From 02b06306687e328be7b7c31591445d367dcae8a8 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 3 Nov 2026 00:50:43 +0100 Subject: [PATCH] chore(deps): constrain test-scope Tomcat to 10.1.61 past GHSA-f525-44xv-f2qj The Boot 3.5.16 BOM manages tomcat-embed-core, -el and -websocket at 10.1.55, which carries GHSA-f525-44xv-f2qj (CVSS 9.8, fixed in 10.1.59) and three more advisories the config suppressed. A testImplementation constraint moves the three modules to 10.1.61, the lock changes only those three lines, and the three Tomcat suppressions come out of osv-scanner.toml in the same change, as its header asks once the dependency moves. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E28c6iftj4hRmx55Uaaoxc Entire-Checkpoint: 01M6FARB3G4EA27Z272N75MDC9 --- build.gradle.kts | 9 +++++++++ gradle.lockfile | 6 +++--- osv-scanner.toml | 17 +---------------- 3 files changed, 13 insertions(+), 19 deletions(-) diff --git a/build.gradle.kts b/build.gradle.kts index 9e9292f..c72da52 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -61,6 +61,15 @@ dependencies { testImplementation(libs.spring.boot.starter.web) // Gradle 9 requires the platform launcher on the test runtime (boot docs convention). testRuntimeOnly("org.junit.platform:junit-platform-launcher") + + // The Boot 3.5.16 BOM manages Tomcat 10.1.55 (test scope only, not in the adapter POM); + // 10.1.61 fixes GHSA-f525-44xv-f2qj, GHSA-9xv2-5v5q-p794, GHSA-gcx9-497g-6cp6 and + // GHSA-h3x4-894j-xpx5. + constraints { + testImplementation("org.apache.tomcat.embed:tomcat-embed-core:10.1.61") + testImplementation("org.apache.tomcat.embed:tomcat-embed-el:10.1.61") + testImplementation("org.apache.tomcat.embed:tomcat-embed-websocket:10.1.61") + } } tasks.test { diff --git a/gradle.lockfile b/gradle.lockfile index eb86453..7a032b7 100644 --- a/gradle.lockfile +++ b/gradle.lockfile @@ -66,9 +66,9 @@ net.minidev:accessors-smart:2.5.2=testCompileClasspath,testRuntimeClasspath net.minidev:json-smart:2.5.2=testCompileClasspath,testRuntimeClasspath org.apache.logging.log4j:log4j-api:2.24.3=testCompileClasspath,testRuntimeClasspath org.apache.logging.log4j:log4j-to-slf4j:2.24.3=testCompileClasspath,testRuntimeClasspath -org.apache.tomcat.embed:tomcat-embed-core:10.1.55=testCompileClasspath,testRuntimeClasspath -org.apache.tomcat.embed:tomcat-embed-el:10.1.55=testCompileClasspath,testRuntimeClasspath -org.apache.tomcat.embed:tomcat-embed-websocket:10.1.55=testCompileClasspath,testRuntimeClasspath +org.apache.tomcat.embed:tomcat-embed-core:10.1.61=testCompileClasspath,testRuntimeClasspath +org.apache.tomcat.embed:tomcat-embed-el:10.1.61=testCompileClasspath,testRuntimeClasspath +org.apache.tomcat.embed:tomcat-embed-websocket:10.1.61=testCompileClasspath,testRuntimeClasspath org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath org.assertj:assertj-core:3.27.7=testCompileClasspath,testRuntimeClasspath org.awaitility:awaitility:4.2.2=testCompileClasspath,testRuntimeClasspath diff --git a/osv-scanner.toml b/osv-scanner.toml index 24fbe33..73862f3 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -10,7 +10,7 @@ # com.guard-core:guard-core (compile) and kotlin-reflect (compile) - proven in # the engine repo's docs/release-rehearsal.md POM audit. Everything below is # a test-scope package that consumers resolve at their own Boot-managed -# versions (spring-webmvc, tomcat, jackson, log4j-api). +# versions (spring-webmvc, jackson, log4j-api). # --- spring-webmvc 6.2.19: compileOnly + test-scope here (testImplementation # spring-boot-starter-web); NOT shipped by the adapter POM. Consumers resolve @@ -25,21 +25,6 @@ reason = "spring-webmvc 6.2.19 is compileOnly/test-scope in this repo and not sh id = "GHSA-pc63-qcmh-9cmg" reason = "spring-webmvc 6.2.19 is compileOnly/test-scope in this repo and not shipped by the adapter POM; consumers resolve their own Boot-managed version; fix train is the Boot 4 line per OSV" -# --- tomcat-embed-core 10.1.55: test-scope only (spring-boot-starter-test); -# not shipped by the adapter POM; consumers resolve their own container. - -[[IgnoredVulns]] -id = "GHSA-9xv2-5v5q-p794" -reason = "tomcat-embed-core 10.1.55 is test-scope (spring-boot-starter-test) and not shipped by the adapter POM; consumers resolve their own container version" - -[[IgnoredVulns]] -id = "GHSA-gcx9-497g-6cp6" -reason = "tomcat-embed-core 10.1.55 is test-scope (spring-boot-starter-test) and not shipped by the adapter POM; consumers resolve their own container version" - -[[IgnoredVulns]] -id = "GHSA-h3x4-894j-xpx5" -reason = "tomcat-embed-core 10.1.55 is test-scope (spring-boot-starter-test) and not shipped by the adapter POM; consumers resolve their own container version" - # --- jackson 2.21.4 (databind + core): test-scope only # (spring-boot-starter-test); not shipped by the adapter POM; consumers # resolve their own Boot-managed jackson.