Skip to content

Bump org.glassfish.main.extras:glassfish-embedded-all from 7.0.25 to 7.1.1 - #1666

Open
dependabot[bot] wants to merge 1 commit into
wicket-9.xfrom
dependabot/maven/wicket-9.x/org.glassfish.main.extras-glassfish-embedded-all-7.1.1
Open

Bump org.glassfish.main.extras:glassfish-embedded-all from 7.0.25 to 7.1.1#1666
dependabot[bot] wants to merge 1 commit into
wicket-9.xfrom
dependabot/maven/wicket-9.x/org.glassfish.main.extras-glassfish-embedded-all-7.1.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps org.glassfish.main.extras:glassfish-embedded-all from 7.0.25 to 7.1.1.

Release notes

Sourced from org.glassfish.main.extras:glassfish-embedded-all's releases.

7.1.1

Eclipse GlassFish is an application server, implementing Jakarta EE. This release is corresponding with the Jakarta EE 10 specification, which is a major feature release. Jakarta EE 10 requires JDK 11 as a minimum, but also officially works on JDK 17 and JDK 21.

GlassFish 7.1.0 is a final release, containing final Jakarta EE 10 APIs. It compiles and runs on JDK 17 to JDK 25.

Since version 7.1.1, the GlassFish 7.1.x branch is in active maintenance mode, getting applicable fixes and improvements from the main branch, while active development focuses on the main GlassFish 8.x branch.

Release overview

This update fixes known vulnerabilities and some regressions introduced in GlassFish 7.1.0. It backports most of the applicable fixes and improvements from GlassFish 8.0.2 and some from 8.0.3, including the fix of a memory leak in Jersey and a performance improvement for Jakarta Faces rendering.

What's Changed

Security Fixes

  • Fixes CVE-2026-24457 9.8 CRITICAL - An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server
  • Fixes CVE-2026-2586 9.1 CRITICAL - A critical Remote Code Execution (RCE) vulnerability in Admin Console
  • Fixes CVE-2026-2587 9.6 CRITICAL - An authenticated Remote Code Execution (RCE) vulnerability in Admin Console
  • Fixes CVE-2020-27511 - HIGH, 7.5 - Upgrade Woodstock to 6.0.3 with a security fix for prototype
  • Not exploitable by CVE-2022-46337 CRITICAL, 9.8. GlassFish not affected because bundled Derby DB does not authenticate database users via LDAP

Improvements

Bug Fixes

Component Upgrades

... (truncated)

Changelog

Sourced from org.glassfish.main.extras:glassfish-embedded-all's changelog.

Releasing a new GlassFish version

In this example we assume 7.1.0. If any step failed, you have to resolve the issue and start from the appropriate step again.

  1. Create a release branch RELEASE_7.1.0 and push it to the Eclipse GlassFish Github repository.
  2. Open glassfish-release
  3. Click Build with parameters in menu.
    • releaseVersion = 7.1.0
    • nextVersion = 7.1.1-SNAPSHOT
    • click [Build] button.
  4. Wait for it to finish successfully
  5. Verify that everything was done:
    1. Verify that the deployment is present in Maven Central Deployments
      • It is possible that you will not have permissions to visit the namespace. Ask project leads or check if expected artifacts made it to Maven Central, then this was obviously successful.
    2. Verify that a new 7.1.0 tag was created.
    3. Verify that the release branch changed the number to the nextVersion value.
  6. Create a Draft PR based on this branch.
  7. Find the Glassfish Full Profile Distribution on the page of the release build under glassfish-release and copy the URL of the zip file.
  8. Run the TCKs against the result artifact - alternatively you can deploy to Maven Central Snapshots using glassfish-deploy-snapshots and refer zip from the build or from Maven Central Snapshots (same file). As another alternative you can run the TCK on any other infrastructure.
    1. Run the platform TCK
    2. Run the standalone TCK
  9. Create the release on Github: click "Draft a new release"
  10. Create the release on Eclipse: ["Create a new release"](https://projects.eclipse.org/projects/ee4j.glassfish click)
  11. If it is a version with important feature changes, ask for a release review. Remember that it will take more than week.
  12. Create the release on Glassfish.org. Do a PR for the master branch with:
  13. Open Maven Central Deployments and click the Publish button. Maven Central then distributes artifacts so they will become reachable to anyone referring Maven Central Repository.
  14. Verify that it's present in Maven Central (usually takes few minutes now)
  15. Upload the new release to the Eclipse download folder. Go to glassfish-copy-to-downloads
    • Enter the version to copy; 7.1.0
    • click [Build] button
  16. If everything is OK, then merge the PR.

... (truncated)

Commits
  • 8e05816 Prepare release 7.1.1
  • fb0c86c Don't wrap the exception again
  • e2506d7 Fixed masterpassword - even if not set, we need at least changeit
  • 79dfb2c create-domain: Give error if keystore already exists in the template
  • e068499 Fix create-domain with a custom master password
  • 3ee4995 Merge pull request #26131 from eclipse-ee4j/backport7x
  • 23385c8 Merge remote-tracking branch 'eclipse/7.0' into backport7x
  • 86368e7 Merge commit '1efafacaae1418e56ae10919c3c89f1f3d8b3ccd' into backport7x
  • 0584c17 Merge pull request #26129 from eclipse-ee4j/RELEASE_7026
  • a9f9b33 Updated version to 7.0.27-SNAPSHOT
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump org.glassfish.main.extras:glassfish-embedded-all
444f841 
Bumps [org.glassfish.main.extras:glassfish-embedded-all](https://github.com/eclipse-ee4j/glassfish) from 7.0.25 to 7.1.1.
- [Release notes](https://github.com/eclipse-ee4j/glassfish/releases)
- [Changelog](https://github.com/eclipse-ee4j/glassfish/blob/7.1.1/RELEASE.md)
- [Commits](eclipse-ee4j/glassfish@7.0.25...7.1.1)

---
updated-dependencies:
- dependency-name: org.glassfish.main.extras:glassfish-embedded-all
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 30, 2026

This branch had an error being deployed

1 failed deployment
CI_DEPLOY — 444f8414 Deployed Oct 30, 2026 by dependabot[bot] via Java 11 Test #1933
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants