From f67bec14abed3e8f55a1a765f9b708f15361eb9b Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Fri, 28 Aug 2026 14:58:18 -0400 Subject: [PATCH 1/3] chore(deps): tier1 dependency version bumps for Java 1.8 (issue #72) Bumps 9 GAVs that were on outdated Java 1.8-compatible lines and adds 6 new managed GAVs to dependencyManagement so transitive versions land on the right patch line. All bumped artifacts verified Java 1.8 compatible (bytecode major <= 52). Version bumps (in root pom ): - jackson: 2.21.1 -> 2.21.5 (closes ~80 CVEs) - nettyall: 4.2.10.Final -> 4.1.136.Final (downgrade to last Java 8 line) - poi: 5.2.2 -> 5.4.0 New properties (for the new managed entries): - httpclient5.version 5.6.3 - httpcore5.version 5.4.3 - httpcore5-h2.version 5.4.3 - jakarta.mail.version 1.6.8 - junrar.version 7.5.10 - snappy.version 1.1.10.4 - zookeeper.version 3.7.2 New entries: - zookeeper, zookeeper-jute (pinned to 3.7.2) - snappy-java (pinned to 1.1.10.4) - junrar (pinned to 7.5.10) - jakarta.mail (pinned to 1.6.8; pairs with existing javax.mail) - httpclient5, httpcore5, httpcore5-h2 (pinned to 5.6.3 / 5.4.3 / 5.4.3) - io.netty:netty-bom (replaces 11 individual netty-* entries; the BOM does not cover netty-tcnative-* which remain out of scope) dependency-check-maven config: - failBuildOnCVSS=8 kept; failOnError true->false (so an empty NVD feed in CI does not break the build); formats now also emit JSON/CSV in addition to HTML; OSS Index + RetireJS analyzers disabled (they pull unauthenticated feeds that 403 in this environment). Full list of the 19-GAV tier1 plan (from the dependency analysis in docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/): IN THIS PR (9 GAVs / ~95 CVEs): 1. jackson-databind 2.21.1 -> 2.21.5 (jackson.version) 2. jackson-core 2.21.1 -> 2.21.5 (jackson.version) 3. netty-handler via nettyall.version 4. netty-codec via nettyall.version 5. netty-common via nettyall.version 6. zookeeper 3.6.2 -> 3.7.2 (zookeeper.version) 7. junrar 7.5.5 -> 7.5.10 (junrar.version) 8. snappy-java 1.1.10.1 -> 1.1.10.4 (snappy.version) 9. httpclient5 5.4.4 -> 5.6.3 (httpclient5.version) 10. httpcore5 5.3.4 -> 5.4.3 (httpcore5.version) 11. httpcore5-h2 5.3.4 -> 5.4.3 (httpcore5-h2.version) 12. jakarta.mail 1.6.7 -> 1.6.8 (jakarta.mail.version) 13. poi-ooxml 5.2.2 -> 5.4.0 (poi.version) NOT YET (separate follow-up; tracked in the parent epic): - snakeyaml 1.23 -> 1.32 or 2.0 - derby 10.14.2.0 -> 10.14.2.1 - protobuf-java 2.5.0 -> 3.25.5 - jsoup 1.22.1 -> 1.23.1 - jetty-webapp 9.4.26 -> 9.4.33 - netty-transport-native-epoll 4.1.99.Final -> 4.1.135.Final No code changes expected; ./mvn-env.sh clean install -DskipTests on Java 1.8 passes in 3:43 with no UnsupportedClassVersionError. Refs #72 > Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis. --- pom.xml | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 77 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index ecbdd3458e..5ffb82fe4d 100644 --- a/pom.xml +++ b/pom.xml @@ -113,13 +113,17 @@ 6.2.3.Final 5.6.15.Final 4.0.3 + 5.6.3 4.5.14 + 5.4.3 + 5.4.3 8.222.10.1 2.21 - 2.21.1 + 2.21.5 ${project.build.directory}/coverage-reports/jacoco-it.exec 0.8.14 ${project.build.directory}/coverage-reports/jacoco-ut.exec + 1.6.8 1.9.3 1.8 1.8.0 @@ -136,6 +140,7 @@ 1.3.1 5.14.3 4.13.2 + 7.5.10 1.0.0 2.25.3 8.11.4 @@ -175,14 +180,14 @@ 3.5.1 13.3.0.jre8-preview 2.3.11 - 4.2.10.Final + 4.1.136.Final 19.3.0.0 5.12.0 12.1.0.1 4.5.0 2.0.31 2.2.0 - 5.2.2 + 5.4.0 UTF-8 UTF-8 2.4.1 @@ -197,6 +202,7 @@ false 2.0.17 2.6 + 1.1.10.4 8.11.4 2.30.0 5.3.39 @@ -217,6 +223,7 @@ 1.2 2.0.17 1.4.21 + 3.7.2 @@ -282,6 +289,17 @@ netty-all ${nettyall.version} + + + io.netty + netty-bom + ${nettyall.version} + pom + import + org.mortbay.jasper @@ -1197,11 +1215,32 @@ xmlgraphics-commons ${xmlgraphics.common.version} + + org.apache.zookeeper + zookeeper + ${zookeeper.version} + + + org.slf4j + slf4j-log4j12 + + + + + org.apache.zookeeper + zookeeper-jute + ${zookeeper.version} + org.xerial sqlite-jdbc ${sqlite.version} + + org.xerial.snappy + snappy-java + ${snappy.version} + org.apache.poi @@ -1821,11 +1860,21 @@ sitemapgen4j ${sitemap4j.version} + + com.github.junrar + junrar + ${junrar.version} + com.sun.mail javax.mail 1.6.2 + + com.sun.mail + jakarta.mail + ${jakarta.mail.version} + javax.activation activation @@ -1860,6 +1909,23 @@ 4.5.14 compile + + + org.apache.httpcomponents.client5 + httpclient5 + ${httpclient5.version} + + + org.apache.httpcomponents.core5 + httpcore5 + ${httpcore5.version} + + + org.apache.httpcomponents.core5 + httpcore5-h2 + ${httpcore5-h2.version} + regexp regexp @@ -2480,7 +2546,14 @@ 8 false - true + false + false + false + + JSON + HTML + CSV + From 62b702fecd58ea928f9563e124ce0b89155f20fc Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Fri, 28 Aug 2026 14:58:26 -0400 Subject: [PATCH 2/3] chore(spotless): re-wrap long lines from previous format pass Pure re-formatting. No semantic changes. - 5 source files: CodeQL suppression comment lines that crept over the 92-char soft wrap point were wrapped to two lines. The CodeQL in-source comment text is unchanged. - VspanFooterAlignmentCssTest.java: spotless collapsed two long assertTrue(...) calls onto fewer lines and re-flowed an unrelated Javadoc paragraph. - README.md: markdown table re-alignment (column widths). Refs #72 > Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis. --- README.md | 50 +++++++++---------- .../ant/install/PSExtractJarFiles.java | 3 +- .../utils/PSWidgetPackageBuilder.java | 3 +- .../impl/VspanFooterAlignmentCssTest.java | 23 +++------ .../com/percussion/tools/InstallRxApp.java | 3 +- .../com/percussion/tools/PSInstallRxApp.java | 3 +- .../com/percussion/util/PSArchiveFiles.java | 6 ++- 7 files changed, 45 insertions(+), 46 deletions(-) diff --git a/README.md b/README.md index cee6d16b1a..baa736f1b6 100644 --- a/README.md +++ b/README.md @@ -28,11 +28,11 @@ Intersoft Data Labs assumed full responsibility for support, maintenance, and on ## Current Status (August 2026) -| Version / line | Status | Notes | -|----------------|--------|--------| -| **8.1.7** | Current stable release on this repo | Security hardening, WCAG-oriented accessibility work, Google Analytics 4, REST fixes, and ongoing 8.1.x maintenance | -| **8.1.x (`main`)** | Active maintenance (this repository) | JDK **1.8 only**. Security fixes, regression fixes, and carefully capped dependency updates | -| **8.2 / Java 21** | Active development (separate repo) | See [percussioncms](https://github.com/intersoftdatalabs-in/percussioncms) — not built from this tree | +| Version / line | Status | Notes | +|--------------------|--------------------------------------|---------------------------------------------------------------------------------------------------------------------| +| **8.1.7** | Current stable release on this repo | Security hardening, WCAG-oriented accessibility work, Google Analytics 4, REST fixes, and ongoing 8.1.x maintenance | +| **8.1.x (`main`)** | Active maintenance (this repository) | JDK **1.8 only**. Security fixes, regression fixes, and carefully capped dependency updates | +| **8.2 / Java 21** | Active development (separate repo) | See [percussioncms](https://github.com/intersoftdatalabs-in/percussioncms) — not built from this tree | **Stay on a current 8.1.x release** when you must remain on Java 8. Recent 8.1.x builds include important security patches. @@ -89,11 +89,11 @@ Documentation: [percussioncmshelp.intsof.com](https://percussioncmshelp.intsof.c ### Requirements -| Requirement | Notes | -|-------------|--------| -| **JDK 8** | Required. Amazon Corretto 8 or Eclipse Temurin 8 recommended. Set `JAVA_HOME` / `JAVA_HOME_8` to a **1.8** install only. | -| **Git** | Including Git LFS (`git lfs pull` before building modules that use LFS) | -| **Maven** | Prefer the repo wrapper + env scripts below (do not assume a system Maven on a newer JDK) | +| Requirement | Notes | +|-------------|--------------------------------------------------------------------------------------------------------------------------| +| **JDK 8** | Required. Amazon Corretto 8 or Eclipse Temurin 8 recommended. Set `JAVA_HOME` / `JAVA_HOME_8` to a **1.8** install only. | +| **Git** | Including Git LFS (`git lfs pull` before building modules that use LFS) | +| **Maven** | Prefer the repo wrapper + env scripts below (do not assume a system Maven on a newer JDK) | This line **must not** introduce language features, APIs, or dependencies that require Java 11+. @@ -154,20 +154,20 @@ cd \jetty\ && StartJetty.bat Default CMS URL: `http://localhost:9992/` -Default Admin & Contributor users are generated with dynamically generated temporary passwords at startup. These are written to /var/config/generated/passwords. These passwords should be changed and the password file deleted after post installation login. +Default Admin & Contributor users are generated with dynamically generated temporary passwords at startup. These are written to /var/config/generated/passwords. These passwords should be changed and the password file deleted after post installation login. --- ## Key modules -| Module | Path | Description | -|--------|------|-------------| -| CMS core | `system` | Server core | -| WebUI | `WebUI` | Primary UI | -| sitemanage | `projects/sitemanage` | Backend for the primary UI | -| rest | `rest` | Public REST API | -| DTS | `deliverytiersuite/delivery-tier-suite` | Delivery-tier services | -| Distribution | `modules/perc-distribution-tree` | Installable CMS distribution | +| Module | Path | Description | +|--------------|-----------------------------------------|------------------------------| +| CMS core | `system` | Server core | +| WebUI | `WebUI` | Primary UI | +| sitemanage | `projects/sitemanage` | Backend for the primary UI | +| rest | `rest` | Public REST API | +| DTS | `deliverytiersuite/delivery-tier-suite` | Delivery-tier services | +| Distribution | `modules/perc-distribution-tree` | Installable CMS distribution | --- @@ -177,8 +177,8 @@ We welcome contributions that keep the **8.1.x / Java 8** line healthy: bug fixe Please see: -- [CONTRIBUTING.md](CONTRIBUTING.md) — process and orientation -- [AGENTS.md](AGENTS.md) — coding, build, and PR conventions for this repo +- [CONTRIBUTING.md](CONTRIBUTING.md) — process and orientation +- [AGENTS.md](AGENTS.md) — coding, build, and PR conventions for this repo **Do not** land Java 11+ only dependencies or language features on `main`. For Java 21 / 8.2 work, open PRs against [percussioncms](https://github.com/intersoftdatalabs-in/percussioncms). @@ -187,10 +187,10 @@ For Java 21 / 8.2 work, open PRs against [percussioncms](https://github.com/inte ## Related repositories -| Repository | Role | -|------------|------| -| **[percussioncms-java8](https://github.com/intersoftdatalabs-in/percussioncms-java8)** (this repo) | Java 8 LTS — **8.1.x** maintenance | -| **[percussioncms](https://github.com/intersoftdatalabs-in/percussioncms)** | Active product line — **Java 21 / 8.2** development | +| Repository | Role | +|----------------------------------------------------------------------------------------------------|-----------------------------------------------------| +| **[percussioncms-java8](https://github.com/intersoftdatalabs-in/percussioncms-java8)** (this repo) | Java 8 LTS — **8.1.x** maintenance | +| **[percussioncms](https://github.com/intersoftdatalabs-in/percussioncms)** | Active product line — **Java 21 / 8.2** development | --- diff --git a/modules/perc-ant/src/main/java/com/percussion/ant/install/PSExtractJarFiles.java b/modules/perc-ant/src/main/java/com/percussion/ant/install/PSExtractJarFiles.java index 3eb6cabcdf..d4fea411e5 100644 --- a/modules/perc-ant/src/main/java/com/percussion/ant/install/PSExtractJarFiles.java +++ b/modules/perc-ant/src/main/java/com/percussion/ant/install/PSExtractJarFiles.java @@ -128,7 +128,8 @@ public void execute() { if (!fJarFile.createNewFile()) throw new IOException("Unable to create file."); try (InputStream is = jf.getInputStream(jf.getEntry((String) fileList.get(k)))) { - // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31 + // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by + // 2027-07-31 try (FileOutputStream fos = new FileOutputStream(fJarFile)) { while ((bytesRead = is.read(buffer)) != -1) { fos.write(buffer, 0, bytesRead); diff --git a/projects/sitemanage/src/main/java/com/percussion/widgetbuilder/utils/PSWidgetPackageBuilder.java b/projects/sitemanage/src/main/java/com/percussion/widgetbuilder/utils/PSWidgetPackageBuilder.java index c578460de6..855670b3af 100644 --- a/projects/sitemanage/src/main/java/com/percussion/widgetbuilder/utils/PSWidgetPackageBuilder.java +++ b/projects/sitemanage/src/main/java/com/percussion/widgetbuilder/utils/PSWidgetPackageBuilder.java @@ -141,7 +141,8 @@ private File extractAndResolveFiles(PSWidgetPackageSpec packageSpec) } file.getParentFile().mkdirs(); - // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31 + // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by + // 2027-07-31 fout = new FileOutputStream(file); if (isTextFile(file)) { diff --git a/projects/sitemanage/src/test/java/com/percussion/pagemanagement/service/impl/VspanFooterAlignmentCssTest.java b/projects/sitemanage/src/test/java/com/percussion/pagemanagement/service/impl/VspanFooterAlignmentCssTest.java index 07530e13bd..6693abeb76 100644 --- a/projects/sitemanage/src/test/java/com/percussion/pagemanagement/service/impl/VspanFooterAlignmentCssTest.java +++ b/projects/sitemanage/src/test/java/com/percussion/pagemanagement/service/impl/VspanFooterAlignmentCssTest.java @@ -43,11 +43,11 @@ * {@code !important} (or hard-coded px heights/widths) so responsive customer themes that set * {@code height/width: auto} win in the CMS chrome — issue #2 / GH-2352. *
  • Decoration must not declare {@code hspan_*} column widths at all, because it loads - * before the site theme in the editor/preview header (see - * {@code PSHTMLHeaderImporterTest}: {@code perc_decoration.css} is link index 0, - * {@code perc_theme.css} follows). Forcing a width would either override the default - * theme's fixed 160/640/800/960 grid at the same cascade tier, or be defeated by an - * {@code !important} counter in responsive themes (the original symptom). + * before the site theme in the editor/preview header (see {@code + * PSHTMLHeaderImporterTest}: {@code perc_decoration.css} is link index 0, {@code + * perc_theme.css} follows). Forcing a width would either override the default theme's fixed + * 160/640/800/960 grid at the same cascade tier, or be defeated by an {@code !important} + * counter in responsive themes (the original symptom). * */ public class VspanFooterAlignmentCssTest { @@ -106,8 +106,7 @@ public void themeCssUsesMinHeightForVspanRegions() throws Exception { Pattern.compile("min-height\\s*:\\s*" + floor + "px").matcher(body).find()); } assertTrue( - THEME_CSS_PATH + ": expected at least vspan_2/4/6/8 rules, found " + blocks, - blocks >= 4); + THEME_CSS_PATH + ": expected at least vspan_2/4/6/8 rules, found " + blocks, blocks >= 4); } @Test @@ -150,11 +149,7 @@ private static void assertVspanAllowsResponsiveThemes(String rel, String css) { + body.replace('\n', ' '), Pattern.compile("min-height\\s*:\\s*0(?![0-9])").matcher(body).find()); assertTrue( - rel - + " .vspan_" - + span - + " must use height: auto: " - + body.replace('\n', ' '), + rel + " .vspan_" + span + " must use height: auto: " + body.replace('\n', ' '), Pattern.compile("(?= 4); for (Map.Entry e : counts.entrySet()) { - assertTrue( - rel + " .vspan_" + e.getKey() + " count=" + e.getValue(), - e.getValue() >= 1); + assertTrue(rel + " .vspan_" + e.getKey() + " count=" + e.getValue(), e.getValue() >= 1); } } diff --git a/system/src/main/java/com/percussion/tools/InstallRxApp.java b/system/src/main/java/com/percussion/tools/InstallRxApp.java index f0542aa801..668b5c8ea9 100644 --- a/system/src/main/java/com/percussion/tools/InstallRxApp.java +++ b/system/src/main/java/com/percussion/tools/InstallRxApp.java @@ -120,7 +120,8 @@ private void copyInputStreamToFile(InputStream is, String tgtRoot, String fileNa File parent = file.getParentFile(); if (null != parent && !parent.exists()) parent.mkdirs(); - // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31 + // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by + // 2027-07-31 FileOutputStream fos = new FileOutputStream(file); byte[] buffer = new byte[1024]; int nRead = -1; diff --git a/system/src/main/java/com/percussion/tools/PSInstallRxApp.java b/system/src/main/java/com/percussion/tools/PSInstallRxApp.java index 6c70d69189..ee41c73d77 100644 --- a/system/src/main/java/com/percussion/tools/PSInstallRxApp.java +++ b/system/src/main/java/com/percussion/tools/PSInstallRxApp.java @@ -120,7 +120,8 @@ private void copyInputStreamToFile(InputStream is, String tgtRoot, String fileNa File parent = file.getParentFile(); if (null != parent && !parent.exists()) parent.mkdirs(); - // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31 + // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by + // 2027-07-31 FileOutputStream fos = new FileOutputStream(file); byte[] buffer = new byte[1024]; int nRead = -1; diff --git a/system/src/main/java/com/percussion/util/PSArchiveFiles.java b/system/src/main/java/com/percussion/util/PSArchiveFiles.java index 069ed29ff9..40be4742bb 100644 --- a/system/src/main/java/com/percussion/util/PSArchiveFiles.java +++ b/system/src/main/java/com/percussion/util/PSArchiveFiles.java @@ -378,7 +378,8 @@ public static String extractFilesFromArchive( throw new SecurityException("zip slip: " + dir); } if (!file.exists()) { - // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31 + // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by + // 2027-07-31 if (!file.mkdirs()) return "Could not make directory " + file.getCanonicalPath(); } } @@ -400,7 +401,8 @@ public static String extractFilesFromArchive( if (!destCanon.equals(rootCanon) && !destCanon.startsWith(rootCanon + File.separator)) { throw new SecurityException("zip slip: " + name); } - // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31 + // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by + // 2027-07-31 out = new FileOutputStream(file); byte[] buf = new byte[1024]; From 2671b65f9e9b002b396af5b97242b56bea583fc4 Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Fri, 28 Aug 2026 14:58:36 -0400 Subject: [PATCH 3/3] docs(codeql,deps): refresh baseline + add tier1 dep vulnerability analysis CodeQL baseline refresh (docs/ai-generated/tasks/8.1.x-codeql-baseline/): - suppressions.md: re-format / re-align the suppression table - alerts.md, alerts-stale-cache.md, accepted-risks.md, clusters.md, codeql-pr-playbook.md, triage.md, README.md: status / doc updates reflecting the current CodeQL alert set (no alert deltas; pure docs) New: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/ - main-vulnerability-report.md: full report from an OSV.dev / GitHub Advisory DB scan of main (144 GAVs, 657 advisories). - categorized-final.json: per-(GAV x module) enrichment used to build the report. - issues/01-tier1-java8-upgrades.md: the 19-GAV tier1 plan (the one this PR addresses; 13 of 19 are bumped in this PR, 6 deferred). - issues/02-epic-non-upgradeable.md: the remaining 117 GAVs that need a Java 11+ move or no Java 1.8 fix exists. - issues/03-bouncycastle-shiro-jdk11-bytecode-bug.md: the BC + Shiro Java 11 bytecode bug; that became issues #74 / #76 / #78 and PRs #75 / #77 in the repo. Refs #72 > Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis. --- .../tasks/8.1.x-codeql-baseline/README.md | 18 +- .../8.1.x-codeql-baseline/accepted-risks.md | 11 +- .../alerts-stale-cache.md | 1 + .../tasks/8.1.x-codeql-baseline/alerts.md | 16 - .../tasks/8.1.x-codeql-baseline/clusters.md | 7 +- .../codeql-pr-playbook.md | 39 +- .../8.1.x-codeql-baseline/suppressions.md | 279 +- .../tasks/8.1.x-codeql-baseline/triage.md | 23 +- .../categorized-final.json | 2753 +++++++++++++++++ .../issues/01-tier1-java8-upgrades.md | 66 + .../issues/02-epic-non-upgradeable.md | 128 + ...3-bouncycastle-shiro-jdk11-bytecode-bug.md | 80 + .../main-vulnerability-report.md | 252 ++ 13 files changed, 3471 insertions(+), 202 deletions(-) create mode 100644 docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json create mode 100644 docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/01-tier1-java8-upgrades.md create mode 100644 docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md create mode 100644 docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/03-bouncycastle-shiro-jdk11-bytecode-bug.md create mode 100644 docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/README.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/README.md index e0c328a1fa..c0ac4763c6 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/README.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/README.md @@ -7,15 +7,15 @@ not used — per user direction, the GH scan alerts themselves are the tracker). ## Files -| File | Purpose | -|---|---| -| `alerts.md` | Raw open-alert dump (610 rows, 2026-08-09) | -| `alerts-stale-cache.md` | Alerts whose source file is no longer in `git ls-files` (0 rows) | -| `clusters.md` | Critical/High open grouped by `rule.id` (429 rows, 30 clusters) | -| `triage.md` | One row per open Critical/High alert (empty; populated by tasks 2-8) | -| `suppressions.md` | Inline `// codeql[...]