommand.java:63)[activemq-console-5.16.0.jar:5.16.0] >>> at >>> org.apache.activemq.console.command.ShellCommand.main(ShellCommand.java:104)[activemq-console-5.16.0.jar:5.16.0] >>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)[:1.8.0_242] >>> at >>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)[:1.8.0_242] >>> at >>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)[:1.8.0_242] >>> at java.lang.reflect.Method.invoke(Method.java:498)[:1.8.0_242] at >>> org.apache.activemq.console.Main.runTaskClass(Main.java:262)[activemq.jar:5.16.0] >>> at >>> org.apache.activemq.console.Main.main(Main.java:115)[activemq.jar:5.16.0] >>> >>> On further debugging, able to see below change is made in spring since >>> 5.2 and it expects the same from ActiveMQ on runtime but which fails due to >>> the spring 4.3.26 reference. >>> >>> >>> https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/AnnotationUtils.html#isCandidateClass-java.lang.Class-java.lang.Class >>> >>> *Replacing the old spring jar with new makes to bypass the issue. But >>> don't know the impact of changing the dependency manually.* >>> >>> Can you please upgrade the spring? >>> >>> Raised same as ticket https://issues.apache.org/jira/browse/AMQ-8058 >>> >>> >>> *Thanks and Regards,* >>> >>> *Ragul* >>> >>
