From c354acb1e44ff7fb4c3750b3537a7aec94e31aa3 Mon Sep 17 00:00:00 2001
From: lekhrocks <lekh.nith@gmail.com>
Date: Sat, 3 Oct 2026 14:28:39 +0530
Subject: [PATCH] fix(deps): bump tomcat-embed to 10.1.60 and jackson to 2.21.7

Override Spring Boot 3.5.16 BOM pins via gradle.properties project
properties (dependency-management gives them precedence):

- tomcat.version=10.1.60: CVE-2026-68525 (FORM auth bypass),
  CVE-2026-65905 (DIGEST replay), CVE-2026-65182 (constraint bypass).
  10.1.58 was never published; 10.1.60 carries the fixes.
- jackson-bom.version=2.21.7: CVE-2026-89425 (jackson-core DoS),
  CVE-2026-91777 (jackson-databind DoS), GHSA-mhm7-754m-9p8w.

Also bump the version-catalog jackson pin to 2.21.7 (syncflow-common
has no Spring BOM, so the catalog was its only version source at the
vulnerable 2.18.3), and drop syncflow-api's jackson-bom 2.21.5
re-import, superseded by the central property.
---
 gradle.properties         |  8 ++++++++
 gradle/libs.versions.toml |  2 +-
 syncflow-api/build.gradle | 10 ++--------
 3 files changed, 11 insertions(+), 9 deletions(-)
 create mode 100644 gradle.properties

diff --git a/gradle.properties b/gradle.properties
new file mode 100644
index 0000000..7f62e10
--- /dev/null
+++ b/gradle.properties
@@ -0,0 +1,8 @@
+# CVE-2026-68525 / CVE-2026-65905 / CVE-2026-65182: Tomcat FORM auth bypass,
+# DIGEST replay, security constraint bypass. Spring Boot 3.5.16's BOM pins
+# 10.1.55; override the BOM property (dependency-management gives project
+# properties precedence). 10.1.58 was never published; 10.1.60 carries the fix.
+tomcat.version=10.1.60
+# CVE-2026-89425: jackson-core DoS via unbounded StringBuilder on malformed
+# tokens. Spring Boot 3.5.16's BOM pins 2.21.4; override to patched 2.21.7.
+jackson-bom.version=2.21.7
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index e5bf9ae..7361582 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -8,7 +8,7 @@ springdoc = "2.8.6"
 lombok = "1.18.38"
 mapstruct = "1.6.3"
 mapstruct-processor = "1.6.3"
-jackson = "2.18.3"
+jackson = "2.21.7"
 micrometer = "1.15.5"
 opentelemetry = "2.15.0"
 testcontainers = "1.21.4"
diff --git a/syncflow-api/build.gradle b/syncflow-api/build.gradle
index 74d2ff0..3179074 100644
--- a/syncflow-api/build.gradle
+++ b/syncflow-api/build.gradle
@@ -4,14 +4,8 @@ plugins {
     alias(libs.plugins.spring.dependency.management)
 }
 
-// GHSA-mhm7-754m-9p8w: jackson-databind @JsonView bypass. Spring Boot 3.5.16's
-// BOM pins jackson-bom 2.21.4 (vulnerable). Re-import the Jackson BOM at the
-// patched 2.21.5 AFTER Spring Boot's BOM so the later import wins.
-dependencyManagement {
-    imports {
-        mavenBom "com.fasterxml.jackson:jackson-bom:2.21.5"
-    }
-}
+// Jackson BOM version is overridden centrally via jackson-bom.version in
+// gradle.properties (covers GHSA-mhm7-754m-9p8w and CVE-2026-89425).
 
 dependencies {
     implementation project(":syncflow-core")