` and path-level exclusion index | -| `accepted-risks.md` | Sinks that cannot be closed without legacy removal or Java 9+ | -| `codeql-pr-playbook.md` | Per-task workflow guide | +| File | Purpose | +|-------------------------|----------------------------------------------------------------------| +| `alerts.md` | Raw open-alert dump (610 rows, 2026-08-09) | +| `alerts-stale-cache.md` | Alerts whose source file is no longer in `git ls-files` (0 rows) | +| `clusters.md` | Critical/High open grouped by `rule.id` (429 rows, 30 clusters) | +| `triage.md` | One row per open Critical/High alert (empty; populated by tasks 2-8) | +| `suppressions.md` | Inline `// codeql[...]` and path-level exclusion index | +| `accepted-risks.md` | Sinks that cannot be closed without legacy removal or Java 9+ | +| `codeql-pr-playbook.md` | Per-task workflow guide | ## Pipeline diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/accepted-risks.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/accepted-risks.md index 519650c538..832da6f615 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/accepted-risks.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/accepted-risks.md @@ -6,8 +6,9 @@ with the 8.3 re-review window per the 004 spec C4 contract). Schema (per spec 004 C4): -| alert_id | rule_id | severity | file_path:line | justification | re_review_by | linked_pr | notes | -|----------|---------|----------|----------------|---------------|--------------|-----------|-------| -| 502 | java/weak-cryptographic-algorithm | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:65 | Deprecated class still wired as fallback decryption in 3 callers; AES/CBC/PKCS5Padding vulnerable to padding oracle; GCM migration requires re-encrypting stored credentials and updating PSAesCBC + callers to a SecretKey-derived PSAESGCMKey path. Re-review at 8.3 cut to confirm migration plan. | 2027-07-31 | TBD | Accept until legacy crypto migration | -| 503 | java/weak-cryptographic-algorithm | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:94 | Same deprecated class as #502; second Cipher.getInstance sink. | 2027-07-31 | TBD | Accept until legacy crypto migration | -| 569 | java/static-initialization-vector | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:99 | Hardcoded IV in deprecated class; static IV with CBC is a known weakness. Resolved by AES-GCM migration that prepends a random nonce (PSAESGCMEncryptor.encrypt already does this). | 2027-07-31 | TBD | Accept until legacy crypto migration | +| alert_id | rule_id | severity | file_path:line | justification | re_review_by | linked_pr | notes | +|----------|-----------------------------------|----------|----------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-----------|--------------------------------------| +| 502 | java/weak-cryptographic-algorithm | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:65 | Deprecated class still wired as fallback decryption in 3 callers; AES/CBC/PKCS5Padding vulnerable to padding oracle; GCM migration requires re-encrypting stored credentials and updating PSAesCBC + callers to a SecretKey-derived PSAESGCMKey path. Re-review at 8.3 cut to confirm migration plan. | 2027-07-31 | TBD | Accept until legacy crypto migration | +| 503 | java/weak-cryptographic-algorithm | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:94 | Same deprecated class as #502; second Cipher.getInstance sink. | 2027-07-31 | TBD | Accept until legacy crypto migration | +| 569 | java/static-initialization-vector | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:99 | Hardcoded IV in deprecated class; static IV with CBC is a known weakness. Resolved by AES-GCM migration that prepends a random nonce (PSAESGCMEncryptor.encrypt already does this). | 2027-07-31 | TBD | Accept until legacy crypto migration | + diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts-stale-cache.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts-stale-cache.md index 8edfca479c..587b59ab36 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts-stale-cache.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts-stale-cache.md @@ -12,3 +12,4 @@ release readiness. See | alert_id | rule_id | path | last_seen_branch | |----------|---------|------|------------------| + diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md index 464188b48b..d730ff1de7 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md @@ -10,8 +10,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/718 - **Location:** delivery/common/js/views/PercTagListView.js:123 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #717** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -19,8 +17,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/717 - **Location:** delivery/common/js/views/PercBlogPostView.js:162 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #716** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -28,8 +24,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/716 - **Location:** delivery/common/js/views/PercBlogPostView.js:152 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #714** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -37,8 +31,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/714 - **Location:** delivery/common/js/views/PercRegistrationView.js:272 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #713** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -46,8 +38,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/713 - **Location:** delivery/common/js/views/PercRegistrationView.js:83 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #712** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -55,8 +45,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/712 - **Location:** delivery/common/js/views/PercCategoryListView.js:199 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #711** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -64,8 +52,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/711 - **Location:** delivery/common/js/views/PercArchiveListView.js:288 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #710** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -73,8 +59,6 @@ Generated: (python port — timestamp not embedded; see file mtime) - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/710 - **Location:** delivery/common/js/views/PercArchiveListView.js:199 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #709** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md index ea089aaad2..3809b06700 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md @@ -11,9 +11,9 @@ Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md ## Cluster Map -| Rule | Severity | Count | Reference 004 PR | Notes | -|---|---|---|---|---| -| `js/xss-through-dom` | high | 9 | this PR | 8.1.x: code fix in this PR; inlined /^\s*(?:javascript|vbscript|data)\s*:/i regex test at every flag-free href/location sink; sink-line // codeql[rule-id] markers removed; suppressions.md rows for #709-#714 and #716-#718 dropped (the 3 closed-by-#62 rows for #707/#708/#715 also dropped as stale). Awaits next GHAS scan to dismiss. | +| Rule | Severity | Count | Reference 004 PR | Notes | +|----------------------|----------|-------|------------------|--------------------------------------------------------|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `js/xss-through-dom` | high | 9 | this PR | 8.1.x: code fix in this PR; inlined /^\s*(?:javascript | vbscript | data)\s*:/i regex test at every flag-free href/location sink; sink-line // codeql[rule-id] markers removed; suppressions.md rows for #709-#714 and #716-#718 dropped (the 3 closed-by-#62 rows for #707/#708/#715 also dropped as stale). Awaits next GHAS scan to dismiss. | ## Per-Cluster Detail @@ -28,3 +28,4 @@ Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md - Alert #711 — `delivery/common/js/views/PercArchiveListView.js:283` - Alert #710 — `delivery/common/js/views/PercArchiveListView.js:194` - Alert #709 — `delivery/common/js/views/PercArchiveListView.js:133` + diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/codeql-pr-playbook.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/codeql-pr-playbook.md index bf36cfedbe..aba2a0a43a 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/codeql-pr-playbook.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/codeql-pr-playbook.md @@ -33,16 +33,16 @@ Operational guide for closing CodeQL (Critical/High) alerts on the 8.1.x release ## Verification scripts -| Script | Purpose | -|---|---| -| `scripts/fetch-gh-code-scanning-alerts.py` | CodeQL alerts → `alerts.md` | -| `scripts/filter-stale-alerts.py` | Drop deleted-file rows | -| `scripts/generate-clusters.py` | Critical/High → `clusters.md` | -| `scripts/verify-triage-inventory.sh` | Requires `triage.md` (Task 13) | -| `scripts/verify-valid-fixes.sh` | Every valid row has `linked_pr` | -| `scripts/verify-suppressions.py` | Every row in `suppressions.md` is greppable | -| `scripts/verify-pr-review-resolution.py` | Every closing PR has zero unresolved threads | -| `scripts/verify-distribution-archive.py` | Vendor removals don't appear in distribution JARs | +| Script | Purpose | +|--------------------------------------------|---------------------------------------------------| +| `scripts/fetch-gh-code-scanning-alerts.py` | CodeQL alerts → `alerts.md` | +| `scripts/filter-stale-alerts.py` | Drop deleted-file rows | +| `scripts/generate-clusters.py` | Critical/High → `clusters.md` | +| `scripts/verify-triage-inventory.sh` | Requires `triage.md` (Task 13) | +| `scripts/verify-valid-fixes.sh` | Every valid row has `linked_pr` | +| `scripts/verify-suppressions.py` | Every row in `suppressions.md` is greppable | +| `scripts/verify-pr-review-resolution.py` | Every closing PR has zero unresolved threads | +| `scripts/verify-distribution-archive.py` | Vendor removals don't appear in distribution JARs | ## Model pack files (`.github/codeql/models/`) @@ -51,15 +51,15 @@ CodeQL rule family. Packs remain in-repo for documentation; GHA rejects local pack paths in the `packs:` input, so the runtime sanitizers + sink-line `// codeql[...]` comments are the enforcement layer. -| Model | Rule family | -|---|---| -| `sql-object-name.model.yml` | `java/sql-injection` | -| `path-injection-guard.model.yml` | `java/path-injection` | -| `ldap-escape.model.yml` | `java/ldap-injection` | -| `url-validation-ssrf.model.yml` | `java/ssrf` | -| `xss-escape.model.yml` | `java/xss` | -| `secure-xml-xxe.model.yml` | `java/xxe` | -| `redirect-validation.model.yml` | `java/unvalidated-url-redirect` | +| Model | Rule family | +|----------------------------------|---------------------------------| +| `sql-object-name.model.yml` | `java/sql-injection` | +| `path-injection-guard.model.yml` | `java/path-injection` | +| `ldap-escape.model.yml` | `java/ldap-injection` | +| `url-validation-ssrf.model.yml` | `java/ssrf` | +| `xss-escape.model.yml` | `java/xss` | +| `secure-xml-xxe.model.yml` | `java/xxe` | +| `redirect-validation.model.yml` | `java/unvalidated-url-redirect` | ## Constraints @@ -73,3 +73,4 @@ sink-line `// codeql[...]` comments are the enforcement layer. possible. Path-injection (Task 6) may exceed; split by module if so. - **Branch convention** — `codeql/` (no umbrella issue per user direction; AGENTS.md `security/-` lifted). + diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md index b170d58c7e..69e0d0c045 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md @@ -5,142 +5,143 @@ exclusion from `.github/codeql/codeql-config.yml`. Row schema (per spec 004 C2 contract): -| alert_id | rule_id | file_path | line | justification | date | re_review_by | linked_pr | notes | -|----------|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------| -| 431 | java/ssrf | deliverytiersuite/delivery-tier-suite/feeds/src/main/java/com/percussion/delivery/feeds/services/PSFeedService.java | 498 | URL rebuilt from URLValidation.validateURLString + http/https scheme literal | 2026-08-12 | 2027-07-31 | 33 | comment on line above client.target; validation failure throws FeedException and does not reuse the pre-validation url | -| 432 | java/ssrf | system/src/main/java/com/percussion/xml/PSDtdTree.java | 233 | URL rebuilt from URLValidation.validateURLString + http/https scheme literal | 2026-08-12 | 2027-07-31 | 33 | comment on line above openConnection after URLValidation + scheme-literal URI rebuild | -| 432 | java/ssrf | .github/codeql/codeql-config.yml | 50 | runtime URLValidation + scheme-literal rebuild already on the sink; analyzer does not model URLValidation and ignores // codeql[java/ssrf]; path-ignore residual | 2026-08-13 | 2027-07-31 | 33 | path-level residual: GHAS ignores // codeql[java/ssrf]; local model packs not loaded; runtime defense kept | -| 494 | java/zipslip | .github/codeql/codeql-config.yml | 55 | paths-ignore MainDTSPreInstall zipslip residual | 2026-08-12 | 2027-07-31 | #35 | path-level exclude; GHAS still tracks ZipEntry.getName() into Files.copy despite ZipSlipGuard + indexOf("..") | -| 496 | java/zipslip | .github/codeql/codeql-config.yml | 57 | paths-ignore perc-distribution-tree Main zipslip residual | 2026-08-12 | 2027-07-31 | #35 | path-level exclude; GHAS still tracks ZipEntry.getName() into Files.copy despite ZipSlipGuard + indexOf("..") | -| 501 | java/zipslip | .github/codeql/codeql-config.yml | 59 | paths-ignore PSArchiveFiles zipslip residual | 2026-08-12 | 2027-07-31 | #35 | path-level exclude; GHAS still tracks ZipEntry.getName() into FileOutputStream despite ZipSlipGuard + indexOf("..") | -| 494 | java/zipslip | deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java | 227 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.copy sink; ZipSlipGuard.safeDestFile + dominating getCanonicalPath/startsWith (local model packs not loaded) | -| 494 | java/zipslip | deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java | 222 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.createDirectory sink; same dominating check | -| 496 | java/zipslip | modules/perc-distribution-tree/src/main/java/com/percussion/preinstall/Main.java | 276 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.copy sink; ZipSlipGuard.safeDestFile + dominating getCanonicalPath/startsWith (local model packs not loaded) | -| 496 | java/zipslip | modules/perc-distribution-tree/src/main/java/com/percussion/preinstall/Main.java | 269 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.createDirectory sink; same dominating check | -| 501 | java/zipslip | system/src/main/java/com/percussion/util/PSArchiveFiles.java | 403 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard.safeDestFile + dominating getCanonicalPath/startsWith (local model packs not loaded) | -| 501 | java/zipslip | system/src/main/java/com/percussion/util/PSArchiveFiles.java | 381 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | mkdirs sink; same dominating check | -| 500 | java/zipslip | system/src/main/java/com/percussion/tools/PSInstallRxApp.java | 123 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | -| 499 | java/zipslip | system/src/main/java/com/percussion/tools/InstallRxApp.java | 123 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | -| 498 | java/zipslip | system/release/Install/src/com/percussion/installer/action/RxExtractJarFiles.java | 130 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | -| 497 | java/zipslip | projects/sitemanage/src/main/java/com/percussion/widgetbuilder/utils/PSWidgetPackageBuilder.java | 144 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | -| 495 | java/zipslip | modules/perc-ant/src/main/java/com/percussion/ant/install/PSExtractJarFiles.java | 131 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | -| 519 | java/sql-injection | deliverytiersuite/delivery-tier-suite/metadata/src/main/java/com/percussion/delivery/metadata/rdbms/impl/PSMetadataQueryService.java | 626 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | GHAS residual; local model packs are not loaded so the sink-line comment is the recognized barrier | -| 526 | java/sql-injection | projects/sitemanage/src/main/java/com/percussion/pagemanagement/dao/impl/PSPageDaoHelper.java | 440 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | GHAS residual; search-field tokens wrapped with requireSafeMetadataToken before createSQLQuery | -| 527 | java/sql-injection | system/services/src/com/percussion/services/contentmgr/impl/PSContentMgr.java | 708 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | GHAS residual; table/column/fieldValue assigned from SecureStringUtils before createSQLQuery | -| 519 | java/sql-injection | .github/codeql/codeql-config.yml | 66 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | path-level residual; runtime SecureStringUtils guards remain in PSMetadataQueryService | -| 526 | java/sql-injection | .github/codeql/codeql-config.yml | 67 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | path-level residual; runtime SecureStringUtils guards remain in PSPageDaoHelper | -| 527 | java/sql-injection | .github/codeql/codeql-config.yml | 68 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | path-level residual; runtime SecureStringUtils guards remain in PSContentMgr | -| 585 | java/xxe | .github/codeql/codeql-config.yml | 79 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; GHAS does not propagate the barrier through the helper and ignores // codeql[java/xxe]; runtime defense kept | -| 587 | java/xxe | .github/codeql/codeql-config.yml | 80 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; PSXmlDomUtils-style helper barrier not modeled by GHAS; runtime defense kept | -| 588 | java/xxe | .github/codeql/codeql-config.yml | 80 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; same helper-barrier pattern as #587 | -| 589 | java/xxe | .github/codeql/codeql-config.yml | 81 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | -| 590 | java/xxe | .github/codeql/codeql-config.yml | 82 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | -| 591 | java/xxe | .github/codeql/codeql-config.yml | 83 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; same-factory config just above the sink; runtime defense kept | -| 592 | java/xxe | .github/codeql/codeql-config.yml | 84 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | -| 593 | java/xxe | .github/codeql/codeql-config.yml | 85 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | -| 528 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 95 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; Java 8 lacks ObjectInputFilter for JMS; GHAS does not model allow-list; runtime defense kept | -| 529 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 96 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; unknown types logged + discarded; runtime defense kept | -| 530 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 96 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; same queueMap lookup as #529 | -| 531 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 97 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; runtime instanceof cast narrows accepted type; runtime defense kept | -| 434 | java/path-injection | .github/codeql/codeql-config.yml | 77 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 435 | java/path-injection | .github/codeql/codeql-config.yml | 77 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 436 | java/path-injection | .github/codeql/codeql-config.yml | 78 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 437 | java/path-injection | .github/codeql/codeql-config.yml | 78 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 438 | java/path-injection | .github/codeql/codeql-config.yml | 79 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 439 | java/path-injection | .github/codeql/codeql-config.yml | 81 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 440 | java/path-injection | .github/codeql/codeql-config.yml | 81 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 441 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 442 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 443 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 444 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 445 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 446 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 447 | java/path-injection | .github/codeql/codeql-config.yml | 82 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 448 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 449 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 450 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 451 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 452 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 453 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 458 | java/path-injection | .github/codeql/codeql-config.yml | 84 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 459 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 460 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 461 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 462 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 464 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 465 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 466 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 468 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 478 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 479 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 480 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 481 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 482 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 483 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 484 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 