[ovirt-devel] Re: Jackson-databind related changes

Hi, oVirt Engine is using JBoss Modules feature to load libraries, so when a library version is mentioned in pom.xml it's unrelated to which version is being using during runtime. Here's the detailed description: 1. jackson-databind 2.12.7 mentioned pom.xml is actually being used only when building the project directly with maven (development purposes) https://github.com/oVirt/vdsm-jsonrpc-java/blob/master/pom.xml.in#L61 https://github.com/oVirt/vdsm-jsonrpc-java/blob/master/client/pom.xml.in 2. When building the project as a part of RPM build, then maven (respectively xmvn) is invoked to use only libraries installed locally as a part of RPM dependencies https://github.com/oVirt/vdsm-jsonrpc-java/blob/master/vdsm-jsonrpc-java.... So on CS8 we can easily find out the jackson-databind package version being used during RPM build # dnf repoquery --whatprovides 'jackson-databind >= 2.10.0' jackson-databind-0:2.10.0-1.module_el8.4.0+595+e59c9af2.noarch jackson-databind-0:2.10.0-1.module_el8.4.0+782+1d1c31a0.noarch 3. On runtime vdsm-jsonrpc-java is being loaded using JBoss Modules as a part of oVirt Engine: https://github.com/oVirt/ovirt-engine/blob/master/backend/manager/depende... which shows that vdsm-jsonrpc-java depends on com.fasterxml.jackson.core.jackson-databind module, which is included in the relevant WildFly release. Currently oVirt Engine is using WildFly 24.0.1, so you can see jackson-databind version using following command: # rpm -ql ovirt-engine-wildfly | grep 'jackson-databind-' /usr/share/ovirt-engine-wildfly/modules/system/layers/base/com/fasterxml/jackson/core/jackson-databind/main/jackson-databind-2.12.3.jar So if you want to bump jackson-databind version for oVirt Engine runtime you have two possibilities: 1. You can deliver updated JBoss module as a part of ovirt-engine-wildfly-overlay RPM: https://github.com/oVirt/ovirt-engine-wildfly/overlay 2. You can try to bump WildFly to latest version in ovirt-engine-wildfly RPM: https://github.com/oVirt/ovirt-engine-wildfly/ Please be awate that at the moment it's not possible to use latest WildFly version, because oVirt Engine is using classic security model, which was removed in favor of Elytron in WildFly 25. So to bump WildFly version, you would need to implement changes in oVirt Engine to use Elytron. Regarding verification the best way is to verify functionality by execution of oVirt System Tests: https://github.com/ovirt/ovirt-system-tests Regards, Martin On Thu, Sep 14, 2023 at 11:44 PM Shubha Kulkarni <shubha.kulkarni(a)oracle.com&gt; wrote: -- Martin Perina Manager, Software Engineering Red Hat Czech s.r.o.