Use Jetty 12.1.10 instead of 11.0.26, due to multiple 3rd party vulnerabilities in 11.0.26

Current Situation

Current JS7 JOC Cockpit versions 2.8.4 and 2.7.9 ship with Eclipse Jetty 11.0.26. This version is flagged with multiple vulnerabilities.

The vulnerable components are:

• Jetty (used jetty-home 11.0.26)
  • jetty-http 11.0.26
    • CVE-2025-11143, CVE-2026-2332
  • http2-common 11.0.26
    • CVE-2025-1948
• used 3rd parties of jetty-home 11.0.26
  • netty-handler 4.1.58.Final
    • CVE-2021-21290, CVE-2023-34462, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010
  • netty-codec 4.1.58.Final
    • CVE-2021-37136, CVE-2021-37137, CVE-2022-41915, CVE-2025-58057, CVE-2026-42583
  • netty-common 4.1.58.Final
    • CVE-2021-21290, CVE-2024-47535
  • netty-transport-native-epoll 4.1.58.Final
    • CVE-2026-45536
  • infinispan-core 11.0.19.Final
    • CVE-2025-0736
  • infinispan-client-hotrod 11.0.19.Final
    • CVE-2023-4586
  • wildfly-elytron 1.12.1.Final
    • CVE-2021-3642, CVE-2022-3143, CVE-2024-1233
  • wildfly-elytron-mechanism-scram 1.12.1.Final
    • CVE-2021-3642
  • wildfly-elytron-realm-token 1.12.1.Final
    • CVE-2024-1233
  • avro 1.7.6
    • CVE-2023-39410, CVE-2024-47561, CVE-2025-33042
  • jackson-mapper-asl 1.9.13
    • CVE-2017-7525, CVE-2019-10172, CVE-2019-10202
• No publicly available fixed 11.0.x version is supported by the vendor.

Desired Behavior

The new JS7 JOC Cockpit version 2.9.0 should use Jetty version 12.1.10 that resolves the issues.