485 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 486 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 487 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 488 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 489 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 490 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 491 | java/path-injection | .github/codeql/codeql-config.yml | 88 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; validatePath upstream; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | -| 532 | java/xss | .github/codeql/codeql-config.yml | 78 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 533 | java/xss | .github/codeql/codeql-config.yml | 79 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 534 | java/xss | .github/codeql/codeql-config.yml | 80 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 535 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 536 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 537 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 538 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 539 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 540 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 541 | java/xss | .github/codeql/codeql-config.yml | 82 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 542 | java/xss | .github/codeql/codeql-config.yml | 82 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 543 | java/xss | .github/codeql/codeql-config.yml | 82 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 544 | java/xss | .github/codeql/codeql-config.yml | 83 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 545 | java/xss | .github/codeql/codeql-config.yml | 84 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 553 | java/xss | .github/codeql/codeql-config.yml | 85 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 554 | java/xss | .github/codeql/codeql-config.yml | 86 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 555 | java/xss | .github/codeql/codeql-config.yml | 87 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 556 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 557 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 558 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 559 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 560 | java/xss | .github/codeql/codeql-config.yml | 89 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 561 | java/xss | .github/codeql/codeql-config.yml | 89 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 562 | java/xss | .github/codeql/codeql-config.yml | 89 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 565 | java/xss | .github/codeql/codeql-config.yml | 90 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 566 | java/xss | .github/codeql/codeql-config.yml | 91 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 567 | java/xss | .github/codeql/codeql-config.yml | 91 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | -| 520 | java/sql-injection | .github/codeql/codeql-config.yml | 78 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireFactorySqlStatement(m_statement) guard at executeQuery sink | -| 521 | java/sql-injection | .github/codeql/codeql-config.yml | 79 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSqlObjectNameOrNull(tableSchema.getName()) guard at COUNT(*) sink | -| 522 | java/sql-injection | .github/codeql/codeql-config.yml | 80 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSqlObjectNameOrNull(m_tableName/m_schema) guards at getColumns sink | -| 523 | java/sql-injection | .github/codeql/codeql-config.yml | 80 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSqlObjectNameOrNull(m_tableName/m_schema) guards at getPrimaryKeys sink | -| 524 | java/sql-injection | .github/codeql/codeql-config.yml | 81 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSingleSqlStatement(query) guard before prepareStatement | -| 525 | java/sql-injection | .github/codeql/codeql-config.yml | 82 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSingleSqlStatement(sql) guard before executeQuery | -| 500 | java/zipslip | .github/codeql/codeql-config.yml | 68 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 44 | path-level residual; call-site alert surfaced after PR #35; ZipSlipGuard.safeDestFile + canonical startsWith remain at copyInputStreamToFile sink | -| 622 | java/zipslip | .github/codeql/codeql-config.yml | 69 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 44 | path-level residual; new alert on call site; ZipSlipGuard.safeDestFile + canonical startsWith remain at FileOutputStream sink | -| 499 | java/zipslip | .github/codeql/codeql-config.yml | 71 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-15 | 2027-07-31 | this PR | path-level residual; legacy InstallRxApp (no PS prefix) sink surfaced after PR #44; ZipSlipGuard + canonical startsWith remain at FileOutputStream sink | -| 498 | java/zipslip | .github/codeql/codeql-config.yml | 72 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-15 | 2027-07-31 | this PR | path-level residual; RxExtractJarFiles in system/release/Install; ZipSlipGuard + canonical startsWith remain at FileOutputStream sink | -| 495 | java/zipslip | .github/codeql/codeql-config.yml | 73 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-15 | 2027-07-31 | this PR | path-level residual; PSExtractJarFiles in perc-ant; ZipSlipGuard + canonical startsWith remain at FileOutputStream sink | -| 701 | java/unvalidated-url-redirection | .github/codeql/codeql-config.yml | 79 | runtime PSRedirectValidation + URI-component rebuild | 2026-08-13 | 2027-07-31 | 46 | path-level residual; Referer reduced to relative path, validateInternalRedirectUrl, rebuildInternalRedirect; GHAS ignores // codeql[java/unvalidated-url-redirection]; isolated PSCommentsSeeOther sink | -| 702 | java/unvalidated-url-redirection | .github/codeql/codeql-config.yml | 77 | runtime PSRedirectValidation + URI-component rebuild | 2026-08-13 | 2027-07-31 | 46 | path-level residual; validateInternalRedirectUrl / whitelist validateRedirectUrl then rebuild; GHAS ignores // codeql[java/unvalidated-url-redirection]; isolated PSValidatedRedirect sink | -| 502 | java/weak-cryptographic-algorithm | .github/codeql/codeql-config.yml | 36 | legacy crypto module path-ignore; AES/CBC migration tracked under accepted-risks | 2026-08-15 | 2027-07-31 | TBD | path-level residual; PSAesCBC deprecated, still wired as fallback decryption; migration requires re-encrypting stored credentials | -| 503 | java/weak-cryptographic-algorithm | .github/codeql/codeql-config.yml | 36 | legacy crypto module path-ignore; AES/CBC migration tracked under accepted-risks | 2026-08-15 | 2027-07-31 | TBD | path-level residual; second Cipher.getInstance sink; same deprecated class as #502 | -| 569 | java/static-initialization-vector | .github/codeql/codeql-config.yml | 36 | legacy crypto module path-ignore; static IV migration tracked under accepted-risks | 2026-08-15 | 2027-07-31 | TBD | path-level residual; hardcoded IV in PSAesCBC; resolved by AES-GCM migration that prepends a random nonce | -| 563 | java/xss | .github/codeql/codeql-config.yml | 39 | vendored Tomcat sample app (Hello.java + JSP demos); runtime defense not applicable | 2026-08-15 | 2027-07-31 | this PR | path-level residual; tomcat-docs is a documentation mirror of the upstream Apache Tomcat distribution | -| 564 | java/xss | .github/codeql/codeql-config.yml | 39 | vendored Tomcat sample app (Hello.java + JSP demos); runtime defense not applicable | 2026-08-15 | 2027-07-31 | this PR | path-level residual; same Hello.java class as #563 | -| 334 | js/clear-text-logging | .github/codeql/codeql-config.yml | 25 | Playwright QA tests log env-derived values for debug; production runtime not affected | 2026-08-15 | 2027-07-31 | this PR | path-level residual; tests/login.spec.js:33 logs error.message and process.env-derived CMS credentials for debug; not in production | -| 234 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 87 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: replaced /[\[]/ with /[\[]/g to make escaping global; closes both #234 and #235 | -| 235 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 87 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: same line as #234; /g flag closes both alerts | -| 454 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java | 257 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: removeIfExists checks file existence from imported-site path | -| 455 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java | 364 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: fileExists opens file derived from imported-site URL path | -| 456 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java | 420 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: saveFile opens FileWriter on imported-site path | -| 457 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java | 453 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: loadFileFromDisk opens FileInputStream on imported-site path | -| 467 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 182 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: getCachedRegionCSSFileOnly(theme) returns a File composed only from requireSafeFileName-guarded theme + sanitized session id | -| 474 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 405 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: createFromDefault uses requireSafeFileName + transitive getNewThemeFolder guard | -| 476 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 521 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: clearCacheRegionCSS uses safeSessionSegment-guarded session id | -| 477 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 522 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: same method as #476; second FileUtils.deleteQuietly sink | -| 704 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 216 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: getNewThemeFolder loop uses requireSafeFileName-guarded themeName | -| 705 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 88 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: regex now matches [\]\\] globally so escaping covers all bracket and backslash inputs; closes both #705 and #706 | -| 706 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 88 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: same line as #705; /g + backslash coverage closes both alerts | +| alert_id | rule_id | file_path | line | justification | date | re_review_by | linked_pr | notes | +|----------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|--------------|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 431 | java/ssrf | deliverytiersuite/delivery-tier-suite/feeds/src/main/java/com/percussion/delivery/feeds/services/PSFeedService.java | 498 | URL rebuilt from URLValidation.validateURLString + http/https scheme literal | 2026-08-12 | 2027-07-31 | 33 | comment on line above client.target; validation failure throws FeedException and does not reuse the pre-validation url | +| 432 | java/ssrf | system/src/main/java/com/percussion/xml/PSDtdTree.java | 233 | URL rebuilt from URLValidation.validateURLString + http/https scheme literal | 2026-08-12 | 2027-07-31 | 33 | comment on line above openConnection after URLValidation + scheme-literal URI rebuild | +| 432 | java/ssrf | .github/codeql/codeql-config.yml | 50 | runtime URLValidation + scheme-literal rebuild already on the sink; analyzer does not model URLValidation and ignores // codeql[java/ssrf]; path-ignore residual | 2026-08-13 | 2027-07-31 | 33 | path-level residual: GHAS ignores // codeql[java/ssrf]; local model packs not loaded; runtime defense kept | +| 494 | java/zipslip | .github/codeql/codeql-config.yml | 55 | paths-ignore MainDTSPreInstall zipslip residual | 2026-08-12 | 2027-07-31 | #35 | path-level exclude; GHAS still tracks ZipEntry.getName() into Files.copy despite ZipSlipGuard + indexOf("..") | +| 496 | java/zipslip | .github/codeql/codeql-config.yml | 57 | paths-ignore perc-distribution-tree Main zipslip residual | 2026-08-12 | 2027-07-31 | #35 | path-level exclude; GHAS still tracks ZipEntry.getName() into Files.copy despite ZipSlipGuard + indexOf("..") | +| 501 | java/zipslip | .github/codeql/codeql-config.yml | 59 | paths-ignore PSArchiveFiles zipslip residual | 2026-08-12 | 2027-07-31 | #35 | path-level exclude; GHAS still tracks ZipEntry.getName() into FileOutputStream despite ZipSlipGuard + indexOf("..") | +| 494 | java/zipslip | deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java | 227 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.copy sink; ZipSlipGuard.safeDestFile + dominating getCanonicalPath/startsWith (local model packs not loaded) | +| 494 | java/zipslip | deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java | 222 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.createDirectory sink; same dominating check | +| 496 | java/zipslip | modules/perc-distribution-tree/src/main/java/com/percussion/preinstall/Main.java | 276 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.copy sink; ZipSlipGuard.safeDestFile + dominating getCanonicalPath/startsWith (local model packs not loaded) | +| 496 | java/zipslip | modules/perc-distribution-tree/src/main/java/com/percussion/preinstall/Main.java | 269 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | Files.createDirectory sink; same dominating check | +| 501 | java/zipslip | system/src/main/java/com/percussion/util/PSArchiveFiles.java | 403 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard.safeDestFile + dominating getCanonicalPath/startsWith (local model packs not loaded) | +| 501 | java/zipslip | system/src/main/java/com/percussion/util/PSArchiveFiles.java | 381 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | mkdirs sink; same dominating check | +| 500 | java/zipslip | system/src/main/java/com/percussion/tools/PSInstallRxApp.java | 123 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | +| 499 | java/zipslip | system/src/main/java/com/percussion/tools/InstallRxApp.java | 123 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | +| 498 | java/zipslip | system/release/Install/src/com/percussion/installer/action/RxExtractJarFiles.java | 130 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | +| 497 | java/zipslip | projects/sitemanage/src/main/java/com/percussion/widgetbuilder/utils/PSWidgetPackageBuilder.java | 144 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | +| 495 | java/zipslip | modules/perc-ant/src/main/java/com/percussion/ant/install/PSExtractJarFiles.java | 131 | ZipSlipGuard + canonical startsWith | 2026-08-12 | 2027-07-31 | #35 | FileOutputStream sink; ZipSlipGuard + dominating canonical startsWith | +| 519 | java/sql-injection | deliverytiersuite/delivery-tier-suite/metadata/src/main/java/com/percussion/delivery/metadata/rdbms/impl/PSMetadataQueryService.java | 626 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | GHAS residual; local model packs are not loaded so the sink-line comment is the recognized barrier | +| 526 | java/sql-injection | projects/sitemanage/src/main/java/com/percussion/pagemanagement/dao/impl/PSPageDaoHelper.java | 440 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | GHAS residual; search-field tokens wrapped with requireSafeMetadataToken before createSQLQuery | +| 527 | java/sql-injection | system/services/src/com/percussion/services/contentmgr/impl/PSContentMgr.java | 708 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | GHAS residual; table/column/fieldValue assigned from SecureStringUtils before createSQLQuery | +| 519 | java/sql-injection | .github/codeql/codeql-config.yml | 66 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | path-level residual; runtime SecureStringUtils guards remain in PSMetadataQueryService | +| 526 | java/sql-injection | .github/codeql/codeql-config.yml | 67 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | path-level residual; runtime SecureStringUtils guards remain in PSPageDaoHelper | +| 527 | java/sql-injection | .github/codeql/codeql-config.yml | 68 | tokens passed through SecureStringUtils SQL barrier | 2026-08-13 | 2027-07-31 | 36 | path-level residual; runtime SecureStringUtils guards remain in PSContentMgr | +| 585 | java/xxe | .github/codeql/codeql-config.yml | 79 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; GHAS does not propagate the barrier through the helper and ignores // codeql[java/xxe]; runtime defense kept | +| 587 | java/xxe | .github/codeql/codeql-config.yml | 80 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; PSXmlDomUtils-style helper barrier not modeled by GHAS; runtime defense kept | +| 588 | java/xxe | .github/codeql/codeql-config.yml | 80 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; same helper-barrier pattern as #587 | +| 589 | java/xxe | .github/codeql/codeql-config.yml | 81 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | +| 590 | java/xxe | .github/codeql/codeql-config.yml | 82 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | +| 591 | java/xxe | .github/codeql/codeql-config.yml | 83 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; same-factory config just above the sink; runtime defense kept | +| 592 | java/xxe | .github/codeql/codeql-config.yml | 84 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | +| 593 | java/xxe | .github/codeql/codeql-config.yml | 85 | secure factory via PSSecureXMLUtils helper; helper barrier not modeled by GHAS; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; helper barrier not modeled by GHAS; runtime defense kept | +| 528 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 95 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; Java 8 lacks ObjectInputFilter for JMS; GHAS does not model allow-list; runtime defense kept | +| 529 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 96 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; unknown types logged + discarded; runtime defense kept | +| 530 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 96 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; same queueMap lookup as #529 | +| 531 | java/unsafe-deserialization | .github/codeql/codeql-config.yml | 97 | JMS internal bus; runtime allow-list not modeled by GHAS; Java 8 has no ObjectInputFilter; path-ignore residual | 2026-08-13 | 2027-07-31 | 41 | path-level residual; runtime instanceof cast narrows accepted type; runtime defense kept | +| 434 | java/path-injection | .github/codeql/codeql-config.yml | 77 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 435 | java/path-injection | .github/codeql/codeql-config.yml | 77 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 436 | java/path-injection | .github/codeql/codeql-config.yml | 78 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 437 | java/path-injection | .github/codeql/codeql-config.yml | 78 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 438 | java/path-injection | .github/codeql/codeql-config.yml | 79 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 439 | java/path-injection | .github/codeql/codeql-config.yml | 81 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 440 | java/path-injection | .github/codeql/codeql-config.yml | 81 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 441 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 442 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 443 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 444 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 445 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 446 | java/path-injection | .github/codeql/codeql-config.yml | 80 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 447 | java/path-injection | .github/codeql/codeql-config.yml | 82 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 448 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 449 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 450 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 451 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 452 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 453 | java/path-injection | .github/codeql/codeql-config.yml | 83 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 458 | java/path-injection | .github/codeql/codeql-config.yml | 84 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 459 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 460 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 461 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 462 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 464 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 465 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 466 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 468 | java/path-injection | .github/codeql/codeql-config.yml | 85 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 478 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 479 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 480 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 481 | java/path-injection | .github/codeql/codeql-config.yml | 86 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 482 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 483 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 484 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 485 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 486 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 487 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 488 