Exclude Apache CXF dependency from kvm hypervisor plugin

[sudo87]

Description

Excludes Apache CXF (cxf-rt-frontend-jaxrs, and transitively cxf-core/cxf-rt-transports-http) from the KVM hypervisor plugin's bundled runtime dependencies, removing the CVE-2026-49875 / CVE-2026-50623 / CVE-2026-50633 / CVE-2026-50634 exposure on KVM agent hosts.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

1. Dependency tree check: confirms CXF is no longer resolved for the KVM plugin module:
   mvn dependency:tree -pl plugins/hypervisors/kvm -Dincludes=org.apache.cxf
   output is empty after the fix

2. Build artifact check: confirms no CXF jars are copied into the agent's dependency bundle
   ls plugins/hypervisors/kvm/target/dependencies | grep -i cxf
   no result

How did you try to break this feature and the system with this change?

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 17.69%. Comparing base (0339f31) to head (64254e7).

Additional details and impacted files

@@             Coverage Diff              @@
##               4.22   #13756      +/-   ##
============================================
- Coverage     17.69%   17.69%   -0.01%     
  Complexity    15833    15833              
============================================
  Files          5925     5925              
  Lines        533534   533534              
  Branches      65273    65273              
============================================
- Hits          94421    94416       -5     
- Misses       428434   428442       +8     
+ Partials      10679    10676       -3     

Flag	Coverage Δ
uitests	3.69% <ø> (ø)
unittests	18.77% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[DaanHoogland]

@sudo87 what (if any) is the functional trade-off for this?

[sudo87]

@sudo87 what (if any) is the functional trade-off for this?

No functional trade-off, KVM never uses the CXF jar. This exclusion is scoped to plugins/hypervisor/kvm only.