Upgrade Jakarta EL impl to 3.0.4

[gsmet]

Fixes #20274

It fixes a CVE so probably something to consider for 2.2.

[famod]

Should we add it to dependabot?

[quarkus-bot]

This workflow status is outdated as a new workflow run has been triggered.

Failing Jobs - Building 7e6ed6d

Status	Name	Step	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 11
✖	JVM Tests - JDK 11 Windows	Build	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 17

Full information is available in the Build summary check run.

Failures

⚙️ JVM Tests - JDK 11 Windows #

- Failing: extensions/vertx-http/deployment 
! Skipped: core/test-extension/deployment docs extensions/agroal/deployment and 286 more

📦 extensions/vertx-http/deployment

✖ io.quarkus.vertx.http.testrunner.QuarkusTestTypeTestCase.testQuarkusTestMode - More details - Source on GitHub

java.lang.RuntimeException: java.lang.RuntimeException: java.lang.RuntimeException: Failed to start quarkus
	at io.quarkus.test.QuarkusDevModeTest.beforeEach(QuarkusDevModeTest.java:259)
	at org.junit.jupiter.engine.descriptor.TestMethodTestDescriptor.lambda$invokeBeforeEachCallbacks$2(TestMethodTestDescriptor.java:163)

✖ io.quarkus.vertx.http.testrunner.TestChangeTrackingWhenStartFailsTestCase.testChangeTrackingOnStartupFailure line 40 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <2> but was: <1>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.TestFailingBeforeAllTestCase.testBrokenBeforeAllHandling line 41 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <1> but was: <0>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.TestRunnerSmokeTestCase.checkTestsAreRun line 45 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <1> but was: <0>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.brokenonly.TestBrokenOnlyTestCase.testBrokenOnlyMode line 43 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <1> but was: <0>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.includes.ExcludePatternTestCase.checkTestsAreRun line 42 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <0> but was: <1>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.includes.IncludePatternTestCase.checkTestsAreRun line 43 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <0> but was: <1>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.metaannotations.MetaAnnotationsTestCase.checkTestsAreRun line 42 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <0> but was: <1>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.params.TestParameterizedTestCase.testParameterizedTests line 42 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <4> but was: <0>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.tags.ExcludeTagsTestCase.checkTestsAreRun line 41 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <0> but was: <1>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

✖ io.quarkus.vertx.http.testrunner.tags.IncludeTagsTestCase.checkTestsAreRun line 42 - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <0> but was: <1>
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:55)
	at org.junit.jupiter.api.AssertionUtils.failNotEqual(AssertionUtils.java:62)

[gsmet]

We could but we will need to ignore all the new major versions.

[sberyozkin]

@gsmet OK, let me update the dependabot rule

[sberyozkin]

Hmm, is it dependency-name: org.glassfish:jakarta-el:3.x or

ignore:
      - dependency-name: "org.glassfish:jakarta-el"
        update-types: ["version-update:semver-major"]

?
ignore section seems the way to go

https://github.blog/changelog/2021-05-21-dependabot-version-updates-can-now-ignore-major-minor-patch-releases/

[sberyozkin]

Hey @geoand can you check my last comment please ?

[geoand]

Oh sorry, I missed that!

[sberyozkin]

@geoand np :-), I'll add the ignore section, 1 sec

[geoand]

I let you folks figure it out. I just need to have this merged by tonight if it's going to be part of 2.3.0.Final

[sberyozkin]

@geoand done :-), if that does not work then we'll make sure the major version is not merged in any case, Guillaume, we won't let 4.x.x in :-)

[gsmet]

When Dependabot pushes the update, you can add a comment with something like "ignore this major version" (not exactly sure it's the right wording but the help is available in the Dependabot PR).

[sberyozkin]

Sound good

[quarkus-bot]

Failing Jobs - Building 054f550

Status	Name	Step	Failures	Logs	Raw logs
⌛	JVM Tests - JDK 11	Build	⚠️ Check →	Logs	Raw logs
✔️	JVM Tests - JDK 17

[sberyozkin]

There was a single JVM JDK 11 failure,

2021-09-28T19:45:27.0795401Z [INFO] Running io.quarkus.it.amqp.AmqpConnectorTest
2021-09-28T19:45:32.2405183Z ##[error]The operation was canceled.
2021-09-28T19:45:32.2991572Z ##[group]Run actions/upload-artifact@v2....

Which is not related, I could not see anything else, so let me merge