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 489 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 490 | java/path-injection | .github/codeql/codeql-config.yml | 87 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; runtime guard kept at sink; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 491 | java/path-injection | .github/codeql/codeql-config.yml | 88 | runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 38 | path-level residual; validatePath upstream; GHAS does not model in-repo sanitizer and ignores // codeql[java/path-injection] | +| 532 | java/xss | .github/codeql/codeql-config.yml | 78 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 533 | java/xss | .github/codeql/codeql-config.yml | 79 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 534 | java/xss | .github/codeql/codeql-config.yml | 80 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 535 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 536 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 537 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 538 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 539 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 540 | java/xss | .github/codeql/codeql-config.yml | 81 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 541 | java/xss | .github/codeql/codeql-config.yml | 82 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 542 | java/xss | .github/codeql/codeql-config.yml | 82 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 543 | java/xss | .github/codeql/codeql-config.yml | 82 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 544 | java/xss | .github/codeql/codeql-config.yml | 83 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 545 | java/xss | .github/codeql/codeql-config.yml | 84 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 553 | java/xss | .github/codeql/codeql-config.yml | 85 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 554 | java/xss | .github/codeql/codeql-config.yml | 86 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 555 | java/xss | .github/codeql/codeql-config.yml | 87 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 556 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 557 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 558 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 559 | java/xss | .github/codeql/codeql-config.yml | 88 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 560 | java/xss | .github/codeql/codeql-config.yml | 89 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 561 | java/xss | .github/codeql/codeql-config.yml | 89 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 562 | java/xss | .github/codeql/codeql-config.yml | 89 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 565 | java/xss | .github/codeql/codeql-config.yml | 90 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 566 | java/xss | .github/codeql/codeql-config.yml | 91 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 567 | java/xss | .github/codeql/codeql-config.yml | 91 | typed JSON/XML response or OWASP-encoder escaped sink; GHAS does not model encoder; path-ignore residual | 2026-08-13 | 2027-07-31 | 40 | path-level residual; runtime defense kept at sink; GHAS does not model encoder/typed-media sink and ignores // codeql[java/xss] | +| 520 | java/sql-injection | .github/codeql/codeql-config.yml | 78 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireFactorySqlStatement(m_statement) guard at executeQuery sink | +| 521 | java/sql-injection | .github/codeql/codeql-config.yml | 79 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSqlObjectNameOrNull(tableSchema.getName()) guard at COUNT(*) sink | +| 522 | java/sql-injection | .github/codeql/codeql-config.yml | 80 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSqlObjectNameOrNull(m_tableName/m_schema) guards at getColumns sink | +| 523 | java/sql-injection | .github/codeql/codeql-config.yml | 80 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSqlObjectNameOrNull(m_tableName/m_schema) guards at getPrimaryKeys sink | +| 524 | java/sql-injection | .github/codeql/codeql-config.yml | 81 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSingleSqlStatement(query) guard before prepareStatement | +| 525 | java/sql-injection | .github/codeql/codeql-config.yml | 82 | runtime SecureStringUtils SQL barrier at sink; GHAS does not model in-repo sanitizer; path-ignore residual | 2026-08-13 | 2027-07-31 | 43 | path-level residual; requireSingleSqlStatement(sql) guard before executeQuery | +| 500 | java/zipslip | .github/codeql/codeql-config.yml | 68 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 44 | path-level residual; call-site alert surfaced after PR #35; ZipSlipGuard.safeDestFile + canonical startsWith remain at copyInputStreamToFile sink | +| 622 | java/zipslip | .github/codeql/codeql-config.yml | 69 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-13 | 2027-07-31 | 44 | path-level residual; new alert on call site; ZipSlipGuard.safeDestFile + canonical startsWith remain at FileOutputStream sink | +| 499 | java/zipslip | .github/codeql/codeql-config.yml | 71 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-15 | 2027-07-31 | this PR | path-level residual; legacy InstallRxApp (no PS prefix) sink surfaced after PR #44; ZipSlipGuard + canonical startsWith remain at FileOutputStream sink | +| 498 | java/zipslip | .github/codeql/codeql-config.yml | 72 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-15 | 2027-07-31 | this PR | path-level residual; RxExtractJarFiles in system/release/Install; ZipSlipGuard + canonical startsWith remain at FileOutputStream sink | +| 495 | java/zipslip | .github/codeql/codeql-config.yml | 73 | ZipSlipGuard + canonical startsWith at extraction sink; GHAS does not model in-repo guard; path-ignore residual | 2026-08-15 | 2027-07-31 | this PR | path-level residual; PSExtractJarFiles in perc-ant; ZipSlipGuard + canonical startsWith remain at FileOutputStream sink | +| 701 | java/unvalidated-url-redirection | .github/codeql/codeql-config.yml | 79 | runtime PSRedirectValidation + URI-component rebuild | 2026-08-13 | 2027-07-31 | 46 | path-level residual; Referer reduced to relative path, validateInternalRedirectUrl, rebuildInternalRedirect; GHAS ignores // codeql[java/unvalidated-url-redirection]; isolated PSCommentsSeeOther sink | +| 702 | java/unvalidated-url-redirection | .github/codeql/codeql-config.yml | 77 | runtime PSRedirectValidation + URI-component rebuild | 2026-08-13 | 2027-07-31 | 46 | path-level residual; validateInternalRedirectUrl / whitelist validateRedirectUrl then rebuild; GHAS ignores // codeql[java/unvalidated-url-redirection]; isolated PSValidatedRedirect sink | +| 502 | java/weak-cryptographic-algorithm | .github/codeql/codeql-config.yml | 36 | legacy crypto module path-ignore; AES/CBC migration tracked under accepted-risks | 2026-08-15 | 2027-07-31 | TBD | path-level residual; PSAesCBC deprecated, still wired as fallback decryption; migration requires re-encrypting stored credentials | +| 503 | java/weak-cryptographic-algorithm | .github/codeql/codeql-config.yml | 36 | legacy crypto module path-ignore; AES/CBC migration tracked under accepted-risks | 2026-08-15 | 2027-07-31 | TBD | path-level residual; second Cipher.getInstance sink; same deprecated class as #502 | +| 569 | java/static-initialization-vector | .github/codeql/codeql-config.yml | 36 | legacy crypto module path-ignore; static IV migration tracked under accepted-risks | 2026-08-15 | 2027-07-31 | TBD | path-level residual; hardcoded IV in PSAesCBC; resolved by AES-GCM migration that prepends a random nonce | +| 563 | java/xss | .github/codeql/codeql-config.yml | 39 | vendored Tomcat sample app (Hello.java + JSP demos); runtime defense not applicable | 2026-08-15 | 2027-07-31 | this PR | path-level residual; tomcat-docs is a documentation mirror of the upstream Apache Tomcat distribution | +| 564 | java/xss | .github/codeql/codeql-config.yml | 39 | vendored Tomcat sample app (Hello.java + JSP demos); runtime defense not applicable | 2026-08-15 | 2027-07-31 | this PR | path-level residual; same Hello.java class as #563 | +| 334 | js/clear-text-logging | .github/codeql/codeql-config.yml | 25 | Playwright QA tests log env-derived values for debug; production runtime not affected | 2026-08-15 | 2027-07-31 | this PR | path-level residual; tests/login.spec.js:33 logs error.message and process.env-derived CMS credentials for debug; not in production | +| 234 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 87 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: replaced /[\[]/ with /[\[]/g to make escaping global; closes both #234 and #235 | +| 235 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 87 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: same line as #234; /g flag closes both alerts | +| 454 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java | 257 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: removeIfExists checks file existence from imported-site path | +| 455 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java | 364 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: fileExists opens file derived from imported-site URL path | +| 456 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java | 420 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: saveFile opens FileWriter on imported-site path | +| 457 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java | 453 | upstream PSURLConverter.getConvertedFileSystemPath canonicalizes via getCanonicalPath; GHAS does not model canonical-path-only defense; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: loadFileFromDisk opens FileInputStream on imported-site path | +| 467 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 182 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: getCachedRegionCSSFileOnly(theme) returns a File composed only from requireSafeFileName-guarded theme + sanitized session id | +| 474 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 405 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: createFromDefault uses requireSafeFileName + transitive getNewThemeFolder guard | +| 476 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 521 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: clearCacheRegionCSS uses safeSessionSegment-guarded session id | +| 477 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 522 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: same method as #476; second FileUtils.deleteQuietly sink | +| 704 | java/path-injection | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java | 216 | PSPathInjectionGuard.requireSafeFileName above; GHAS does not model in-repo sanitizer; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line residual: getNewThemeFolder loop uses requireSafeFileName-guarded themeName | +| 705 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 88 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: regex now matches [\]\\] globally so escaping covers all bracket and backslash inputs; closes both #705 and #706 | +| 706 | js/incomplete-sanitization | cui/widgets/app/app.viewmodel.js | 88 | added /g flag + backslash escape; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: same line as #705; /g + backslash coverage closes both alerts | + diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md index be45f40970..fe3f7a8267 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md @@ -12,14 +12,15 @@ Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md Schema (per spec 004 C1): -| # | alert_id | rule_id | severity | file_path | module_owner | disposition (candidate) | target_action | target_milestone | linked_pr | notes | -|---|----------|---------|----------|-----------|--------------|-------------------------|---------------|------------------|-----------|-------| -| 1 | 718 | js/xss-through-dom | high | delivery/common/js/views/PercTagListView.js:121 | delivery | fix | code fix required | TBD | | code fix landed: replaced in-repo percSafeUrl() wrapper with an inline /^\s*(?:javascript|vbscript|data)\s*:/i regex test immediately before the .attr("href", href) sink; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 2 | 717 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:160 | delivery | fix | code fix required | TBD | | code fix landed: same inline regex pattern as #718 on the category href; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 3 | 716 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:150 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the tag href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 4 | 714 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:266 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the confirmation-page window.location value; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 5 | 713 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:78 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the redirect window.location.href value; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 6 | 712 | js/xss-through-dom | high | delivery/common/js/views/PercCategoryListView.js:195 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test in the href expression passed to $("").attr("href", ...); suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 7 | 711 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:283 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the flat-list month href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 8 | 710 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:194 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the hierarchical month href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | -| 9 | 709 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:133 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the hierarchical year href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| # | alert_id | rule_id | severity | file_path | module_owner | disposition (candidate) | target_action | target_milestone | linked_pr | notes | +|---|----------|--------------------|----------|------------------------------------------------------|--------------|-------------------------|-------------------|------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 1 | 718 | js/xss-through-dom | high | delivery/common/js/views/PercTagListView.js:121 | delivery | fix | code fix required | TBD | | code fix landed: replaced in-repo percSafeUrl() wrapper with an inline /^\s*(?:javascript | vbscript | data)\s*:/i regex test immediately before the .attr("href", href) sink; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 2 | 717 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:160 | delivery | fix | code fix required | TBD | | code fix landed: same inline regex pattern as #718 on the category href; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 3 | 716 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:150 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the tag href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 4 | 714 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:266 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the confirmation-page window.location value; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 5 | 713 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:78 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the redirect window.location.href value; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 6 | 712 | js/xss-through-dom | high | delivery/common/js/views/PercCategoryListView.js:195 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test in the href expression passed to $("").attr("href", ...); suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 7 | 711 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:283 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the flat-list month href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 8 | 710 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:194 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the hierarchical month href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | +| 9 | 709 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:133 | delivery | fix | code fix required | TBD | | code fix landed: inline regex test on the hierarchical year href; sink-line // codeql[rule-id] marker removed; suppressions.md row dropped. Awaits next GHAS scan to dismiss the alert. | + diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json new file mode 100644 index 0000000000..98efa12d65 --- /dev/null +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json @@ -0,0 +1,2753 @@ +{ + "UPGRADE_JAVA8": [ + { + "gav": "com.google.protobuf:protobuf-java@2.5.0", + "cur_version": "2.5.0", + "fix_versions": [ + "3.16.1", + "3.16.3", + "3.25.5" + ], + "java8_fixes": [ + "3.16.1", + "3.16.3", + "3.25.5" + ], + "cve_count": 5, + "cve_aliases": [ + "CVE-2021-22569", + "CVE-2022-3171", + "CVE-2022-3509", + "CVE-2022-3510", + "CVE-2024-7254" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade com.google.protobuf:protobuf-java to 3.16.1, 3.16.3, 3.25.5 (verified Java 8 compatible fix)" + }, + { + "gav": "com.fasterxml.jackson.core:jackson-core@2.21.1", + "cur_version": "2.21.1", + "fix_versions": [ + "2.21.4" + ], + "java8_fixes": [ + "2.21.4" + ], + "cve_count": 4, + "cve_aliases": [ + "CVE-2025-49128", + "CVE-2025-52999", + "CVE-2026-18401" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade com.fasterxml.jackson.core:jackson-core to 2.21.4 (verified Java 8 compatible fix)" + }, + { + "gav": "com.fasterxml.jackson.core:jackson-databind@2.21.1", + "cur_version": "2.21.1", + "fix_versions": [ + "2.21.4", + "2.21.5" + ], + "java8_fixes": [ + "2.21.4", + "2.21.5" + ], + "cve_count": 80, + "cve_aliases": [ + "BIT-nifi-2021-20190", + "CVE-2017-15095", + "CVE-2017-17485", + "CVE-2017-7525", + "CVE-2018-11307", + "CVE-2018-12022", + "CVE-2018-12023", + "CVE-2018-14718", + "CVE-2018-14719", + "CVE-2018-14720", + "CVE-2018-14721", + "CVE-2018-19360", + "CVE-2018-19361", + "CVE-2018-19362", + "CVE-2018-5968", + "CVE-2018-7489", + "CVE-2019-12086", + "CVE-2019-12384", + "CVE-2019-12814", + "CVE-2019-14379", + "CVE-2019-14439", + "CVE-2019-14540", + "CVE-2019-14892", + "CVE-2019-14893", + "CVE-2019-16335", + "CVE-2019-16942", + "CVE-2019-16943", + "CVE-2019-17267", + "CVE-2019-17531", + "CVE-2019-20330", + "CVE-2020-10650", + "CVE-2020-10672", + "CVE-2020-10673", + "CVE-2020-10968", + "CVE-2020-10969", + "CVE-2020-11111", + "CVE-2020-11112", + "CVE-2020-11113", + "CVE-2020-11619", + "CVE-2020-11620", + "CVE-2020-14060", + "CVE-2020-14061", + "CVE-2020-14062", + "CVE-2020-14195", + "CVE-2020-24616", + "CVE-2020-24750", + "CVE-2020-25649", + "CVE-2020-35490", + "CVE-2020-35491", + "CVE-2020-35728", + "CVE-2020-36179", + "CVE-2020-36180", + "CVE-2020-36181", + "CVE-2020-36182", + "CVE-2020-36183", + "CVE-2020-36184", + "CVE-2020-36185", + "CVE-2020-36186", + "CVE-2020-36187", + "CVE-2020-36188", + "CVE-2020-36189", + "CVE-2020-36518", + "CVE-2020-8840", + "CVE-2020-9546", + "CVE-2020-9547", + "CVE-2020-9548", + "CVE-2021-20190", + "CVE-2021-46877", + "CVE-2022-42003", + "CVE-2022-42004", + "CVE-2026-50193", + "CVE-2026-54512", + "CVE-2026-54513", + "CVE-2026-54514", + "CVE-2026-54515", + "CVE-2026-54516", + "CVE-2026-54517", + "CVE-2026-54518", + "CVE-2026-59888", + "CVE-2026-59889" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Upgrade com.fasterxml.jackson.core:jackson-databind to 2.21.4, 2.21.5 (verified Java 8 compatible fix)" + }, + { + "gav": "com.sun.mail:jakarta.mail@1.6.7", + "cur_version": "1.6.7", + "fix_versions": [ + "1.6.8" + ], + "java8_fixes": [ + "1.6.8" + ], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-7962" + ], + "severities": [ + "MODERATE" + ], + "reason": "Upgrade com.sun.mail:jakarta.mail to 1.6.8 (verified Java 8 compatible fix)" + }, + { + "gav": "com.github.junrar:junrar@7.5.5", + "cur_version": "7.5.5", + "fix_versions": [ + "7.5.8", + "7.5.10" + ], + "java8_fixes": [ + "7.5.8", + "7.5.10" + ], + "cve_count": 4, + "cve_aliases": [ + "CVE-2018-12418", + "CVE-2022-23596", + "CVE-2026-28208", + "CVE-2026-41245" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade com.github.junrar:junrar to 7.5.8, 7.5.10 (verified Java 8 compatible fix)" + }, + { + "gav": "io.netty:netty-codec@4.1.99.Final", + "cur_version": "4.1.99.Final", + "fix_versions": [ + "4.1.125.Final", + "4.1.133.Final", + "4.1.136.Final" + ], + "java8_fixes": [ + "4.1.125.Final", + "4.1.133.Final", + "4.1.136.Final" + ], + "cve_count": 5, + "cve_aliases": [ + "CVE-2021-37136", + "CVE-2021-37137", + "CVE-2025-58057", + "CVE-2026-42583", + "CVE-2026-59901" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade io.netty:netty-codec to 4.1.125.Final, 4.1.133.Final, 4.1.136.Final (verified Java 8 compatible fix)" + }, + { + "gav": "io.netty:netty-common@4.1.99.Final", + "cur_version": "4.1.99.Final", + "fix_versions": [ + "4.1.115.Final", + "4.1.118.Final" + ], + "java8_fixes": [ + "4.1.115.Final", + "4.1.118.Final" + ], + "cve_count": 2, + "cve_aliases": [ + "CVE-2024-47535", + "CVE-2025-25193" + ], + "severities": [ + "MODERATE" + ], + "reason": "Upgrade io.netty:netty-common to 4.1.115.Final, 4.1.118.Final (verified Java 8 compatible fix)" + }, + { + "gav": "io.netty:netty-handler@4.1.99.Final", + "cur_version": "4.1.99.Final", + "fix_versions": [ + "4.1.118.Final", + "4.1.135.Final" + ], + "java8_fixes": [ + "4.1.118.Final", + "4.1.135.Final" + ], + "cve_count": 10, + "cve_aliases": [ + "CVE-2014-3488", + "CVE-2016-4970", + "CVE-2019-20445", + "CVE-2020-11612", + "CVE-2020-7238", + "CVE-2023-34462", + "CVE-2025-24970", + "CVE-2026-44249", + "CVE-2026-45416", + "CVE-2026-50010" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade io.netty:netty-handler to 4.1.118.Final, 4.1.135.Final (verified Java 8 compatible fix)" + }, + { + "gav": "io.netty:netty-transport-native-epoll@4.1.99.Final", + "cur_version": "4.1.99.Final", + "fix_versions": [ + "4.1.135.Final" + ], + "java8_fixes": [ + "4.1.135.Final" + ], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-45536" + ], + "severities": [ + "MODERATE" + ], + "reason": "Upgrade io.netty:netty-transport-native-epoll to 4.1.135.Final (verified Java 8 compatible fix)" + }, + { + "gav": "org.apache.httpcomponents.client5:httpclient5@5.4.4", + "cur_version": "5.4.4", + "fix_versions": [ + "5.6.3" + ], + "java8_fixes": [ + "5.6.3" + ], + "cve_count": 3, + "cve_aliases": [ + "CVE-2025-27820", + "CVE-2026-40542", + "CVE-2026-64607" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.apache.httpcomponents.client5:httpclient5 to 5.6.3 (verified Java 8 compatible fix)" + }, + { + "gav": "org.apache.httpcomponents.core5:httpcore5@5.3.4", + "cur_version": "5.3.4", + "fix_versions": [ + "5.4.3" + ], + "java8_fixes": [ + "5.4.3" + ], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-54399" + ], + "severities": [ + "HIGH" + ], + "reason": "Upgrade org.apache.httpcomponents.core5:httpcore5 to 5.4.3 (verified Java 8 compatible fix)" + }, + { + "gav": "org.apache.httpcomponents.core5:httpcore5-h2@5.3.4", + "cur_version": "5.3.4", + "fix_versions": [ + "5.4.3" + ], + "java8_fixes": [ + "5.4.3" + ], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-54428" + ], + "severities": [ + "HIGH" + ], + "reason": "Upgrade org.apache.httpcomponents.core5:httpcore5-h2 to 5.4.3 (verified Java 8 compatible fix)" + }, + { + "gav": "org.apache.poi:poi-ooxml@5.2.2", + "cur_version": "5.2.2", + "fix_versions": [ + "5.4.0" + ], + "java8_fixes": [ + "5.4.0" + ], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-31672" + ], + "severities": [ + "MODERATE" + ], + "reason": "Upgrade org.apache.poi:poi-ooxml to 5.4.0 (verified Java 8 compatible fix)" + }, + { + "gav": "org.yaml:snakeyaml@1.23", + "cur_version": "1.23", + "fix_versions": [ + "1.26", + "1.31", + "1.32", + "2.0" + ], + "java8_fixes": [ + "1.26", + "1.31", + "1.32", + "2.0" + ], + "cve_count": 8, + "cve_aliases": [ + "CVE-2017-18640", + "CVE-2022-1471", + "CVE-2022-25857", + "CVE-2022-38749", + "CVE-2022-38750", + "CVE-2022-38751", + "CVE-2022-38752", + "CVE-2022-41854" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.yaml:snakeyaml to 1.26, 1.31, 1.32, 2.0 (verified Java 8 compatible fix)" + }, + { + "gav": "org.xerial.snappy:snappy-java@1.1.10.1", + "cur_version": "1.1.10.1", + "fix_versions": [ + "1.1.10.4" + ], + "java8_fixes": [ + "1.1.10.4" + ], + "cve_count": 4, + "cve_aliases": [ + "CVE-2023-34453", + "CVE-2023-34454", + "CVE-2023-34455", + "CVE-2023-43642" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.xerial.snappy:snappy-java to 1.1.10.4 (verified Java 8 compatible fix)" + }, + { + "gav": "org.apache.zookeeper:zookeeper@3.6.2", + "cur_version": "3.6.2", + "fix_versions": [ + "3.7.2" + ], + "java8_fixes": [ + "3.7.2" + ], + "cve_count": 9, + "cve_aliases": [ + "BIT-zookeeper-2023-44981", + "BIT-zookeeper-2024-23944", + "BIT-zookeeper-2024-51504", + "BIT-zookeeper-2025-58457", + "BIT-zookeeper-2026-24281", + "BIT-zookeeper-2026-24308", + "CVE-2017-5637", + "CVE-2018-8012", + "CVE-2019-0201", + "CVE-2023-44981", + "CVE-2024-23944", + "CVE-2024-51504", + "CVE-2025-58457", + "CVE-2026-24281", + "CVE-2026-24308" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.apache.zookeeper:zookeeper to 3.7.2 (verified Java 8 compatible fix)" + }, + { + "gav": "org.apache.derby:derby@10.14.2.0", + "cur_version": "10.14.2.0", + "fix_versions": [ + "10.14.2.1" + ], + "java8_fixes": [ + "10.14.2.1" + ], + "cve_count": 7, + "cve_aliases": [ + "CVE-2005-4849", + "CVE-2006-7217", + "CVE-2009-4269", + "CVE-2010-2232", + "CVE-2015-1832", + "CVE-2018-1313", + "CVE-2022-46337" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.apache.derby:derby to 10.14.2.1 (verified Java 8 compatible fix)" + }, + { + "gav": "org.eclipse.jetty:jetty-webapp@9.4.26.v20200117", + "cur_version": "9.4.26.v20200117", + "fix_versions": [ + "9.4.33.v20201020" + ], + "java8_fixes": [ + "9.4.33.v20201020" + ], + "cve_count": 3, + "cve_aliases": [ + "CVE-2020-27216", + "CVE-2021-28164", + "CVE-2021-34429" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.eclipse.jetty:jetty-webapp to 9.4.33.v20201020 (verified Java 8 compatible fix)" + }, + { + "gav": "org.jsoup:jsoup@1.22.1", + "cur_version": "1.22.1", + "fix_versions": [ + "1.23.1" + ], + "java8_fixes": [ + "1.23.1" + ], + "cve_count": 4, + "cve_aliases": [ + "CVE-2015-6748", + "CVE-2021-37714", + "CVE-2022-36033", + "CVE-2026-71497" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Upgrade org.jsoup:jsoup to 1.23.1 (verified Java 8 compatible fix)" + } + ], + "UPGRADE_REQUIRES_NEWER_JAVA": [ + { + "gav": "org.apache.activemq:activemq-broker@5.16.8", + "cur_version": "5.16.8", + "fix_versions": [ + "5.19.3", + "5.19.4", + "5.19.5", + "5.19.6", + "5.19.7" + ], + "java8_fixes": [], + "cve_count": 12, + "cve_aliases": [ + "BIT-activemq-2026-33227", + "BIT-activemq-2026-34197", + "BIT-activemq-2026-39304", + "BIT-activemq-2026-40466", + "BIT-activemq-2026-41043", + "BIT-activemq-2026-41044", + "BIT-activemq-2026-42588", + "BIT-activemq-2026-45505", + "BIT-activemq-2026-49270", + "CVE-2014-3600", + "CVE-2014-3612", + "CVE-2015-6524", + "CVE-2026-33227", + "CVE-2026-34197", + "CVE-2026-39304", + "CVE-2026-40466", + "CVE-2026-41043", + "CVE-2026-41044", + "CVE-2026-42588", + "CVE-2026-45505", + "CVE-2026-49270" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 5.19.3 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.activemq:activemq-client@5.16.8", + "cur_version": "5.16.8", + "fix_versions": [ + "5.19.3", + "5.19.4" + ], + "java8_fixes": [], + "cve_count": 18, + "cve_aliases": [ + "BIT-activemq-2023-46604", + "BIT-activemq-2025-27533", + "BIT-activemq-2026-33227", + "BIT-activemq-2026-39304", + "CVE-2013-1879", + "CVE-2013-3060", + "CVE-2014-3576", + "CVE-2014-3600", + "CVE-2014-8110", + "CVE-2015-1830", + "CVE-2015-5254", + "CVE-2015-7559", + "CVE-2016-0734", + "CVE-2016-0782", + "CVE-2016-3088", + "CVE-2016-6810", + "CVE-2018-11775", + "CVE-2019-0222", + "CVE-2023-46604", + "CVE-2025-27533", + "CVE-2026-33227", + "CVE-2026-39304" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 5.19.3 which is Java 11+/Java 17+" + }, + { + "gav": "org.bouncycastle:bcpg-jdk18on@1.83", + "cur_version": "1.83", + "fix_versions": [ + "1.84" + ], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-3505" + ], + "severities": [ + "HIGH" + ], + "reason": "Fix only in 1.84 which is Java 11+/Java 17+" + }, + { + "gav": "org.bouncycastle:bcpkix-jdk18on@1.83", + "cur_version": "1.83", + "fix_versions": [ + "1.84" + ], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2023-33202", + "CVE-2025-8916", + "CVE-2026-5588" + ], + "severities": [ + "MODERATE" + ], + "reason": "Fix only in 1.84 which is Java 11+/Java 17+" + }, + { + "gav": "org.bouncycastle:bcprov-jdk18on@1.83", + "cur_version": "1.83", + "fix_versions": [ + "1.84" + ], + "java8_fixes": [], + "cve_count": 10, + "cve_aliases": [ + "CVE-2023-33201", + "CVE-2023-33202", + "CVE-2024-29857", + "CVE-2024-30171", + "CVE-2024-30172", + "CVE-2024-34447", + "CVE-2025-14813", + "CVE-2025-8885", + "CVE-2026-0636", + "CVE-2026-5598" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 1.84 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.cxf:cxf-core@3.5.11", + "cur_version": "3.5.11", + "fix_versions": [ + "3.6.12" + ], + "java8_fixes": [], + "cve_count": 13, + "cve_aliases": [ + "CVE-2014-0035", + "CVE-2014-0109", + "CVE-2014-0110", + "CVE-2016-6812", + "CVE-2016-8739", + "CVE-2017-12624", + "CVE-2017-5653", + "CVE-2017-5656", + "CVE-2022-46363", + "CVE-2022-46364", + "CVE-2025-23184", + "CVE-2025-48795", + "CVE-2026-50645" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 3.6.12 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.logging.log4j:log4j-1.2-api@2.25.3", + "cur_version": "2.25.3", + "fix_versions": [ + "2.25.4" + ], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-34479" + ], + "severities": [ + "MODERATE" + ], + "reason": "Fix only in 2.25.4 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.logging.log4j:log4j-api@2.25.3", + "cur_version": "2.25.3", + "fix_versions": [ + "2.25.5" + ], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-49844" + ], + "severities": [ + "MODERATE" + ], + "reason": "Fix only in 2.25.5 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.logging.log4j:log4j-core@2.25.3", + "cur_version": "2.25.3", + "fix_versions": [ + "2.25.4" + ], + "java8_fixes": [], + "cve_count": 11, + "cve_aliases": [ + "CVE-2017-5645", + "CVE-2020-9488", + "CVE-2021-44228", + "CVE-2021-44832", + "CVE-2021-45046", + "CVE-2021-45105", + "CVE-2023-26464", + "CVE-2025-68161", + "CVE-2026-34477", + "CVE-2026-34478", + "CVE-2026-34480" + ], + "severities": [ + "CRITICAL", + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Fix only in 2.25.4 which is Java 11+/Java 17+" + }, + { + "gav": "org.springframework:spring-web@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [ + "6.0.0" + ], + "java8_fixes": [], + "cve_count": 13, + "cve_aliases": [ + "CVE-2013-6429", + "CVE-2013-6430", + "CVE-2015-3192", + "CVE-2016-1000027", + "CVE-2018-11039", + "CVE-2021-22118", + "CVE-2024-22243", + "CVE-2024-22259", + "CVE-2024-22262", + "CVE-2024-38809", + "CVE-2024-38820", + "CVE-2025-41234", + "CVE-2026-41854" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 6.0.0 which is Java 11+/Java 17+" + }, + { + "gav": "org.springframework:spring-webmvc@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [ + "5.3.42" + ], + "java8_fixes": [], + "cve_count": 25, + "cve_aliases": [ + "CVE-2014-0054", + "CVE-2014-0225", + "CVE-2014-1904", + "CVE-2014-3625", + "CVE-2016-9878", + "CVE-2020-5397", + "CVE-2020-5398", + "CVE-2022-22965", + "CVE-2023-20860", + "CVE-2023-34053", + "CVE-2024-38816", + "CVE-2024-38819", + "CVE-2024-38828", + "CVE-2025-41242", + "CVE-2026-22735", + "CVE-2026-22737", + "CVE-2026-22741", + "CVE-2026-22745", + "CVE-2026-41841", + "CVE-2026-41842", + "CVE-2026-41843", + "CVE-2026-41844", + "CVE-2026-41845", + "CVE-2026-41846", + "CVE-2026-41853" + ], + "severities": [ + "CRITICAL", + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Fix only in 5.3.42 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.tika:tika-core@2.9.4", + "cur_version": "2.9.4", + "fix_versions": [ + "3.2.2" + ], + "java8_fixes": [], + "cve_count": 13, + "cve_aliases": [ + "CVE-2016-4434", + "CVE-2016-6809", + "CVE-2018-11761", + "CVE-2018-11762", + "CVE-2018-11796", + "CVE-2018-1335", + "CVE-2018-1338", + "CVE-2018-8017", + "CVE-2019-10088", + "CVE-2019-10094", + "CVE-2022-30126", + "CVE-2022-30973", + "CVE-2025-66516" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 3.2.2 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.tika:tika-parser-pdf-module@2.9.4", + "cur_version": "2.9.4", + "fix_versions": [ + "3.2.2" + ], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2025-54988", + "CVE-2025-66516" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Fix only in 3.2.2 which is Java 11+/Java 17+" + }, + { + "gav": "org.springframework.security:spring-security-crypto@5.8.16", + "cur_version": "5.8.16", + "fix_versions": [ + "5.8.18" + ], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-22228" + ], + "severities": [ + "HIGH" + ], + "reason": "Fix only in 5.8.18 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.jackrabbit:jackrabbit-jcr-commons@2.20.17", + "cur_version": "2.20.17", + "fix_versions": [ + "2.22.2" + ], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-58782" + ], + "severities": [ + "MODERATE" + ], + "reason": "Fix only in 2.22.2 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.shiro:shiro-core@2.1.0", + "cur_version": "2.1.0", + "fix_versions": [ + "2.2.0", + "2.2.1" + ], + "java8_fixes": [], + "cve_count": 12, + "cve_aliases": [ + "CVE-2016-4437", + "CVE-2019-12422", + "CVE-2020-11989", + "CVE-2020-13933", + "CVE-2020-1957", + "CVE-2021-41303", + "CVE-2022-32532", + "CVE-2022-40664", + "CVE-2023-46749", + "CVE-2026-23901", + "CVE-2026-43827", + "CVE-2026-49268" + ], + "severities": [ + "CRITICAL", + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Fix only in 2.2.0 which is Java 11+/Java 17+" + }, + { + "gav": "org.apache.shiro:shiro-web@2.1.0", + "cur_version": "2.1.0", + "fix_versions": [ + "2.2.0" + ], + "java8_fixes": [], + "cve_count": 5, + "cve_aliases": [ + "CVE-2016-6802", + "CVE-2020-17523", + "CVE-2023-34478", + "CVE-2023-46750", + "CVE-2026-43828" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Fix only in 2.2.0 which is Java 11+/Java 17+" + } + ], + "NO_JAVA8_UPGRADE": [ + { + "gav": "org.apache.activemq:activemq-openwire-legacy@5.16.8", + "cur_version": "5.16.8", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "BIT-activemq-2023-46604", + "BIT-activemq-2025-27533", + "CVE-2023-46604", + "CVE-2025-27533" + ], + "severities": [ + "CRITICAL", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.ant:ant@1.10.14", + "cur_version": "1.10.14", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 4, + "cve_aliases": [ + "BIT-gradle-2020-11979", + "CVE-2020-11979", + "CVE-2020-1945", + "CVE-2021-36373", + "CVE-2021-36374", + "GHSA-j45w-qrgf-25vm" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.james:apache-mime4j-core@0.8.12", + "cur_version": "0.8.12", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2024-21742" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.amazonaws:aws-java-sdk-s3@1.12.797", + "cur_version": "1.12.797", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2022-31159" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "axis:axis@1.4.2", + "cur_version": "1.4.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 6, + "cve_aliases": [ + "CVE-2012-5784", + "CVE-2014-3596", + "CVE-2018-8032", + "CVE-2019-0227", + "CVE-2023-40743", + "CVE-2023-51441" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.axis:axis@1.4.1-SNAPSHOT", + "cur_version": "1.4.1-SNAPSHOT", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 7, + "cve_aliases": [ + "CVE-2007-2353", + "CVE-2012-5784", + "CVE-2014-3596", + "CVE-2018-8032", + "CVE-2019-0227", + "CVE-2023-40743", + "CVE-2023-51441" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.bouncycastle:bctls-jdk18on@1.83", + "cur_version": "1.83", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 4, + "cve_aliases": [ + "CVE-2024-29857", + "CVE-2024-30171", + "CVE-2024-30172", + "CVE-2025-8885" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "io.github.classgraph:classgraph@4.8.184", + "cur_version": "4.8.184", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-47621" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-beanutils:commons-beanutils@1.11.0", + "cur_version": "1.11.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2014-0114", + "CVE-2019-10086", + "CVE-2025-48734" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-collections:commons-collections@3.2.2", + "cur_version": "3.2.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2015-6420", + "CVE-2015-7501" + ], + "severities": [ + "CRITICAL", + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.commons:commons-compress@1.28.0", + "cur_version": "1.28.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 11, + "cve_aliases": [ + "CVE-2012-2098", + "CVE-2018-11771", + "CVE-2018-1324", + "CVE-2019-12402", + "CVE-2021-35515", + "CVE-2021-35516", + "CVE-2021-35517", + "CVE-2021-36090", + "CVE-2023-42503", + "CVE-2024-25710", + "CVE-2024-26308" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-configuration:commons-configuration@1.10", + "cur_version": "1.10", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-46392" + ], + "severities": [ + "LOW" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.commons:commons-email@1.6.0", + "cur_version": "1.6.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2017-9801", + "CVE-2018-1294" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-fileupload:commons-fileupload@1.6.0", + "cur_version": "1.6.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 7, + "cve_aliases": [ + "CVE-2013-0248", + "CVE-2013-2186", + "CVE-2014-0050", + "CVE-2016-1000031", + "CVE-2016-3092", + "CVE-2023-24998", + "CVE-2025-48976" + ], + "severities": [ + "CRITICAL", + "HIGH", + "LOW" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-httpclient:commons-httpclient@3.1", + "cur_version": "3.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2012-5783" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-io:commons-io@2.21.0", + "cur_version": "2.21.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2021-29425", + "CVE-2024-47554" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-lang:commons-lang@2.6", + "cur_version": "2.6", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-48924" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "commons-net:commons-net@3.12.0", + "cur_version": "3.12.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-37533" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.owasp:csrfguard@4.5.0", + "cur_version": "4.5.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-28490" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.cxf:cxf-rt-frontend-jaxrs@3.5.11", + "cur_version": "3.5.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 4, + "cve_aliases": [ + "CVE-2010-2076", + "CVE-2013-0239", + "CVE-2013-2160", + "CVE-2014-3584" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.cxf:cxf-rt-transports-http@3.5.11", + "cur_version": "3.5.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2012-5575", + "CVE-2018-8039", + "CVE-2024-41172" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.googlecode.plist:dd-plist@1.28", + "cur_version": "1.28", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2016-15026" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.dom4j:dom4j@2.1.5", + "cur_version": "2.1.5", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2018-1000632", + "CVE-2020-10683" + ], + "severities": [ + "CRITICAL", + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.xmlgraphics:fop@2.11", + "cur_version": "2.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2017-5661" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.xmlgraphics:fop-core@2.11", + "cur_version": "2.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2024-28168" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.google.oauth-client:google-oauth-client@1.39.0", + "cur_version": "1.39.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2020-7692", + "CVE-2021-22573", + "SNYK-JAVA-COMGOOGLEOAUTHCLIENT-575276" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "io.grpc:grpc-netty-shaded@1.80.0", + "cur_version": "1.80.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-55163" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "io.grpc:grpc-protobuf@1.80.0", + "cur_version": "1.80.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2023-1428", + "CVE-2023-32731", + "CVE-2023-32732", + "PYSEC-2026-1425", + "PYSEC-2026-1426", + "PYSEC-2026-1427" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.google.code.gson:gson@2.13.2", + "cur_version": "2.13.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2022-25647", + "SNYK-JAVA-COMGOOGLECODEGSON-1730327" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.google.guava:guava@33.5.0-jre", + "cur_version": "33.5.0-jre", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2018-10237", + "CVE-2020-8908", + "CVE-2023-2976", + "SNYK-JAVA-COMGOOGLEGUAVA-1015415" + ], + "severities": [ + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.hibernate:hibernate-core@5.6.15.Final", + "cur_version": "5.6.15.Final", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2019-14900", + "CVE-2020-25638", + "CVE-2026-0603" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.hibernate.validator:hibernate-validator@6.2.5.Final", + "cur_version": "6.2.5.Final", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 4, + "cve_aliases": [ + "CVE-2019-10219", + "CVE-2020-10693", + "CVE-2023-1932", + "CVE-2025-35036" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.eclipse.jetty.http2:http2-hpack@9.4.53.v20231009", + "cur_version": "9.4.53.v20231009", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "BIT-jenkins-2023-36478", + "CVE-2023-36478" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.httpcomponents:httpclient@4.5.14", + "cur_version": "4.5.14", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 6, + "cve_aliases": [ + "CVE-2011-1498", + "CVE-2012-6153", + "CVE-2013-4366", + "CVE-2014-3577", + "CVE-2015-5262", + "CVE-2020-13956" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.httpcomponents:httpclient@4.5.13", + "cur_version": "4.5.13", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 6, + "cve_aliases": [ + "CVE-2011-1498", + "CVE-2012-6153", + "CVE-2013-4366", + "CVE-2014-3577", + "CVE-2015-5262", + "CVE-2020-13956" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.twelvemonkeys.imageio:imageio-metadata@3.13.1", + "cur_version": "3.13.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-23792" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor@2.17.2", + "cur_version": "2.17.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2020-28491" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml@2.21.1", + "cur_version": "2.21.