T2.x.2 hardening: drop test-scope javafaker in sitemanage and metadata (fully removes snakeyaml 1.x)

[natechadwick-intsof]

Summary

PR #99 removed the production-scope javafaker from modules/perc-security-utils, but two test files still declare javafaker at <scope>test</scope> in their own poms and keep pulling in org.yaml:snakeyaml:1.23-android on the test classpath. This slice replaces the Faker calls in those two files with inline random text and removes the now-unused javafaker dep declarations, so the project's full dep graph has no snakeyaml:1.x left at any scope.

Why

After PR #99, Dependabot's 8 SnakeYAML alerts (#102-#109) were dismissed manually with reason not_used. The dismissal is correct — the remaining 1.23-android is dev-scope and unreachable from production — but a fully clean dep graph is the more defensible state: no future Dependabot re-scan can resurrect an alert, no new contributor is tempted to use Faker in production code, and the 16-CVE transitive goes away for good.

What changes

projects/sitemanage/.../PSDefaultPasswordEncryptionBeanTest.java

Replace:

Faker faker = new Faker();
String testPassword = faker.aquaTeenHungerForce().character().toString();

with:

// Use UUID for random test data; was com.github.javafaker.Faker (drops snakeyaml:1.23-android).
String testPassword = "test-" + java.util.UUID.randomUUID();

The test only checks that a password round-trips through encryption; the specific text content is irrelevant.

deliverytiersuite/delivery-tier-suite/metadata/.../PSMetadataQueryServiceTest.java

Replace the three Faker faker = new Faker(); blocks with simple string concatenation that uses the existing entryIdx counter (which is already incremented per entry). The categories are already derived from per-entry indices for the rest of the test; the faker calls were just adding noise that varied between runs.

projects/sitemanage/pom.xml and deliverytiersuite/delivery-tier-suite/metadata/pom.xml

Remove the javafaker <dependency> blocks. After the test changes, nothing references com.github.javafaker.* in either module.

Verification

• ./mvn-env.sh dependency:tree -pl projects/sitemanage,deliverytiersuite/delivery-tier-suite/metadata -Dincludes=org.yaml:snakeyaml,com.github.javafaker → both filters return empty.
• ./mvn-env.sh test -pl projects/sitemanage -Dtest=PSDefaultPasswordEncryptionBeanTest → passes.
• ./mvn-env.sh test -pl deliverytiersuite/delivery-tier-suite/metadata -Dtest=PSMetadataQueryServiceTest → passes.
• A grep for com.github.javafaker across the entire project source tree returns no files (the import + class references are all gone).

Out of scope

• The production SecureStringUtils.generateRandomPassword() rewrite from PR fix(security): T2.x hardening: drop javafaker in SecureStringUtils (closes 16 SnakeYAML CVEs) (issue #98) #99 — already done.

References

• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
• Previous slice: T2.x hardening: replace javafaker in SecureStringUtils.generateRandomPassword with SecureRandom (drops snakeyaml 1.23-android, closes 16 CVEs) #98 (PR fix(security): T2.x hardening: drop javafaker in SecureStringUtils (closes 16 SnakeYAML CVEs) (issue #98) #99, dropped production javafaker, dismissed the 8 Dependabot alerts)
• javafaker on Maven Central: https://search.maven.org/artifact/com.github.javafaker/javafaker — last release 1.0.2 (2020-02-10)

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.

[natechadwick-intsof]

Fixed via #101. javafaker is now gone from all 3 poms (sitemanage, metadata, perc-security-utils). SecureStringUtils uses SecureRandom directly, and the two test files use UUID / per-entry deterministic strings. The project's full dep graph has no snakeyaml:1.x at any scope; only snakeyaml:2.6 (from liquibase-core) remains, which is past the patched versions for all 8 CVEs.