From c437e9b4f517cf6c0aeb8b9c8a2e10a1085731ab Mon Sep 17 00:00:00 2001
From: Stian Sandvold <stian@dhis2.org>
Date: Sun, 31 May 2026 12:38:34 +0200
Subject: [PATCH] chore(deps): bump artemis-jakarta 2.44.0 to 2.54.0 and
 migrate groupId to org.apache.artemis

Artemis moved to its own Apache top-level project and migrated its Maven
groupId from org.apache.activemq to org.apache.artemis as of 2.50.0. The
old coordinates are now relocation stubs, so bumping the version alone makes
dependency:analyze fail (declared org.apache.activemq:* vs resolved
org.apache.artemis:*). This updates the groupId at all declarations and the
analyze ignore entries.

Also fixes CVE-2026-27446 (missing authentication in Core protocol
federation), which affects Artemis 2.11.0-2.44.0 and is fixed in 2.52.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 dhis-2/dhis-services/dhis-service-event-hook/pom.xml |  2 +-
 dhis-2/dhis-support/dhis-support-artemis/pom.xml     |  4 ++--
 dhis-2/pom.xml                                       | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/dhis-2/dhis-services/dhis-service-event-hook/pom.xml b/dhis-2/dhis-services/dhis-service-event-hook/pom.xml
index 8f1cc95146c8..6bf6d0135af0 100644
--- a/dhis-2/dhis-services/dhis-service-event-hook/pom.xml
+++ b/dhis-2/dhis-services/dhis-service-event-hook/pom.xml
@@ -83,7 +83,7 @@
       <artifactId>jsr305</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.apache.activemq</groupId>
+      <groupId>org.apache.artemis</groupId>
       <artifactId>artemis-jakarta-client</artifactId>
     </dependency>
     <dependency>
diff --git a/dhis-2/dhis-support/dhis-support-artemis/pom.xml b/dhis-2/dhis-support/dhis-support-artemis/pom.xml
index a2464177c403..661212e83f67 100644
--- a/dhis-2/dhis-support/dhis-support-artemis/pom.xml
+++ b/dhis-2/dhis-support/dhis-support-artemis/pom.xml
@@ -46,11 +46,11 @@
       <artifactId>jsr305</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.apache.activemq</groupId>
+      <groupId>org.apache.artemis</groupId>
       <artifactId>artemis-jakarta-server</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.apache.activemq</groupId>
+      <groupId>org.apache.artemis</groupId>
       <artifactId>artemis-jakarta-client</artifactId>
     </dependency>
 
diff --git a/dhis-2/pom.xml b/dhis-2/pom.xml
index 894509cd6e3b..dac2672be9e5 100644
--- a/dhis-2/pom.xml
+++ b/dhis-2/pom.xml
@@ -173,7 +173,7 @@
     <jts.version>1.20.0</jts.version>
 
     <!-- Apache Artemis -->
-    <artemis-jakarta.version>2.44.0</artemis-jakarta.version>
+    <artemis-jakarta.version>2.54.0</artemis-jakarta.version>
     <netty-all.version>4.2.13.Final</netty-all.version>
     <classgraph.version>4.8.184</classgraph.version>
 
@@ -1438,12 +1438,12 @@
 
       <!-- Apache Artemis -->
       <dependency>
-        <groupId>org.apache.activemq</groupId>
+        <groupId>org.apache.artemis</groupId>
         <artifactId>artemis-jakarta-client</artifactId>
         <version>${artemis-jakarta.version}</version>
       </dependency>
       <dependency>
-        <groupId>org.apache.activemq</groupId>
+        <groupId>org.apache.artemis</groupId>
         <artifactId>artemis-jakarta-server</artifactId>
         <version>${artemis-jakarta.version}</version>
         <exclusions>
@@ -2162,7 +2162,7 @@ jasperreports.version=${jasperreports.version}
               <ignoredUnusedDeclaredDependency>org.hisp.dhis:dhis-web-commons</ignoredUnusedDeclaredDependency>
               <ignoredUnusedDeclaredDependency>org.hisp.dhis:dhis-web-dataentry</ignoredUnusedDeclaredDependency>
               <ignoredUnusedDeclaredDependency>org.hisp.dhis:dhis-web-approval</ignoredUnusedDeclaredDependency>
-              <ignoredUnusedDeclaredDependency>org.apache.activemq:artemis-jakarta-server</ignoredUnusedDeclaredDependency>
+              <ignoredUnusedDeclaredDependency>org.apache.artemis:artemis-jakarta-server</ignoredUnusedDeclaredDependency>
             </ignoredUnusedDeclaredDependencies>
             <ignoredUsedUndeclaredDependencies>
               <ignoredUsedUndeclaredDependency>javax.cache:cache-api:jar</ignoredUsedUndeclaredDependency>
@@ -2171,14 +2171,14 @@ jasperreports.version=${jasperreports.version}
               <ignoredUsedUndeclaredDependency>org.antlr:antlr4-runtime</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>org.junit.jupiter:junit-jupiter-api</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>io.prometheus:simpleclient</ignoredUsedUndeclaredDependency>
-              <ignoredUsedUndeclaredDependency>org.apache.activemq:artemis-commons</ignoredUsedUndeclaredDependency>
+              <ignoredUsedUndeclaredDependency>org.apache.artemis:artemis-commons</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>org.apache.kafka:connect-api</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>io.prometheus:simpleclient_common</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>org.springframework:spring-jcl</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>ognl:ognl</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>org.springframework.session:spring-session-core</ignoredUsedUndeclaredDependency>
               <ignoredUsedUndeclaredDependency>jakarta.jms:jakarta.jms-api</ignoredUsedUndeclaredDependency>
-              <ignoredUsedUndeclaredDependency>org.apache.activemq:artemis-server</ignoredUsedUndeclaredDependency>
+              <ignoredUsedUndeclaredDependency>org.apache.artemis:artemis-server</ignoredUsedUndeclaredDependency>
               <ignoredUnusedDeclaredDependency>org.mock-server:mockserver-core:jar</ignoredUnusedDeclaredDependency>
             </ignoredUsedUndeclaredDependencies>
             <ignoredNonTestScopedDependencies>