[26.x][WFLY-16829] Upgrade Apache cxf to 3.4.8

[boris-unckel]

Fixes https://issues.redhat.com/browse/WFLY-16829

Upstream

1. [WFLY-16302] Upgrade Apache cxf to 3.5.2 #15467 (3.5.2)
2. 61c1db9#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8 (3.5.2-jbossorg)
3. 78d2a0f (3.5.2-jbossorg-1)

[boris-unckel]

Please find all links to release notes, git tags, github-diff in the Jira.

[jimma]

@boris-unckel Thanks for the PR, again! I'll look at the tck result before this upgrade. Can you please give me some time to have a tck check locally for this version ?

[boris-unckel]

@jimma It seems there is a deadline for WF26x: #15962 (comment)

[bstansberry]

It is unlikely we'd include this one in 26.1.2. A CXF upgrade is a pretty large thing to do at the last minute and the change log doesn't show anything particularly critical.

[boris-unckel]

@bstansberry I don't consider this one critical CXF-7996 Jakarta EE TCKs and compatibility but there is a long list of fixes behind. They have been solved incremental (previous versions contain fixes, too) and the work has been finalized in this minor.

[jimma]

• @boris-unckel I've gone through all the commits in CXF 3.4.8. These two commits are we need to have a fully tck test , especially the first one :

• apache/cxf@bb4d26f

• apache/cxf@0d586e4

Except these two changes, there are all related to jaxrs change , component upgrade and test fix.

[bstansberry]

• @boris-unckel I've gone through all the commits in CXF 3.4.8. These two commits are we need to have a fully tck test , especially the first one :
• apache/cxf@bb4d26f

This caused a regression, to be fixed in 3.4.9:

https://issues.apache.org/jira/browse/CXF-8733

• apache/cxf@0d586e4

This is an Improvement, not a bug fix.

https://issues.apache.org/jira/browse/CXF-8699

Except these two changes, there are all related to jaxrs change , component upgrade and test fix.

[boris-unckel]

@jimma @bstansberry Thanks for time investigating this. It seems this has not enough benefit for the release. Even downstream I would wait for 3.4.9.