Skip to content

Conversation

@rkoelbel
Copy link
Contributor

No description provided.

@Flohack74
Copy link

@rkoelbel and me are building a software test application in C# that currently utilizes both Apache.NMS.ActiveMQ and Apache.NMS.AMQP Nuget packages, which in turn rely on the Apache.NMS package.

As published on Oct 16th there is now a CVE that basically demands upgrade of AMQP to 2.4.0, which bumps Apache.NMS to 2.2.0 - unfortunately that breaks ActiveMQ since it cannot handle interface changes introduced there. It can only work with version 2.0.0 despite specifying >=2.0.0 in its version constraints.

This PR bumps Apache.NMS and implements the breaking changes in a way we think is sufficient.

@McMlok
Copy link

McMlok commented Oct 29, 2025

I'm in the same situation. I want to bump AMQP but cannot because it breaks OpenWire (ActiveMQ) connection factory.

@jbertram
Copy link

@Havret, can you take a look at this?

@Havret
Copy link
Contributor

Havret commented Oct 29, 2025

@jbertram yes, I will take a look over the weekend.

@Havret
Copy link
Contributor

Havret commented Nov 2, 2025

This will require a bit more work. Besides the red tape (JIRA, proper commit names, etc.), we need to actually implement the async listener and an option to customize acknowledgment behavior for expired messages via IRedeliveryPolicy. That’s something I had on my radar but had to postpone because of other obligations. I’ll take over this PR and try to finish it up this week.

@rkoelbel
Copy link
Contributor Author

rkoelbel commented Nov 3, 2025

Thanks so much for the feedback! Sorry I didn’t get everything quite right. Really appreciate you taking it over, and I’m happy to help out however I can!

@Flohack74
Copy link

@Havret as Roland said, we are very grateful for the support. We currently decided to postpone our patch by 2 weeks therefore. If you think that it will take longer, please let me know so that I can actually release the current patch and we bite the bullet to ship another hotfix later then. Thanks!

@Havret
Copy link
Contributor

Havret commented Nov 11, 2025

@michaelandrepearce @lukeabsent Could you guys please take a look?

@lukeabsent
Copy link
Contributor

+1 seems ok

@Havret Havret merged commit 4550baa into apache:main Nov 17, 2025
1 check passed
@Flohack74
Copy link

Great to see that has been merged Any idea when this can go into a release? ;)

@Havret
Copy link
Contributor

Havret commented Nov 24, 2025

@Flohack74 I’ve started the vote for the v2.2.0 release.

Here is the thread: https://lists.apache.org/thread/s57no2vq7lj8qf9k8qg5ldf6xqf294yf

Please feel free to vote to help expedite the process.

@Havret
Copy link
Contributor

Havret commented Nov 27, 2025

@Flohack74 @rkoelbel the new version was released.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants