Exclude Apache CXF dependency from kvm plugin

[sudo87]

Description

Excludes Apache CXF (cxf-rt-frontend-jaxrs, and transitively cxf-core/cxf-rt-transports-http) from the KVM hypervisor plugin's bundled runtime dependencies, removing the CVE-2026-49875 / CVE-2026-50623 / CVE-2026-50633 / CVE-2026-50634 exposure on KVM agent hosts.

rebase of #13756

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

1. Dependency tree check: confirms CXF is no longer resolved for the KVM plugin module:
   mvn dependency:tree -pl plugins/hypervisors/kvm -Dincludes=org.apache.cxf
   output is empty after the fix

2. Build artifact check: confirms no CXF jars are copied into the agent's dependency bundle
   ls plugins/hypervisors/kvm/target/dependencies | grep -i cxf
   no result

How did you try to break this feature and the system with this change?

[sudo87]

@blueorangutan package

[blueorangutan]

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

[DaanHoogland]

clgtm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.26%. Comparing base (549daae) to head (2e92088).

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #13799      +/-   ##
============================================
- Coverage     16.26%   16.26%   -0.01%     
+ Complexity    13434    13433       -1     
============================================
  Files          5667     5667              
  Lines        500731   500731              
  Branches      60803    60803              
============================================
- Hits          81455    81448       -7     
- Misses       410172   410178       +6     
- Partials       9104     9105       +1     

Flag	Coverage Δ
uitests	4.14% <ø> (ø)
unittests	17.12% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18777

[DaanHoogland]

@blueorangutan test ol9 kvm-ol9

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol9 mgmt + kvm-ol9) has been kicked to run smoke tests

[DaanHoogland]

@blueorangutan test ol10 kvm-ol10

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol10 mgmt + kvm-ol10) has been kicked to run smoke tests

[blueorangutan]

[SF] Trillian Build Failed (tid-16719)