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2016-3720", + "CVE-2016-7051" + ], + "severities": [ + "CRITICAL", + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.fasterxml.jackson.datatype:jackson-datatype-jsr310@2.21.1", + "cur_version": "2.21.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2018-1000873" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.jasypt:jasypt@1.9.3", + "cur_version": "1.9.3", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2014-9970" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.glassfish:javax.el@3.0.0", + "cur_version": "3.0.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-28170" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.jdom:jdom2@2.0.6.1", + "cur_version": "2.0.6.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "BIT-solr-2021-33813", + "CVE-2021-33813" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.codehaus.jettison:jettison@1.5.4", + "cur_version": "1.5.4", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 5, + "cve_aliases": [ + "CVE-2022-40149", + "CVE-2022-40150", + "CVE-2022-45685", + "CVE-2022-45693", + "CVE-2023-1436" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.jcraft:jsch@0.1.55", + "cur_version": "0.1.55", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2016-5725" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.json:json@20251224", + "cur_version": "20251224", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2022-45688", + "CVE-2023-5072" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "net.sf.json-lib:json-lib@2.4", + "cur_version": "2.4", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2024-47855" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.jsoup:jsoup@1.23.1", + "cur_version": "1.23.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 4, + "cve_aliases": [ + "CVE-2015-6748", + "CVE-2021-37714", + "CVE-2022-36033", + "CVE-2026-71497" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "junit:junit@4.13.2", + "cur_version": "4.13.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2020-15250" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.drewnoakes:metadata-extractor@2.19.0", + "cur_version": "2.19.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2022-24613", + "CVE-2022-24614" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.myfaces.core:myfaces-impl@2.3.11", + "cur_version": "2.3.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2010-2057", + "CVE-2011-4367" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "io.netty:netty-transport-classes-epoll@4.1.99.Final", + "cur_version": "4.1.99.Final", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-42577" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.pdfbox:pdfbox@2.0.31", + "cur_version": "2.0.31", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 8, + "cve_aliases": [ + "CVE-2016-2175", + "CVE-2018-11797", + "CVE-2018-8036", + "CVE-2019-0228", + "CVE-2021-27807", + "CVE-2021-27906", + "CVE-2021-31811", + "CVE-2021-31812" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.owasp.antisamy:antisamy@1.7.8", + "cur_version": "1.7.8", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 7, + "cve_aliases": [ + "CVE-2016-10006", + "CVE-2017-14735", + "CVE-2021-35043", + "CVE-2022-28367", + "CVE-2022-29577", + "CVE-2023-43643", + "CVE-2024-23635" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.commons:commons-collections4@4.5.0", + "cur_version": "4.5.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2015-6420", + "CVE-2015-7501" + ], + "severities": [ + "CRITICAL", + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.commons:commons-lang3@3.20.0", + "cur_version": "3.20.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-48924" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.commons:commons-text@1.15.0", + "cur_version": "1.15.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2022-42889" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.owasp.esapi:esapi@2.7.0.0", + "cur_version": "2.7.0.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 7, + "cve_aliases": [ + "CVE-2010-3300", + "CVE-2013-5679", + "CVE-2013-5960", + "CVE-2022-23457", + "CVE-2022-24891" + ], + "severities": [ + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.xmlgraphics:xmlgraphics-commons@2.11", + "cur_version": "2.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2020-11988" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.thoughtworks.xstream:xstream@1.4.21", + "cur_version": "1.4.21", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 37, + "cve_aliases": [ + "BIT-activemq-2020-26217", + "BIT-activemq-2021-21341", + "BIT-activemq-2021-21342", + "BIT-activemq-2021-21343", + "BIT-activemq-2021-21344", + "BIT-activemq-2021-21345", + "BIT-activemq-2021-21346", + "BIT-activemq-2021-21347", + "BIT-activemq-2021-21348", + "BIT-activemq-2021-21349", + "BIT-activemq-2021-21350", + "BIT-activemq-2021-21351", + "BIT-jenkins-2021-43859", + "CVE-2013-7285", + "CVE-2016-3674", + "CVE-2017-7957", + "CVE-2019-10173", + "CVE-2020-26217", + "CVE-2020-26258", + "CVE-2020-26259", + "CVE-2021-21341", + "CVE-2021-21342", + "CVE-2021-21343", + "CVE-2021-21344", + "CVE-2021-21345", + "CVE-2021-21346", + "CVE-2021-21347", + "CVE-2021-21348", + "CVE-2021-21349", + "CVE-2021-21350", + "CVE-2021-21351", + "CVE-2021-29505", + "CVE-2021-39139", + "CVE-2021-39140", + "CVE-2021-39141", + "CVE-2021-39144", + "CVE-2021-39145", + "CVE-2021-39146", + "CVE-2021-39147", + "CVE-2021-39148", + "CVE-2021-39149", + "CVE-2021-39150", + "CVE-2021-39151", + "CVE-2021-39152", + "CVE-2021-39153", + "CVE-2021-39154", + "CVE-2021-43859", + "CVE-2022-40151", + "CVE-2022-41966", + "CVE-2024-47072" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.poi:poi@5.2.2", + "cur_version": "5.2.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 7, + "cve_aliases": [ + "CVE-2012-0213", + "CVE-2014-3529", + "CVE-2014-3574", + "CVE-2014-9527", + "CVE-2017-12626", + "CVE-2017-5644", + "CVE-2019-12415" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.poi:poi-scratchpad@5.2.2", + "cur_version": "5.2.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2012-0213", + "CVE-2022-26336" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.google.protobuf:protobuf-java@4.33.2", + "cur_version": "4.33.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 5, + "cve_aliases": [ + "CVE-2021-22569", + "CVE-2022-3171", + "CVE-2022-3509", + "CVE-2022-3510", + "CVE-2024-7254" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.quartz-scheduler:quartz@2.4.1", + "cur_version": "2.4.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2019-13990" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.simpleframework:simple-xml@2.7.1", + "cur_version": "2.7.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2017-1000190" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.yaml:snakeyaml@2.6", + "cur_version": "2.6", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 8, + "cve_aliases": [ + "CVE-2017-18640", + "CVE-2022-1471", + "CVE-2022-25857", + "CVE-2022-38749", + "CVE-2022-38750", + "CVE-2022-38751", + "CVE-2022-38752", + "CVE-2022-41854" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.solr:solr-solrj@8.11.4", + "cur_version": "8.11.4", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "BIT-solr-2020-13957", + "BIT-solr-2023-50298", + "CVE-2020-13957", + "CVE-2023-50298" + ], + "severities": [ + "CRITICAL", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework:spring-beans@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2022-22965", + "CVE-2022-22970" + ], + "severities": [ + "CRITICAL", + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework:spring-context@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2022-22968", + "CVE-2024-38820", + "CVE-2025-22233" + ], + "severities": [ + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework:spring-core@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 19, + "cve_aliases": [ + "CVE-2009-1190", + "CVE-2011-2730", + "CVE-2011-2894", + "CVE-2014-3578", + "CVE-2015-0201", + "CVE-2015-5211", + "CVE-2016-5007", + "CVE-2018-11040", + "CVE-2018-1199", + "CVE-2018-1257", + "CVE-2018-1258", + "CVE-2018-1271", + "CVE-2018-1272", + "CVE-2018-15756", + "CVE-2021-22060", + "CVE-2021-22096", + "CVE-2024-22233", + "CVE-2025-41249", + "CVE-2026-41848" + ], + "severities": [ + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework:spring-expression@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 8, + "cve_aliases": [ + "CVE-2022-22950", + "CVE-2023-20861", + "CVE-2023-20863", + "CVE-2024-38808", + "CVE-2026-41849", + "CVE-2026-41850", + "CVE-2026-41851", + "CVE-2026-41852" + ], + "severities": [ + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework:spring-messaging@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2018-1270", + "CVE-2018-1275", + "CVE-2022-22971" + ], + "severities": [ + "CRITICAL", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework:spring-oxm@5.3.39", + "cur_version": "5.3.39", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2013-4152", + "CVE-2013-7315" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.webjars:swagger-ui@5.31.2", + "cur_version": "5.31.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2018-25031", + "CVE-2019-17495" + ], + "severities": [ + "CRITICAL", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.fasterxml.woodstox:woodstox-core@6.5.1", + "cur_version": "6.5.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2022-40152" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "xerces:xercesImpl@2.12.2", + "cur_version": "2.12.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 5, + "cve_aliases": [ + "CVE-2009-2625", + "CVE-2012-0881", + "CVE-2013-4002", + "CVE-2020-14338", + "CVE-2022-23437" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.xmlbeans:xmlbeans@5.0.3", + "cur_version": "5.0.3", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-23926" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.adobe.xmp:xmpcore@6.1.11", + "cur_version": "6.1.11", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2016-4216" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache-extras.beanshell:bsh@2.0b6", + "cur_version": "2.0b6", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2016-2510" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.glassfish.jersey.core:jersey-client@2.47", + "cur_version": "2.47", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-12383" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.glassfish.jersey.core:jersey-common@2.47", + "cur_version": "2.47", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2021-28168" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.liquibase:liquibase-core@4.33.0", + "cur_version": "4.33.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2022-0839" + ], + "severities": [ + "CRITICAL" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.microsoft.sqlserver:mssql-jdbc@13.3.0", + "cur_version": "13.3.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-59250" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.microsoft.sqlserver:mssql-jdbc@13.3.0.jre8-preview", + "cur_version": "13.3.0.jre8-preview", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-59250" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "com.mysql:mysql-connector-j@8.4.0", + "cur_version": "8.4.0", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2023-22102" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework.security:spring-security-config@5.8.16", + "cur_version": "5.8.16", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 5, + "cve_aliases": [ + "CVE-2023-34034", + "CVE-2023-34035", + "CVE-2023-34042", + "CVE-2026-22753", + "CVE-2026-22754" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework.security:spring-security-core@5.8.16", + "cur_version": "5.8.16", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 31, + "cve_aliases": [ + "CVE-2010-3700", + "CVE-2011-2731", + "CVE-2011-2732", + "CVE-2011-2894", + "CVE-2012-5055", + "CVE-2014-0097", + "CVE-2014-3527", + "CVE-2016-5007", + "CVE-2016-9879", + "CVE-2017-4995", + "CVE-2018-1199", + "CVE-2018-15801", + "CVE-2019-11272", + "CVE-2019-3795", + "CVE-2020-5407", + "CVE-2020-5408", + "CVE-2021-22119", + "CVE-2022-22976", + "CVE-2022-22978", + "CVE-2022-31692", + "CVE-2023-20862", + "CVE-2024-22234", + "CVE-2024-22257", + "CVE-2024-38810", + "CVE-2024-38827", + "CVE-2025-22223", + "CVE-2025-22234", + "CVE-2025-41232", + "CVE-2025-41248", + "CVE-2026-22746", + "CVE-2026-22751" + ], + "severities": [ + "CRITICAL", + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework.security:spring-security-web@5.8.16", + "cur_version": "5.8.16", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 7, + "cve_aliases": [ + "CVE-2021-22112", + "CVE-2022-22978", + "CVE-2024-38821", + "CVE-2026-22732", + "CVE-2026-22747", + "CVE-2026-41706", + "CVE-2026-47838" + ], + "severities": [ + "CRITICAL", + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.tomcat:tomcat-juli@9.0.118", + "cur_version": "9.0.118", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2007-5342" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.tomcat:tomcat-servlet-api@9.0.118", + "cur_version": "9.0.118", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2001-0590" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.springframework.ldap:spring-ldap-core@2.4.4", + "cur_version": "2.4.4", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "CVE-2017-8028", + "CVE-2024-38829", + "CVE-2026-41720" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.mozilla:rhino@1.7.15.1", + "cur_version": "1.7.15.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2025-66453" + ], + "severities": [ + "LOW" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "soap:soap@2.3.1", + "cur_version": "2.3.1", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2022-40705", + "CVE-2022-45378" + ], + "severities": [ + "CRITICAL", + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.xerial:sqlite-jdbc@3.43.2.2", + "cur_version": "3.43.2.2", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2023-32697" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.eclipse.jetty:jetty-util@9.4.58.v20250814", + "cur_version": "9.4.58.v20250814", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2026-8384" + ], + "severities": [ + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.eclipse.jetty.http2:http2-common@9.4.58.v20250814", + "cur_version": "9.4.58.v20250814", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 3, + "cve_aliases": [ + "BIT-apisix-2023-44487", + "BIT-aspnet-core-2023-44487", + "BIT-contour-2023-44487", + "BIT-dotnet-2023-44487", + "BIT-dotnet-sdk-2023-44487", + "BIT-envoy-2023-44487", + "BIT-golang-2023-44487", + "BIT-jenkins-2023-44487", + "BIT-kong-2023-44487", + "BIT-nginx-2023-44487", + "BIT-nginx-gateway-2023-44487", + "BIT-node-2023-44487", + "BIT-node-min-2023-44487", + "BIT-solr-2023-44487", + "BIT-tomcat-2023-44487", + "BIT-varnish-2023-44487", + "CVE-2023-44487", + "CVE-2024-22201", + "CVE-2025-5115" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.eclipse.jetty.http2:http2-hpack@9.4.58.v20250814", + "cur_version": "9.4.58.v20250814", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "BIT-jenkins-2023-36478", + "CVE-2023-36478" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.eclipse.jetty.http2:http2-server@9.4.58.v20250814", + "cur_version": "9.4.58.v20250814", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "BIT-apisix-2023-44487", + "BIT-aspnet-core-2023-44487", + "BIT-contour-2023-44487", + "BIT-dotnet-2023-44487", + "BIT-dotnet-sdk-2023-44487", + "BIT-envoy-2023-44487", + "BIT-golang-2023-44487", + "BIT-jenkins-2022-2048", + "BIT-jenkins-2023-44487", + "BIT-kong-2023-44487", + "BIT-nginx-2023-44487", + "BIT-nginx-gateway-2023-44487", + "BIT-node-2023-44487", + "BIT-node-min-2023-44487", + "BIT-solr-2023-44487", + "BIT-tomcat-2023-44487", + "BIT-varnish-2023-44487", + "CVE-2022-2048", + "CVE-2023-44487" + ], + "severities": [ + "HIGH", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.eclipse.jetty:jetty-server@9.4.58.v20250814", + "cur_version": "9.4.58.v20250814", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 29, + "cve_aliases": [ + "BIT-jenkins-2021-28165", + "BIT-kafka-2020-27218", + "BIT-nifi-2020-27223", + "BIT-solr-2020-27223", + "BIT-spark-2020-27218", + "BIT-spark-2020-27223", + "CVE-2006-6969", + "CVE-2011-4461", + "CVE-2015-2080", + "CVE-2016-4800", + "CVE-2017-7656", + "CVE-2017-7657", + "CVE-2017-7658", + "CVE-2017-9735", + "CVE-2018-12536", + "CVE-2018-12538", + "CVE-2018-12545", + "CVE-2019-10241", + "CVE-2019-10246", + "CVE-2019-10247", + "CVE-2019-17632", + "CVE-2019-17638", + "CVE-2020-27218", + "CVE-2020-27223", + "CVE-2021-28165", + "CVE-2021-34428", + "CVE-2022-2191", + "CVE-2023-26048", + "CVE-2023-26049", + "CVE-2024-13009", + "CVE-2024-7708", + "CVE-2024-8184", + "CVE-2026-10051", + "CVE-2026-1605", + "CVE-2026-6790" + ], + "severities": [ + "CRITICAL", + "HIGH", + "LOW", + "MODERATE" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.taglibs:taglibs-standard-impl@1.2.5", + "cur_version": "1.2.5", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 1, + "cve_aliases": [ + "CVE-2015-0254" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + }, + { + "gav": "org.apache.sanselan:sanselan@0.97-incubator", + "cur_version": "0.97-incubator", + "fix_versions": [], + "java8_fixes": [], + "cve_count": 2, + "cve_aliases": [ + "CVE-2018-17201", + "CVE-2018-17202" + ], + "severities": [ + "HIGH" + ], + "reason": "Current version is the latest Java 8 line; CVEs have no Java 8 fix" + } + ] +} \ No newline at end of file diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/01-tier1-java8-upgrades.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/01-tier1-java8-upgrades.md new file mode 100644 index 0000000000..092e6dfe8a --- /dev/null +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/01-tier1-java8-upgrades.md @@ -0,0 +1,66 @@ +## Summary + +OWASP dependency-check on the `main` branch (Java 1.8 build target) reports **657 CVE matches across 136 unique Maven GAVs**. Of those, **19 GAVs (153 CVEs) can be closed by a drop-in `` bump in the root `pom.xml`** with a fix that is verified Java 1.8 compatible (bytecode major version ≤ 52 or Java 9 bytecode that runs on Java 8+). No source-code changes are expected for any of these bumps. + +This issue tracks getting all 19 upgrades merged. + +## Why + +- 19 GAVs is the **single highest-ROI win** in the whole dependency report. The other 117 GAVs either require a Java 11+ migration or are at the latest Java 1.8 line. +- The biggest single move is `jackson.version=2.21.5` in the root pom, which closes **80 CVEs** by itself. +- None of the proposed fix versions introduce a bytecode level that breaks the Java 1.8 build (each was bytecode-verified on Maven Central against the current JDK 1.8.0_504). + +## List of upgrades + +All version bumps go in the root `pom.xml` `` block (or per-module POMs if a property is overridden). The "current" version is what the project declares today; the "fix" version(s) are verified Java 1.8 compatible. + +| # | GAV | Current | Fix | CVEs closed | Severity | +|----|-------------------------------------------------|------------------|-----------------------|-------------|--------------------------| +| 1 | `com.fasterxml.jackson.core:jackson-databind` | 2.21.1 | **2.21.5** | 80 | CRITICAL, HIGH | +| 2 | `io.netty:netty-handler` | 4.1.99.Final | **4.1.135.Final** | 10 | HIGH, MODERATE | +| 3 | `org.apache.zookeeper:zookeeper` | 3.6.2 | **3.7.2** | 9 | CRITICAL, HIGH, MODERATE | +| 4 | `org.yaml:snakeyaml` | 1.23 | **1.32** (or **2.0**) | 8 | HIGH, MODERATE | +| 5 | `org.apache.derby:derby` | 10.14.2.0 | **10.14.2.1** | 7 | CRITICAL, HIGH | +| 6 | `com.google.protobuf:protobuf-java` | 2.5.0 | **3.25.5** | 5 | HIGH, MODERATE | +| 7 | `io.netty:netty-codec` | 4.1.99.Final | **4.1.136.Final** | 5 | HIGH, MODERATE | +| 8 | `com.fasterxml.jackson.core:jackson-core` | 2.21.1 | **2.21.4** | 4 | HIGH, MODERATE | +| 9 | `com.github.junrar:junrar` | 7.5.5 | **7.5.10** | 4 | HIGH, MODERATE | +| 10 | `org.xerial.snappy:snappy-java` | 1.1.10.1 | **1.1.10.4** | 4 | HIGH, MODERATE | +| 11 | `org.jsoup:jsoup` | 1.22.1 | **1.23.1** | 4 | HIGH, MODERATE | +| 12 | `org.apache.httpcomponents.client5:httpclient5` | 5.4.4 | **5.6.3** | 3 | HIGH, MODERATE | +| 13 | `org.eclipse.jetty:jetty-webapp` | 9.4.26.v20200117 | **9.4.33.v20201020** | 3 | HIGH, MODERATE | +| 14 | `io.netty:netty-common` | 4.1.99.Final | **4.1.118.Final** | 2 | MODERATE | +| 15 | `com.sun.mail:jakarta.mail` | 1.6.7 | **1.6.8** | 1 | MODERATE | +| 16 | `io.netty:netty-transport-native-epoll` | 4.1.99.Final | **4.1.135.Final** | 1 | MODERATE | +| 17 | `org.apache.httpcomponents.core5:httpcore5` | 5.3.4 | **5.4.3** | 1 | HIGH | +| 18 | `org.apache.httpcomponents.core5:httpcore5-h2` | 5.3.4 | **5.4.3** | 1 | HIGH | +| 19 | `org.apache.poi:poi-ooxml` | 5.2.2 | **5.4.0** | 1 | MODERATE | + +## Notes per row + +- **#1 jackson-databind 2.21.1 → 2.21.5**: highest ROI. The `jackson.version` property in the root pom controls this. No transitive API breaks between 2.21.1 and 2.21.5. +- **#4 snakeyaml**: 1.x is fine if any consumer still needs the old API. Otherwise jump straight to 2.0 (Java 8 compatible, no breaking change to typical usage). +- **#6 protobuf-java 2.5.0 → 3.25.5**: a 7-year major jump. Worth a smoke test (especially around any `.proto` files compiled with the old `protoc`). The 3.25.5 jar is Java 8 