Update Tomcat to a version >= 10.1.25 and >= 9.0.90

[tasso94]

Acceptance Criteria (Required on creation)

Update Tomcat to a version >= 10.1.25 and >= 9.0.90

Hints

Links

• https://jira.camunda.com/browse/SEC-1122
• https://jira.camunda.com/browse/SEC-1067
• https://jira.camunda.com/browse/SUPPORT-23160

Breakdown

Pull Requests

Preview Give feedback

1. Main PR: chore(deps): bump tomcat to versions 9.0.90 and 10.1.25 #4534
2. 7.21: https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1268
3. 7.20: https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1269
4. 7.19: https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1270

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment

[joaquinfelici]

Hints for review

Hey @mboskamp

Fixes:

7.22

• bumped spring-boot version for parent (used by both run and spring-boot-stater) from 3.3.0 to 3.3.1 (uses tomcat 10.1.25)
• bumped tomcat version in parent from 9.0.89 to 9.0.90

7.21

• bumped spring-bootversion for parent (used byspring-boot-starter) from 3.2.6 to 3.2.7 (uses tomcat 10.1.25)
• bumped spring-boot version for run from 3.3.0 to 3.3.1 (uses tomcat 10.1.25)
• bumped tomcat version in parent from 9.0.89 to 9.0.90

7.20

• bumped spring-boot version for run from 3.2.6 to 3.2.7 (uses tomcat 10.1.25)
• kept old spring-boot version (3.1.12 that uses tomcat 10.1.24) in parent but overrode tomcat version in spring-boot-starter to 10.1.25 for tomcat dependencies
• bumped tomcat version in parent from 9.0.89 to 9.0.90

7.19

• bumped tomcat version in parent from 9.0.89 to 9.0.90
• kept old spring-boot version in parent (2.7.18 that uses tomcat 9.0.83) but:
• for spring-boot-starter, tomcat dependencies versions are already overridden with this property (see here)
• same for run (see here)

Note: This may not be 100% ready for merge but this needs to be delivered in next patch so I'd rather you take a look at it while I'm off. Thank you!

[mboskamp]

@joaquinfelici, I added some suggestions to the PRs.
Could you set the correct backport version labels on this issue?

[joaquinfelici]

Hey @mboskamp , I applied your suggestions. The labels for the backport versions were already correctly set for next patch (end of august).

[mboskamp]

Hi @joaquinfelici, thanks for implementing the suggestions.

What do you think about the CI failures (Distro EE)? This stage does not fail on the 7.21 and 7.20 branches. Maybe you can solve it by rebasing your PRs.

The version labels have the potential prefix. We are committed to delivering this change with the mentioned versions. In that case, we need the version:x.y.z etc. labels (e.g. version:7.19.15).

[joaquinfelici]

Hey @mboskamp , I rebased and all jobs are green now, thanks.
And indeed for the labels, just changed them. Please review https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1268.