security vulnerability:update of org.eclipse.jetty

[mbiarnes]

GitHub: potential security vulnerabilities in dependencies

[mbiarnes]

found org.eclipse.jetty in following reps:
droolsjbpm-integration
jbpm-work-items

[mareknovotny]

Jenkins execute full downstream build

[mareknovotny]

we use jetty as a test container only with exceptions to jbpm-work-items google's modules which can bundle/depends on some jetty, @tsurdilo can you review this upgrade?

@mbiarnes affected tests are the following:

• https://github.com/kiegroup/droolsjbpm-integration/blob/master/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/KieServerHttpRequestTest.java
• https://github.com/kiegroup/droolsjbpm-integration/blob/master/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/ServerTestCase.java
• https://github.com/kiegroup/jbpm-work-items//blob/master/repository/src/test/java/org/jbpm/process/workitem/repository/HostedRepositoryIntegrationTest.java

If they are green here in CI I think we can merge it

[mareknovotny]

Jenkins execute full downstream build

[mbiarnes]

@mareknovotny three test failed
org.kie.server.common.rest.KieServerHttpRequestTest.getWithResponseCharset
org.kie.server.common.rest.KieServerHttpRequestTest.numberHeader
org.kie.wb.selenium.ui.ProjectLibraryIntegrationTest.importAndBuildProjectFromStockRepository
the selenium one fails in each FDB - the other two has to be looked at

[mareknovotny]

@mbiarnes ok, so test source code need a fix for the upgrade.

[mbiarnes]

Jenkins execute full downstream build

[mareknovotny]

I looked at jetty issues, and it seems the Charset can be in different letter case in 9.x see https://bugs.eclipse.org/bugs/show_bug.cgi?id=414449 so we can fix it like in my change here mareknovotny/droolsjbpm-integration@55baa10 or find the version it is fixed. Unfortunately that bugzilla is referencing only the commit hash so I need to look for it in git repository

[mbiarnes]

#989
kiegroup/droolsjbpm-integration#1891

[mbiarnes]

Jenkins execute full downstream build

[mareknovotny]

so there is keeping org.kie.server.common.rest.KieServerHttpRequestTest.numberHeader failing, looking at that

[mbiarnes]

Jenkins execute full downstream build

[mareknovotny]

jetty vulnerability is not applicable here as we use it mainly for CI tests. And we don't have a motivation to solve the test failures in newer jetty version