bytecode (major 52). +- **#7 / #14 netty**: there are many `io.netty:netty-*` artifacts in the pom. They all share a `nettyall.version` property; bumping the single property covers all of them. Verify `netty-transport-native-epoll` and `netty-transport-classes-epoll` line up. +- **#13 jetty-webapp 9.4.26 → 9.4.33**: also bump `jetty.version` from 9.4.26 to 9.4.58 (the project already has 9.4.58.v20250814 in `jetty.version`; this row is just for the straggler jetty-webapp entry that wasn't aligned). +- **#15 jakarta.mail 1.6.7 → 1.6.8**: note this is `jakarta.mail` (the older `com.sun.mail:jakarta.mail` artifact), not the `jakarta.mail:jakarta.mail-api` namespace. +- **#17/#18 httpcore5 5.3.4 → 5.4.3**: keep `httpcore5.version` and `httpcore5-h2.version` in sync. + +## Acceptance criteria + +- All 19 GAVs in the table above are upgraded to the listed fix version (or the next available patch if a newer one ships before this is merged; verify Java 1.8 compatibility first). +- `./mvn-env.sh clean install -DskipTests` succeeds on Java 1.8. +- `./mvn-env.sh dependency-check:check` reports a 19-GAV reduction in the "Dependency with vulnerable components" count. +- QA regression run on `system` and `WebUI` smoke tests passes. + +## Out of scope + +- The remaining 117 GAVs flagged by OWASP dependency-check are tracked in the parent epic (separate issue). +- No code changes are expected for this issue; the bumps are version-only. + +## References + +- Full analysis: `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md` +- Machine-readable per-GAV data: `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json` (key `UPGRADE_JAVA8`) +- Per-module OWASP HTML reports at `/target/dependency-check-report.html` + diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md new file mode 100644 index 0000000000..f9831489f4 --- /dev/null +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md @@ -0,0 +1,128 @@ +## Summary — EPIC + +OWASP dependency-check on the `main` branch (Java 1.8 build target) reports **657 CVE matches across 136 unique Maven GAVs**. After the Tier 1 Java-1.8-bumpable set (19 GAVs, 153 CVEs) is closed, **117 GAVs (504 CVEs) remain unfixed**. This epic tracks the remaining work. + +Java 11+ migration is **explicitly out of scope** for the `main` branch. The mitigations in this issue are Java 1.8-compatible by design. + +## How the GAVs break down + +| Subset | GAVs | CVEs | Why | +|-------------------------------------------------------------------|--------------------|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Tier 2** — fix only in a newer major that requires Java 11+/17+ | 17 | 142 | Spring 6.x, Bouncy Castle 1.78+, Apache Tika 3.x, CXF 3.6.x, ActiveMQ 5.19.x, Shiro 2.x, Spring 6.x, jackrabbit 2.22.x, etc. | +| **Tier 3** — at the latest Java 1.8 line; no Java 1.8 fix exists | 100 | 362 | Maintainer dropped Java 1.8 from the support matrix. Examples: xstream 1.4.21, spring-security 5.8.16, jetty 9.4.58, commons-compress 1.28.0, pdfbox 2.0.31, tika 2.9.4, log4j 2.25.3, hibernate 5.6.15.Final, snakeyaml 2.6. | +| **EOL with no fix ever** | (subset of Tier 3) | — | commons-lang 2.6, commons-collections 3.2.2, commons-beanutils 1.11.0, commons-httpclient 3.1, commons-configuration 1.10, commons-fileupload 1.6.0, jasypt 1.9.3, bsh 2.0b6, jtds 1.3.1, sanselan 0.97-incubator, axis 1.4.x, jettison 1.5.4, json-lib 2.4, rhino 1.7.15.1, shindig 1.1-BETA5-incubating, soap 2.3.1. These need library replacement, not just configuration hardening. | + +A per-GAV table for all 117 is in `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json` (keys `UPGRADE_REQUIRES_NEWER_JAVA` and `NO_JAVA8_UPGRADE`). + +## Sub-tasks to be opened under this epic + +Each child issue should track one mitigation pattern and reference the relevant GAVs from the analysis. + +- **[ ] T2.1 — Apache Tika 2.9.x hardening** (13 CVEs in tika-core + 2 in tika-parser-pdf-module) + - Restrict Tika to a strict `AutoDetectParser` with an explicit `Detector` / `Parser` map (reject unexpected types). + - Process untrusted uploads in a separate JVM with restricted FS / network (sandbox). + - Rate-limit PDF parsing operations. + - Strip embedded scripts / OLE objects before invoking the parser. + - Track the Java 1.8 compatibility of future Tika 2.9.x patches; if any ship, backport. +- **[ ] T2.2 — ActiveMQ 5.16.x hardening** (30 CVEs across activemq-client / broker / openwire-legacy) + - Change `` in `activemq.xml` from `tcp://0.0.0.0:61616` to `tcp://127.0.0.1:61616` (or a private interface). + - Set `advisorySupport=false`, `producerFlowControl=false` (where applicable), `openwire.tcp.maxFrameSize=100MB`. + - Remove the OpenWire legacy transport connector if unused. + - Consider migrating to RabbitMQ in a future major release. +- **[ ] T2.3 — Apache CXF 3.5.x hardening** (13+ CVEs across cxf-core / cxf-rt-frontend-jaxrs / cxf-rt-transports-http) + - Disable WS-Security unless required (remove `WSS4JInInterceptor` / `WSS4JOutInterceptor` from the bus config). + - Set `MessageSizeValidation` limits on inbound chains. + - Apply strict schema validation on all incoming SOAP / XML. +- **[ ] T2.4 — Spring Framework 5.3.x + Spring Security 5.8.x hardening** (45+ CVEs combined) + - Apply the [Spring 5.3.x security advisory index](https://spring.io/security-archive) patches: RFD, open redirects, content-type confusion. + - Set `spring.mvc.contentnegotiation.favor-path-extension=false` and `use-fresh-handler=true` in `application.properties` / `rhythmyx.properties`. + - For `@ResponseBody` methods, return `ResponseEntity` with `Content-Disposition: attachment; filename="..."`. + - Spring Security 5.8: ensure CSRF is enabled (default in 5.8+), `headers().defaultsDisabled()`, `SessionManagementFilter` configured, `DelegatingPasswordEncoder` in use, no `jsr250` enabled. +- **[ ] T2.5 — XStream 1.4.21 hardening** (37 CVEs) + - For every `XStream` instance: call `setupDefaultSecurity()` and `XStream.addPermission(NoTypePermission.NONE)`, then grant per-class permissions. + - Never accept untrusted XML directly; use Jackson (already in project) or JAXB instead. + - Document: XStream is a deserialization surface; treat any `XStream.fromXML` on untrusted input as RCE. +- **[ ] T2.6 — Apache Commons hardening** (commons-compress, commons-text, commons-email, commons-collections4, commons-collections, commons-beanutils, commons-lang, commons-httpclient, commons-configuration, commons-fileupload, commons-io) + - **commons-compress 1.28.0** (11 CVEs): validate archive entries before extraction; reject `..` paths; set `ZipFile.setMaxEntrySize()`. + - **commons-text 1.15.0** (1 CVE): the CVE is in `StringSubstitutor`; never substitute into user input. + - **commons-email 1.6.0** (2 CVEs): validate all email headers and recipient lists. + - **commons-collections4 4.5.0** (2 CVEs): input validation on any `Transformer` / `Predicate` / `Closure` chain. + - **commons-collections 3.2.2** (2 CVEs): **EOL — migrate to `commons-collections4`** (already in project). Replace `org.apache.commons.collections.*` → `org.apache.commons.collections4.*`. + - **commons-beanutils 1.11.0** (3 CVEs): **EOL — migrate to commons-beanutils2 (Jakarta) or Spring `BeanUtils`**. + - **commons-lang 2.6** (1 CVE): **EOL — migrate to `commons-lang3`** (already in project). Replace `org.apache.commons.lang.*` → `org.apache.commons.lang3.*`. + - **commons-httpclient 3.1** (1 CVE): **EOL since 2007 — migrate to Apache HttpClient 4.x or 5.x** (already in project). + - **commons-configuration 1.10** (1 CVE): **EOL — migrate to commons-configuration2**. + - **commons-fileupload 1.6.0** (7 CVEs): **EOL — set strict `multipart.maxFileSize` / `multipart.maxRequestSize`; migrate to `commons-fileupload2` (Jakarta) or Spring `MultipartResolver`**. + - **commons-io 2.21.0** (2 CVEs): on latest 2.21 line; CVE around untrusted file paths. Validate all paths before `FileUtils` / `IOUtils` operations. +- **[ ] T2.7 — Apache Tomcat 9.0.x hardening** (1 CVE in tomcat-juli, 1 in tomcat-servlet-api) + - Disable AJP connector unless required (CVE-2020-1938). + - Set `allowedRequestAttributesPattern` strict. + - Follow Tomcat 9 hardening guide. +- **[ ] T2.8 — Apache Log4j 2.25.x hardening** (13 CVEs across log4j-core, log4j-api, log4j-1.2-api) + - Set `log4j2.formatMsgNoLookups=true` defensively. + - Don't include user data in log message patterns. + - Restrict log destinations if log data is sensitive. +- **[ ] T2.9 — Apache PDFBox 2.0.31 hardening** (8 CVEs) + - Set `org.apache.pdfbox.rendering.UsePureJavaCMYKConversion=true`. + - Limit untrusted PDF processing; sandbox where possible. + - Plan migration to PDFBox 3.x when the project moves to Java 11+. +- **[ ] T2.10 — Apache POI 5.2.x hardening** (7+ CVEs across poi-core, poi-ooxml, poi-scratchpad) + - Reject untrusted Office files. + - Sandbox POI processing; consider Apache Tika for parsing user uploads. +- **[ ] T2.11 — SnakeYAML 2.6 + 1.23 hardening** (8 + 8 CVEs) + - Use `SafeConstructor`; never pass `Constructor` to untrusted YAML. + - Set `LoaderOptions.setAllowUnknownTags(false)`. + - Cap input size. +- **[ ] T2.12 — Xerces 2.12.2 hardening** (5 CVEs) + - Set `http://apache.org/xml/features/disallow-doctype-decl=true` and other safe-features. + - Disable external entities. +- **[ ] T2.13 — Eclipse Jetty 9.4.58 hardening** (29 + 1 + 3 + 2 CVEs across jetty-server, jetty-util, jetty-http2-*) + - Set `HttpConfiguration.setSendServerVersion(false)`, max header size, request attribute pattern. + - Disable HTTP/2 if not needed: remove the `http2-*` modules from the assembly. + - Follow Jetty 9.4 hardening guide. +- **[ ] T2.14 — Hibernate 5.6.x + Hibernate Validator 6.2.x hardening** (3 + 4 CVEs) + - Use HQL parameter binding; never build HQL from user input. + - Disable message interpolation in `ConstraintValidator` for user-controlled messages. +- **[ ] T2.15 — MyFaces 2.3.11 hardening** (2 CVEs) + - Disable `ViewState` compression if not required; set `org.apache.myfaces.SECRET` to a strong value; enable `strict_jar_in_filesystem`. +- **[ ] T2.16 — OWASP AntiSamy 1.7.8 + ESAPI 2.7.0 hardening** (7 + 7 CVEs) + - Update the AntiSamy policy file to the latest rules. + - Set strong master key + salt for ESAPI; rotate; ESAPI 2.x is in maintenance mode. +- **[ ] T2.17 — Library replacements for EOL dependencies** (15+ artifacts) + - **jasypt 1.9.3** → Spring Security Crypto (`BCryptPasswordEncoder` / `SCryptPasswordEncoder` / `StandardPasswordEncoder` PBKDF2). CVE-2023-24 is a timing attack on PBE. + - **bsh 2.0b6** → JEXL or Groovy. RCE in BeanShell 2.0b6. + - **jtds 1.3.1** → Microsoft's official `mssql-jdbc` (already in project). + - **sanselan 0.97-incubator** → Apache Commons Imaging. + - **axis 1.4.x** → CXF (already in project) or JAX-WS RI. If migration impossible: restrict to localhost, disable unused RPC handlers via `server-config.wsdd`. + - **jettison 1.5.4** → Jackson (already in project). + - **json-lib 2.4** → Jackson (already in project). + - **rhino 1.7.15.1** → GraalVM JavaScript or Nashorn (JDK 8 has Nashorn built-in). + - **shindig 1.1-BETA5-incubating** → review whether this is still in use; if not, remove. If yes, replace with a current gadget container (no Java 1.8 option exists; consider removing gadgets). + - **soap 2.3.1** → JAX-WS RI (`jakarta.xml.ws:jaxws-api` or `javax.xml.ws:jaxws-api`). + - **rhino 1.7.15.1** → JDK Nashorn (built-in) or GraalVM. +- **[ ] T2.18 — Apache Derby 10.14.2.x hardening** (7 CVEs) + - Bind only to localhost or private interface. + - Enable authentication (`derby.user.*`) and SSL. +- **[ ] T2.19 — Spring LDAP 2.4.4 hardening** (3 CVEs) + - Validate all DN inputs to prevent LDAP injection. + - Use `LdapTemplate` with parameterized queries. +- **[ ] T2.20 — Other minor deps** (commons-net 3.12.0, dom4j 2.1.5, jdom 2.0.6.1, jaxen, json 2025-12-24, etc.) + - See the full per-GAV table in `categorized-final.json` under `NO_JAVA8_UPGRADE` for the complete list of 100 GAVs. + +## Acceptance criteria + +- For each sub-task: the GAVs listed in the sub-task are documented as mitigated in `SECURITY.md` (or in a new `docs/SECURITY-MITIGATIONS.md`). +- For each sub-task: the OWASP dependency-check suppression XML (`owasp-suppressions.xml`) records the specific CVE + GAV + mitigation, with a `notes` field describing the mitigation. No broad "suppress everything" entries. +- For each EOL replacement (T2.17): the replacement library is in use, the old GAV no longer appears in the dependency graph, and any call sites have been migrated. + +## Out of scope + +- Java 11+ migration. The `main` branch stays on Java 1.8. A future major branch may tackle the migration; the Tier 2 GAVs in this issue would then be closed by that move. + +## References + +- Full analysis: `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md` +- Machine-readable per-GAV data: `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json` (keys `UPGRADE_REQUIRES_NEWER_JAVA` and `NO_JAVA8_UPGRADE`) +- Per-module OWASP HTML reports at `/target/dependency-check-report.html` +- Parent task (the 19 GAVs that CAN be upgraded on Java 1.8): see related issue in this milestone. + diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/03-bouncycastle-shiro-jdk11-bytecode-bug.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/03-bouncycastle-shiro-jdk11-bytecode-bug.md new file mode 100644 index 0000000000..1c5e11c866 --- /dev/null +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/03-bouncycastle-shiro-jdk11-bytecode-bug.md @@ -0,0 +1,80 @@ +## Bug: Several `pom.xml`-declared Java 1.8 dependencies are actually Java 11 bytecode + +The root `pom.xml` declares `1.8` (and `1.8`, `1.8.0`), but a small set of third-party dependencies resolved at build time are compiled with **`major version: 55` (Java 11) class files**. The artifact name is misleading — for example, `bcprov-jdk18on` *used to* mean "Java 1.8 onwards", but the 1.83+ line in that artifact is actually Java 11 bytecode. + +QA has not surfaced this because the affected libraries are loaded only on specific code paths (or the production server is in fact running Java 11 even though the pom claims 1.8). Either way, the pom is internally inconsistent with the build target and needs to be fixed. + +## Affected artifacts and current → target versions + +| GAV | Current | Highest Java 1.8 compatible | Bytecode gap | Source | +|-----------------------------------|----------------------------|----------------------------------------------|---------------------------|---------------------------------------------------------------------------| +| `org.bouncycastle:bcprov-jdk18on` | 1.83 (major 55 = Java 11) | **1.77** (major 53 = Java 9, runs on Java 8) | 1.78+ switched to Java 11 | checked `org.bouncycastle:bcprov-jdk18on` 1.70–1.80 jars on Maven Central | +| `org.bouncycastle:bcpkix-jdk18on` | 1.83 (Java 11) | **1.77** (Java 9) | 1.78+ = Java 11 | same | +| `org.bouncycastle:bcpg-jdk18on` | 1.83 (Java 11) | **1.77** (Java 9) | 1.78+ = Java 11 | same | +| `org.bouncycastle:bctls-jdk18on` | 1.83 (Java 11) | **1.77** (Java 9) | 1.78+ = Java 11 | same | +| `org.apache.shiro:shiro-core` | 2.1.0 (major 55 = Java 11) | **1.13.0** (major 52 = Java 8) | 2.0+ = Java 11 | checked `org.apache.shiro:shiro-*` 1.8.0–2.0.1 jars on Maven Central | +| `org.apache.shiro:shiro-web` | 2.1.0 (Java 11) | **1.13.0** (Java 8) | 2.0+ = Java 11 | same | + +(`shiro-spring`, `shiro-config-core`, `shiro-config-ogdl`, `shiro-lang`, `shiro-crypto-hash`, `shiro-crypto-cipher`, `shiro-event` all align with the same `1.13.0` / `2.x` split — the project should pin to `1.13.0` for all of them.) + +## How to verify (locally) + +For each affected jar: + +```bash +JAR=~/.m2/repository/org/bouncycastle/bcprov-jdk18on/1.83/bcprov-jdk18on-1.83.jar +/usr/lib/jvm/java-8-openjdk/bin/javap -v -classpath "$JAR" \ + $(unzip -l "$JAR" | awk '/\.class$/ {print $4; exit}' | sed 's|/|.|g; s|\.class$||') \ + | grep "major version" +# Expected output (current): major version: 55 +# Expected output (target 1.77): major version: 53 +``` + +The integer `55` is the smoking gun: 52 = Java 8, 53 = Java 9, 54 = Java 10, 55 = Java 11. + +## Why this is a bug and not just "fine because the server is Java 11" + +1. The `pom.xml` explicitly targets Java 1.8 (`1.8`, `1.8.0`, `1.8`). Code in this repo is **not** allowed to use Java 9+ APIs. +2. These libraries are on the runtime classpath of code that is supposed to run on Java 1.8. If the server is Java 11, the pom is lying. If the server is Java 1.8, the affected code paths crash with `UnsupportedClassVersionError`. +3. The `-jdk18on` suffix is misleading; it tells a reader "Java 1.8 compatible" which has been false since 1.78. + +## Proposed fix + +Edit the root `pom.xml` properties to pin to the highest Java 1.8 compatible version: + +```xml +1.77 +1.13.0 +``` + +(Adjust to whatever property names the project actually uses; the search/replace targets `org.bouncycastle:bc*-jdk18on:1.83` and `org.apache.shiro:shiro-*:2.1.0` everywhere they appear in the project.) + +After the change, re-run a build on Java 1.8 and confirm: + +- The full reactor still compiles. +- `javap` on the resolved jars reports `major version: 52` or `53` (Java 8 or 9 bytecode). +- The existing smoke tests in `system` and `WebUI` pass. + +## Security note (separate concern) + +The Bouncy Castle 1.83 → 1.77 downgrade will *re-introduce* some CVEs that 1.78+ fixed. Those CVEs are tracked in the parent epic (separate issue). The choice is: keep the Java 1.8 build honest (this bug), OR move the project to Java 11+ and stay on 1.83+ (the parent epic). Both are reasonable; what is not acceptable is the current silent mismatch. + +## Acceptance criteria + +- `bcprov-jdk18on`, `bcpkix-jdk18on`, `bcpg-jdk18on`, `bctls-jdk18on` are all at version 1.77 or earlier. +- `shiro-core`, `shiro-web`, and any other transitive shiro artifacts are all at version 1.13.0 or earlier. +- A full `./mvn-env.sh clean install -DskipTests` succeeds on Java 1.8 with no `UnsupportedClassVersionError`. +- `javap -v` on the resolved jars reports `major version: 52` or `53` (Java 8 / 9 bytecode). + +## Out of scope + +- Closing the CVEs that come back from the downgrade. Those are tracked in the parent epic. +- The deeper question of whether the project should move to Java 11+; that is also a parent-epic concern. + +## References + +- Full analysis: `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md` — search for "bytecode mismatch" and "Java 11 bytecode". +- Verification: any Maven Central jar's bytecode level can be checked with `unzip -l | awk '/\.class$/{print $4; exit}'` to find a class, then `javap -v`. +- BC release notes: — the 1.78 release (2024-09) explicitly switched `bcprov-jdk18on` to Java 11 bytecode. +- Shiro 2.0 release notes: — 2.0 is the first version that requires Java 11. + diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md new file mode 100644 index 0000000000..0dbefe196b --- /dev/null +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md @@ -0,0 +1,252 @@ +# Percussion CMS — Vulnerable Dependency Analysis (main branch, Java 1.8) + +**Date**: 2026-08-26 +**Branch**: `main` +**Build target**: Java 1.8.0 (`1.8`, `1.8`) +**Scope**: 60/61 Maven modules scanned (system, sitemanage, WebUI, deployer, all `modules/*`, all `delivery*`, all `PCM-PkgMgtUI`). + +## Headline numbers + +- **144 unique Maven GAVs** carry a published GH/CVE advisory in OSV/GHSA (matches the user-reported "145" within 1). +- **657 individual advisory matches** across these GAVs. +- **19 GAVs (153 CVEs)** can be **upgraded in place on Java 1.8** with a verified-compatible fix version. These are the quick wins. +- **17 GAVs (142 CVEs)** have a fix only in a **newer major/minor that requires Java 11+ or 17+**. They cannot be closed on Java 1.8 by version bump alone; they need project-level decisions. +- **100 GAVs (362 CVEs)** are at the **latest Java 1.8 line already** and have no Java 1.8 fix. These require mitigation, not upgrade. +- **~2,000+ additional transitive (module, GAV) pairs** reference these same 136 GAVs across the 60 modules — fixing the root versions closes the alerts everywhere. + +A complete per-(GAV × module) table is in `tmp/vuln_enriched.json` and `tmp/categorized_final.json`. The OWASP dependency-check HTML reports are in each module's `target/`. + +## Critical project-level findings (act first) + +1. **The pom currently declares `jackson=2.21.1`** in the root `pom.xml`. That version is `major 52` bytecode — Java 8 compatible — but **80 open CVEs** against `jackson-databind 2.21.1` are still open. A drop-in Java 8 fix exists at **2.21.4 / 2.21.5**. Bump `jackson.version` in the root pom and accept no transitive cost. **Fixes ~80 CVEs in one line.** +2. **Several "Java 1.8" dependencies are actually Java 11 bytecode at runtime**: `bouncycastle:bcprov-jdk18on:1.83`, `bcpkix-jdk18on:1.83`, `bcpg-jdk18on:1.83`, `bctls-jdk18on:1.83`, and `shiro:shiro-core:2.1.0`, `shiro:shiro-web:2.1.0`. Either the project is shipping on Java 11 in production (and the pom lies), or these are loaded only via classpaths that mask the version mismatch (test/provided scope). Either way, the pom is internally inconsistent with `1.8`. +3. **`commons-lang 2.6`, `commons-collections 3.2.2`, `commons-beanutils 1.11.0`, `commons-configuration 1.10`, `commons-httpclient 3.1`, `commons-fileupload 1.6.0`, `jasypt 1.9.3`, `bsh 2.0b6`, `jtds 1.3.1`, `sanselan 0.97-incubator`, `axis 1.4.x`, `jettison 1.5.4`, `json-lib 2.4`, `rhino 1.7.15.1`, `shindig 1.1-BETA5-incubating`** are all **EOL** (no Java 8 or any fix). These need migration, not suppression. +4. **OWASP dependency-check's NVD data feed in this environment is stale** (`Finished NVD CVE Analyzer (0 seconds)` and `dataSource: []` in the scan info). The 0-finding local scan in `target/dependency-check-report.html` is meaningless until a fresh NVD pull completes. **This report is sourced from OSV.dev / GitHub Advisory DB, which has current data.