[JCRVLT-640] RCP bundle: Get rid of some Sling dependencies

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.6.4
• Assignee: Konrad Windszus
• Reporter: Konrad Windszus
• Created: 24/Jun/22 13:41
• Updated: 19/Sep/22 09:46
• Resolved: 24/Jun/22 16:54

Description

The RCP bundle should not depend on any Sling bundles. This would also fix the vulnerability issue currently detected in Sling API failing the build:

One or more dependencies were identified with known vulnerabilities in Apache Jackrabbit FileVault RCP Server Bundle:

org.apache.sling.api-2.16.4.jar (pkg:maven/org.apache.sling/org.apache.sling.api@2.16.4, cpe:2.3:a:apache:sling:2.16.4:*:*:*:*:*:*:*, cpe:2.3:a:apache:sling_api:2.16.4:*:*:*:*:*:*:*) : CVE-2022-32549

(https://ci-builds.apache.org/blue/organizations/jenkins/Jackrabbit%2Ffilevault/detail/master/135/pipeline)

Issue Links

• links to: GitHub Pull Request #232