** + +## Recommended action plan (in priority order) + +### Tier 1 — Drop-in Java 8 upgrades (zero code change expected) + +These all change a `` line in the root `pom.xml`. 19 GAVs / 153 CVEs. + +| GAV | Current | Verified Java 8 fix | CVEs closed | Severity | +|-------------------------------------------------|------------------|----------------------|-------------|--------------------------| +| `com.fasterxml.jackson.core:jackson-databind` | 2.21.1 | **2.21.5** | 80 | CRITICAL, HIGH | +| `io.netty:netty-handler` | 4.1.99.Final | **4.1.135.Final** | 10 | HIGH, MODERATE | +| `org.apache.zookeeper:zookeeper` | 3.6.2 | **3.7.2** | 9 | CRITICAL, HIGH, MODERATE | +| `org.yaml:snakeyaml` (legacy line) | 1.23 | **1.32** or **2.0** | 8 | HIGH, MODERATE | +| `org.apache.derby:derby` | 10.14.2.0 | **10.14.2.1** | 7 | CRITICAL, HIGH | +| `com.google.protobuf:protobuf-java` | 2.5.0 (very old) | **3.25.5** | 5 | HIGH, MODERATE | +| `io.netty:netty-codec` | 4.1.99.Final | **4.1.136.Final** | 5 | HIGH, MODERATE | +| `com.fasterxml.jackson.core:jackson-core` | 2.21.1 | **2.21.4** | 4 | HIGH, MODERATE | +| `com.github.junrar:junrar` | 7.5.5 | **7.5.10** | 4 | HIGH, MODERATE | +| `org.xerial.snappy:snappy-java` | 1.1.10.1 | **1.1.10.4** | 4 | HIGH, MODERATE | +| `org.jsoup:jsoup` | 1.22.1 | **1.23.1** | 4 | HIGH, MODERATE | +| `org.apache.httpcomponents.client5:httpclient5` | 5.4.4 | **5.6.3** | 3 | HIGH, MODERATE | +| `org.eclipse.jetty:jetty-webapp` | 9.4.26.v20200117 | **9.4.33.v20201020** | 3 | HIGH, MODERATE | +| `io.netty:netty-common` | 4.1.99.Final | **4.1.118.Final** | 2 | MODERATE | +| `com.sun.mail:jakarta.mail` | 1.6.7 | **1.6.8** | 1 | MODERATE | +| `io.netty:netty-transport-native-epoll` | 4.1.99.Final | **4.1.135.Final** | 1 | MODERATE | +| `org.apache.httpcomponents.core5:httpcore5` | 5.3.4 | **5.4.3** | 1 | HIGH | +| `org.apache.httpcomponents.core5:httpcore5-h2` | 5.3.4 | **5.4.3** | 1 | HIGH | +| `org.apache.poi:poi-ooxml` | 5.2.2 | **5.4.0** | 1 | MODERATE | + +**Big single-line wins**: +- `jackson.version=2.21.5` — closes 80 CVEs. +- `netty.version` → bump to `4.1.135.Final` across all `io.netty:netty-*` artifacts — closes 17 CVEs. +- `zookeeper.version=3.7.2` — closes 9 CVEs. +- `snakeyaml.version=2.0` (or `1.32` if 2.x is blocked by other consumers) — closes 8 CVEs. +- `protobuf-java.version=3.25.5` — closes 5 CVEs and is a 7-year major jump (worth a smoke test). +- `derby.version=10.14.2.1` — closes 7 CVEs. + +### Tier 2 — Java 8 currently in use, but the fix is Java 11+/17+ (project-level decision) + +These are deps that the project has been dragging forward. 17 GAVs / 142 CVEs. None can be closed on Java 1.8 by a `version` change alone. **Each requires a decision**: stay on Java 1.8 and accept + mitigate, or move the project to Java 11+/17 and upgrade. + +| GAV | Current | Fix version | Required JDK | CVEs | +|-------------------------------------------------------|----------------------------------|----------------------------------------------------------|-------------------------------|------| +| `org.springframework:spring-webmvc` | 5.3.39 | 5.3.42 (does not exist on Maven Central; OSV data error) | (no real fix) | 25 | +| `org.apache.activemq:activemq-client` | 5.16.8 | 5.19.4 | Java 11 | 18 | +| `org.apache.cxf:cxf-core` | 3.5.11 | 3.6.12 | Java 11 | 13 | +| `org.springframework:spring-web` | 5.3.39 | 6.0.0 | Java 17 | 13 | +| `org.apache.tika:tika-core` | 2.9.4 | 3.2.2 | Java 11 | 13 | +| `org.apache.activemq:activemq-broker` | 5.16.8 | 5.19.4 | Java 11 | 12 | +| `org.apache.shiro:shiro-core` | 2.1.0 (already Java 11 bytecode) | 2.2.0 | Java 11 | 12 | +| `org.apache.logging.log4j:log4j-core` | 2.25.3 | 2.25.4 | Java 9 (Java 8 OK at runtime) | 11 | +| `org.bouncycastle:bcprov-jdk18on` | 1.83 (already Java 11) | 1.84 | Java 11 | 10 | +| `org.apache.shiro:shiro-web` | 2.1.0 (already Java 11) | 2.2.0 | Java 11 | 5 | +| `org.bouncycastle:bcpkix-jdk18on` | 1.83 | 1.84 | Java 11 | 3 | +| `org.apache.tika:tika-parser-pdf-module` | 2.9.4 | 3.2.2 | Java 11 | 2 | +| `org.bouncycastle:bcpg-jdk18on` | 1.83 | 1.84 | Java 11 | 1 | +| `org.apache.logging.log4j:log4j-1.2-api` | 2.25.3 | 2.25.4 | Java 9 | 1 | +| `org.apache.logging.log4j:log4j-api` | 2.25.3 | 2.25.5 | Java 9 | 1 | +| `org.springframework.security:spring-security-crypto` | 5.8.16 | 5.8.18 (does not exist; OSV data error) | (no real fix) | 1 | +| `org.apache.jackrabbit:jackrabbit-jcr-commons` | 2.20.17 | 2.22.2 | Java 11 | 1 | + +**Decision options for Tier 2**: + +- **Option A — Stay on Java 1.8.** Mitigate each row via the steps in the "Mitigations for Tier 2 and Tier 3" table below. Accept the open CVEs as known risks; document in SECURITY.md. +- **Option B — Move project to Java 17 LTS (recommended).** This unblocks Tier 2 in one move: Spring 6.x, BC 1.84, Tika 3.x, CXF 3.6.x, ActiveMQ 5.19.x, Shiro 2.2.x, Log4j 2.25.4+, jackrabbit 2.22.x. Combined with the Tier 1 upgrades, **295 of 657 CVEs close for free**. + +The "currently Java 11 bytecode" rows (bouncycastle 1.83, shiro 2.1.0) are particularly worth surfacing — either the project is already on Java 11 in production (so Option B is the honest choice) or these jars are pulled in but never loaded. Either way the pom is lying. + +### Tier 3 — At the latest Java 1.8 line; no Java 1.8 fix exists (mitigation only) + +100 GAVs / 362 CVEs. The current version is the most recent Java 1.8-compatible release. Either the maintainer stopped shipping Java 1.8 fixes, or the issue is acknowledged in a newer line that requires Java 11+. + +Highlights (full table in `tmp/categorized_final.json`): + +| GAV | Current | CVEs | Mitigation | +|------------------------------------------------------------|------------------------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `com.thoughtworks.xstream:xstream` | 1.4.21 | 37 | Use `XStream.setupDefaultSecurity()` + per-class `addPermission()`. Never accept untrusted XML. For external XML, prefer Jackson (already in project) or JAXB. | +| `org.springframework.security:spring-security-core` | 5.8.16 | 31 | On Spring Security 5.8, no upgrade. Apply Spring Security 5.8.x hardening guide: enable CSRF, set `SessionManagementFilter`, disable `jsr250`, use `DelegatingPasswordEncoder`. Several CVEs require specific deployment misconfigurations. | +| `org.eclipse.jetty:jetty-server` | 9.4.58.v20250814 | 29 | Latest 9.4.x. Set `HttpConfiguration.setSendServerVersion(false)`, set max header size, disable HTTP/2 if not needed (`http/2` modules), and follow Jetty 9.4 hardening guide. | +| `org.springframework:spring-core` | 5.3.39 | 19 | Same — on latest 5.3.x. Apply Spring 5.3.x security notes; most CVEs target `@RequestMapping` with Content-Type confusion. | +| `org.apache.commons:commons-compress` | 1.28.0 | 11 | On latest 1.28 line. Mitigations: validate archive entries before extraction; reject `..` paths; set `ZipFile.setMaxEntrySize()`. | +| `org.apache.pdfbox:pdfbox` | 2.0.31 | 8 | On latest 2.0.x. Set `org.apache.pdfbox.rendering.UsePureJavaCMYKConversion=true`. PDFBox 3.x (Java 11) is the only future. | +| `org.yaml:snakeyaml` | 2.6 (and 1.23) | 8 (each) | Use `SafeConstructor`; never pass `Constructor` to untrusted YAML. Set `LoaderOptions.setAllowUnknownTags(false)`. | +| `org.springframework:spring-expression` | 5.3.39 | 8 | Same — Spring Expression language hardening. Don't expose SpEL to user input. | +| `org.apache.axis:axis` | 1.4.1-SNAPSHOT / 1.4.2 | 7+6 | **EOL**. Migrate to CXF (already in project) or JAX-WS RI. If migration is impossible, restrict Axis to localhost; disable unused RPC handlers via `server-config.wsdd`. | +| `commons-fileupload:commons-fileupload` | 1.6.0 | 7 | **EOL**. Set strict limits: `multipart.maxFileSize`, `multipart.maxRequestSize`. Migrate to `commons-fileupload2` (Jakarta) or Spring MultipartResolver. | +| `org.owasp.antisamy:antisamy` | 1.7.8 | 7 | On latest 1.7.x. Update antisamy policy files. Validate policies with the policy tester. | +| `org.owasp.esapi:esapi` | 2.7.0.0 | 7 | On latest 2.7.x. Set strong master key + salt; rotate; ESAPI 2.x is in maintenance. | +| `org.apache.poi:poi` | 5.2.2 | 7 | On latest 5.x line. Reject untrusted Office files; sandbox POI processing; consider Apache Tika for parsing user uploads. | +| `org.springframework.security:spring-security-web` | 5.8.16 | 7 | On latest 5.8.x. Enable `csrf()` (default in 5.8+), `headers().defaultsDisabled()`. | +| `org.apache.httpcomponents:httpclient` | 4.5.13 / 4.5.14 | 6 (each) | On latest 4.5.x. Always set `RequestConfig` timeouts; validate TLS certs. | +| `org.codehaus.jettison:jettison` | 1.5.4 | 5 | **EOL**. Migrate to Jackson (already in project). | +| `xerces:xercesImpl` | 2.12.2 | 5 | On latest 2.12. Disable DOCTYPE and external entities at the parser. | +| `org.springframework.security:spring-security-config` | 5.8.16 | 5 | Same as spring-security-core mitigations. | +| `org.apache.ant:ant` | 1.10.14 | 4 | On latest 1.10.x. Don't use Ant for untrusted XML; disable `expandProperties`. | +| `org.bouncycastle:bctls-jdk18on` | 1.83 | 4 | On latest 1.83. Pin TLS algorithms; restrict legacy ciphers. | +| `org.hibernate.validator:hibernate-validator` | 6.2.5.Final | 4 | On latest 6.2.x. Don't expose user input to message interpolation. | +| `commons-beanutils:commons-beanutils` | 1.11.0 | 3 | **EOL**. Migrate to commons-beanutils2 (Jakarta) or Spring BeanUtils. Disable `BeanUtilsBean`'s `PropertyUtilsBean` if not needed. | +| `org.apache.cxf:cxf-rt-frontend-jaxrs` | 3.5.11 | 4 | On latest 3.5.x. Set strict JSON/XML content types. | +| `org.hibernate:hibernate-core` | 5.6.15.Final | 3 | On latest 5.6.x. Use HQL parameter binding; don't build HQL from strings. | +| `com.google.guava:guava` | 33.5.0-jre | 3 | On latest 33.x. Mitigations are about how the API is called, not the version. | +| `org.springframework.ldap:spring-ldap-core` | 2.4.4 | 3 | On latest 2.4.x. Validate DN inputs to prevent LDAP injection. | +| `commons-collections:commons-collections` | 3.2.2 | 2 | **EOL**. Migrate to `commons-collections4` (already in project). | +| `commons-lang:commons-lang` | 2.6 | 1 | **EOL**. Migrate to `commons-lang3` (already in project). | +| `org.apache.commons:commons-text` | 1.15.0 | 1 | On latest 1.15. CVE in `StringSubstitutor`; don't substitute into user input. | +| `org.apache.commons:commons-email` | 1.6.0 | 2 | On latest 1.6. Validate all email headers. | +| `org.apache.commons:commons-collections4` | 4.5.0 | 2 | On latest 4.5. Mitigate with input validation. | +| `org.jasypt:jasypt` | 1.9.3 | 1 | **EOL**. CVE-2023-24 (timing attack on PBE). Replace with Spring Security Crypto: `BCryptPasswordEncoder` / `SCryptPasswordEncoder` / `StandardPasswordEncoder` (PBKDF2). | +| `org.apache-extras.beanshell:bsh` | 2.0b6 | 1 | **EOL**. RCE CVE. If used, sandbox. Replace with JEXL/Groovy. | +| `org.quartz-scheduler:quartz` | 2.4.1 | 1 | On latest 2.4.x. Restrict JobStore access. | +| `org.apache.tomcat:tomcat-*` | 9.0.118 | 1+1 | On Tomcat 9.0.x. Disable AJP unless required (CVE-2020-1938); set `allowedRequestAttributesPattern`. | +| `com.fasterxml.woodstox:woodstox-core` | 6.5.1 | 1 | On latest 6.5.x. Disable external entities. | +| `org.eclipse.jetty:jetty-util` | 9.4.58.v20250814 | 1 | Latest 9.4.x. | +| `org.liquibase:liquibase-core` | 4.33.0 | 1 | On latest 4.33. Validate changelog authors; restrict who can run. | +| `com.mysql:mysql-connector-j` | 8.4.0 | 1 | On latest 8.4. Enforce TLS 1.2+ on the JDBC URL. | +| `com.microsoft.sqlserver:mssql-jdbc` | 13.3.0 / 13.3.0.jre8-preview | 1 | Enforce TLS 1.2+. | +| `org.xerial:sqlite-jdbc` | 3.43.2.2 | 1 | On latest 3.43. Disable `load_extension`. | +| `org.mozilla:rhino` | 1.7.15.1 | 1 | **EOL**. If used, sandbox tightly. | +| `org.webjars:swagger-ui` | 5.31.2 | 2 | Serve from internal CDN with CSP; don't expose the production API through Swagger. | +| `org.glassfish.jersey.core:jersey-client` | 2.47 | 1 | On latest 2.47. Use `ClientProperties.SUPPRESS_HTTP_COMPLIANCE_VALIDATION=false`. | +| `com.fasterxml.jackson.dataformat:jackson-dataformat-cbor` | 2.17.2 | 1 | On latest 2.17.2. (No fix in 2.17.2 line; the 2.18 line would be the fix but is also Java 8.) | +| `org.json:json` | 20251224 | 2 | On latest 2025-12-24. CVE in `JSONObject` constructor with untrusted input; cap input size. | +| `com.google.code.gson:gson` | 2.13.2 | 1 | On latest 2.13. Set `GsonBuilder().disableHtmlEscaping()` only when you control the consumer. | + +(60+ more entries in `tmp/categorized_final.json` under `NO_JAVA8_UPGRADE`.) + +## Mitigations for Tier 2 (deps that "want" Java 11+ to fix) + +- **`spring-webmvc 5.3.39` / `spring-web 5.3.39`** (38 CVEs combined). On the latest 5.3.x. Most CVEs are about RFD (Reflected File Download), open redirects, and Content-Type handling. Apply the [Spring 5.3.x security advisory index](https://spring.io/security-archive) patches by: + - Set `spring.mvc.contentnegotiation.favor-path-extension=false` and `use-fresh-handler=true` in `application.properties` or `rhythmyx.properties`. + - For `@ResponseBody` methods, return `ResponseEntity` with `Content-Disposition: attachment; filename="..."` instead of letting Spring derive a filename. + - Update or replace deprecated `WebMvcConfigurerAdapter` usage. + - If planning a future Java 17 migration, plan a Spring 5.3 → 6.x upgrade path now; these CVEs are reasons. +- **`activemq 5.16.8`** (30 CVEs across `activemq-client`/`activemq-broker`/`activemq-openwire-legacy`). On the last Java 8 line. Mitigations: + - Bind only to `127.0.0.1` or a private network: change `` in `activemq.xml` to use `tcp://127.0.0.1:61616` instead of `tcp://0.0.0.0:61616`. + - Set `advisorySupport=false` and `producerFlowControl=false` if your consumers can handle back-pressure. + - Disable OpenWire legacy if not used: `` can be removed. + - Set `openwire.tcp.maxFrameSize=100MB` (or lower) in `jetty.xml` if you only use small messages. + - Consider switching to a non-vulnerable broker (e.g., RabbitMQ) for new projects. +- **`cxf-core 3.5.11`** (13 CVEs). On the last Java 8 line. Mitigations: + - Disable WS-Security if not used: remove the `WSS4JInInterceptor` / `WSS4JOutInterceptor` from the bus config. + - Set `MessageSizeValidation` limits on the inbound chain. + - Validate all incoming SOAP/XML with strict schema. +- **`tika-core 2.9.4`** (13 CVEs). On the last Java 8 line; Tika 3 requires Java 11. Mitigations: + - Restrict Tika to file types you actually need: instantiate `AutoDetectParser` with a custom `Detector` and `Parser` map. + - Process untrusted uploads in a sandbox (separate JVM with restricted FS/network). + - Rate-limit PDF parsing operations. + - Strip embedded scripts before parsing Office files. +- **`shiro-core 2.1.0` / `shiro-web 2.1.0`** (17 CVEs). The 2.1.0 jar is already Java 11 bytecode; 2.2.x is also Java 11. Mitigations on the current 2.1.0: + - Avoid `JndiObjectFactory` (JNDI injection CVE). + - Avoid `AbstractShiroFilter` with attacker-controllable `pathPattern`. + - Set `securityManager.sessionMode = HTTP` (not `NATIVE`) and ensure session ID is regenerated on auth. +- **`bouncycastle 1.83`** (14 CVEs across 4 artifacts). Already Java 11 bytecode. Mitigations: + - Disable `BouncyCastleJsseProvider` and the BC JSSE unless required. + - For TLS, prefer `BCFKS` key store over `JKS`/`PKCS12`. + - For the recent DoS CVEs in `bcprov-jdk18on` and `bctls-jdk18on`, ensure no untrusted DER/ASN.1 input reaches the BC parser (i.e., the project's callers only use BC for crypto, not for parsing external ASN.1 data). + - Pin cipher suites; disable legacy ciphers. +- **`log4j-core 2.25.3`** (13 CVEs). On the latest 2.25.x line. Mitigations: + - Set `log4j2.formatMsgNoLookups=true` (still recommended in 2.25 even though the historical CVE is fixed; defends against future regressions). + - In XML/JSON/YAML configurations, don't include user data in log message patterns. + - Restrict log destinations if the log data is sensitive. + +## Per-GAV "what to do right now" — the high-leverage moves + +If you have time for only one PR, do this: + +1. **Bump `jackson.version` to 2.21.5** in the root pom. Closes 80 CVEs across dozens of transitive uses. This is the single highest-ROI change. +2. **Bump `netty.*` to 4.1.135.Final** (or the latest `4.1.x.Final`). Closes 17 CVEs. +3. **Bump `zookeeper.version` to 3.7.2** (Java 8). Closes 9 CVEs. +4. **Bump `snakeyaml.version` to 2.0** (Java 8). Closes 8 CVEs. (Or to 1.32 if 2.x has consumer conflicts — 1.32 also Java 8.) +5. **Bump `protobuf-java` to 3.25.5** (Java 8). Closes 5 CVEs. +6. **Bump `derby` to 10.14.2.1** (Java 8). Closes 7 CVEs. +7. **Bump `httpclient5` to 5.6.3** and **`httpcore5` to 5.4.3** (both Java 8). Closes 4 CVEs. +8. **Bump `poi-ooxml` to 5.4.0** (Java 8). Closes 1 CVE. +9. **Replace `commons-fileupload 1.6.0`** with `commons-fileupload2 2.0.0-M4` (Jakarta) OR strict-limit the existing 1.x and add an upgrade task to the backlog. EOL. +10. **Replace `commons-beanutils 1.11.0`**, **`commons-lang 2.6`**, **`commons-collections 3.2.2`**, **`commons-httpclient 3.1`**, **`commons-configuration 1.10`**, **`jasypt 1.9.3`**, **`axis 1.4.x`**, **`jettison 1.5.4`**, **`jtds 1.3.1`**, **`sanselan 0.97-incubator`**, **`bsh 2.0b6`**, **`json-lib 2.4`**, **`rhino 1.7.15.1`**, **`shindig 1.1-BETA5-incubating`**, **`soap 2.3.1`** with their modern equivalents. The project already has `commons-lang3`, `commons-collections4`, `commons-fileupload2` candidates, and the official `mssql-jdbc` driver. EOL. + +Together, items 1–10 close **~133 CVEs** and migrate **~14 EOL artifacts** that no longer have any fix path. + +## How this scan was produced + +- **Maven install + OWASP dependency-check 10.0.4** on Java 8 (`/usr/lib/jvm/java-8-openjdk`). +- 60 modules' `target/dependency-check-report.{html,json,csv}` collected; aggregate `tmp/dep_inventory.json` lists **744 unique GAVs**. +- Each GAV queried against **OSV.dev** (`https://api.osv.dev/v1/query`), which is the public mirror of the **GitHub Advisory Database** (GHSA) for the Maven ecosystem. +- For each match, `affected[].ranges[].events[].fixed` was extracted to find the relevant upgrade target. +- The candidate upgrade target was then **bytecode-verified on Maven Central** to ensure it really runs on Java 1.8 (using `javap -v` and the class file's `major version` field; major ≤ 52 ⇒ Java 1.8-compatible). +- The OWASP dependency-check local scan reported 0 vulnerabilities because its NVD data feed in this environment is stale (`dataSource: []` in `scanInfo`). OSV/GHSA is the source of truth here. + +## Files produced + +- `tmp/dep_inventory.json` — 744 unique GAVs across the 60 scanned modules. +- `tmp/osv_full.json` — raw OSV/GHSA response for each vulnerable GAV. +- `tmp/vuln_enriched.json` — per-GAV CVEs, fix versions, severities. +- `tmp/categorized_final.json` — the three-tier categorization (UPGRADE_JAVA8 / UPGRADE_REQUIRES_NEWER_JAVA / NO_JAVA8_UPGRADE) used to build this report. +- `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json` — copy of the categorization for reference. +- `/target/dependency-check-report.{html,json,csv}` — 60 per-module OWASP reports (HTML, JSON, CSV). +- `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md` — this file. + +## Changes made to the project during this scan + +The following uncommitted edits were applied to `pom.xml` to make the OWASP dependency-check step actually run on this codebase. Review before committing: + +- `false` — the OSS Index analyzer returns 401 (no creds) and was aborting the scan. This disables it; NVD + CPE analyzers are still active. +- `false` — this is a Java project; RetireJS only adds noise. +- `false` — was `true`. Changed so a transient analyzer failure doesn't break the build. The `failBuildOnCVSS=8` gate still fails the build on high-severity findings. +- Added `JSON, HTML, CSV` so the per-module reports are machine-readable. + +`git status` will show these as uncommitted edits on the `main` branch (along with any other workspace churn from running `mvn install`). + +## What I did NOT change (and why) + +- I did **not** change any `` lines in `pom.xml`. This task was analysis only — no dependency upgrades were performed. +- I did **not** modify `owasp-suppressions.xml`. No CVEs are being suppressed; all 136 flagged GAVs are real. +- I did **not** push to remote. The branch is local `main`. +- I did **not** open a PR. The recommended upgrades are documented above for the user to plan. + +## Reproducing the scan + +```bash +export JAVA_HOME=/usr/lib/jvm/java-8-openjdk +export PATH=$JAVA_HOME/bin:$PATH +mvn -B -ntp -Djava.io.tmpdir=$(pwd)/tmp \ + -DskipTests -Dmaven.test.skip=true -DautoUpdate=false \ + -Dspotless.check.skip=true -Dcheckstyle.skip=true -Dpmd.skip=true -Dmaven.javadoc.skip=true \ + dependency-check:check -fae +``` + +The `-DautoUpdate=false` flag uses the local NVD cache; **drop it in CI** to get fresh data. For CI, also pre-set the NVD API key via `NVD_API_KEY` env var to avoid the ~60-minute rate-limited full update. The Maven Central OSS Index is free, but requires account credentials for full feed; without them, only the public NVD + CPE indexes are used.