fix(deps): clear all 12 known CVEs from the 2026-04-17 baseline by aksOps · Pull Request #50 · RandomCodeSpace/codeiq

aksOps · 2026-04-17T13:40:43Z

Bumps every dependency flagged by the OSV-Scanner + Dependabot pass to
its fixed version. Re-running OSV after this commit: 0 findings.

Maven (all transitive, overridden via pom properties and
dependencyManagement — nothing to change in our direct dep list):

tomcat-embed-core 11.0.20 -> 11.0.21 (tomcat.version property)
CVE-2026-34483 HIGH: JsonAccessLogValve improper encoding
CVE-2026-34487 HIGH: sensitive info insertion into log file
CVE-2026-34500 MOD : CLIENT_CERT auth does not fail as expected

tools.jackson.core:* 3.1.0 -> 3.1.1 (explicit management entries)
GHSA-2m67-wjpj-xhg9 HIGH: document length bypass in blocking/async/
DataInput parsers

log4j-core 2.25.3 -> 2.25.4 (explicit management entry)
CVE-2026-34477 MOD : verifyHostName silently ignored in TLS config
CVE-2026-34478 MOD : log injection in Rfc5424Layout
CVE-2026-34480 MOD : silent log-event loss in XmlLayout

log4j-layout-template-json 2.25.3 -> 2.25.4
CVE-2026-34481 MOD : improper serialization of non-finite floats

shiro-core 2.0.6 -> 2.1.0
CVE-2026-23901 LOW : observable timing discrepancy
(pulled in by neo4j-security)

mcp-core 1.1.0 -> 1.1.1
CVE-2026-34237 MOD : hardcoded wildcard CORS on MCP endpoints.
Load-bearing for us — our read-only MCP API should not accept
cross-origin requests from arbitrary origins.

npm (direct dev dependency):

vite 6.4.1 -> 6.4.2 (src/main/frontend/)
CVE-2026-39363 HIGH: arbitrary file read via dev server WebSocket
CVE-2026-39365 MOD : path traversal in optimized deps .map handling
Dev-only (build tool) — blast radius is the developer machine.

Note on Jackson: Spring Boot 4.0.5's <jackson.version> property pins
only the new-API artifacts (tools.jackson.core:*) — Spring Boot does
not propagate it to them, so the property override by itself is a
no-op. Explicit entries for jackson-core /
-databind / -annotations are required until the Boot BOM catches up.

Revert hints are captured in the pom's comment blocks so when Spring
Boot 4.0.6+ / the Spring-AI BOM / Neo4j 2026.02.4 ship with these
versions naturally, these overrides can go away.

Verified:
mvn test -> 3,059 tests, 0 failures, 0 errors
osv-scanner -> 0 findings (was 12: 4 HIGH / 7 MOD / 1 LOW)
dependency:tree -> all 6 Maven and 1 npm versions match fix targets

Summary by CodeRabbit

Release Notes

Chores
- Updated all project dependencies with explicit version management across multiple backend and frontend components. Updated versions include: Apache Tomcat (11.0.21), Jackson libraries (3.1.1), Log4j (2.25.4), Apache Shiro (2.1.0), Model Context Protocol SDK (1.1.1), and frontend build tool Vite (6.4.2). All component versions are now explicitly pinned in project dependency management.

Bumps every dependency flagged by the OSV-Scanner + Dependabot pass to its fixed version. Re-running OSV after this commit: 0 findings. Maven (all transitive, overridden via pom properties and dependencyManagement — nothing to change in our direct dep list): tomcat-embed-core 11.0.20 -> 11.0.21 (tomcat.version property) CVE-2026-34483 HIGH: JsonAccessLogValve improper encoding CVE-2026-34487 HIGH: sensitive info insertion into log file CVE-2026-34500 MOD : CLIENT_CERT auth does not fail as expected tools.jackson.core:* 3.1.0 -> 3.1.1 (explicit management entries) GHSA-2m67-wjpj-xhg9 HIGH: document length bypass in blocking/async/ DataInput parsers log4j-core 2.25.3 -> 2.25.4 (explicit management entry) CVE-2026-34477 MOD : verifyHostName silently ignored in TLS config CVE-2026-34478 MOD : log injection in Rfc5424Layout CVE-2026-34480 MOD : silent log-event loss in XmlLayout log4j-layout-template-json 2.25.3 -> 2.25.4 CVE-2026-34481 MOD : improper serialization of non-finite floats shiro-core 2.0.6 -> 2.1.0 CVE-2026-23901 LOW : observable timing discrepancy (pulled in by neo4j-security) mcp-core 1.1.0 -> 1.1.1 CVE-2026-34237 MOD : hardcoded wildcard CORS on MCP endpoints. Load-bearing for us — our read-only MCP API should not accept cross-origin requests from arbitrary origins. npm (direct dev dependency): vite 6.4.1 -> 6.4.2 (src/main/frontend/) CVE-2026-39363 HIGH: arbitrary file read via dev server WebSocket CVE-2026-39365 MOD : path traversal in optimized deps .map handling Dev-only (build tool) — blast radius is the developer machine. Note on Jackson: Spring Boot 4.0.5's `<jackson.version>` property pins only the new-API artifacts (tools.jackson.core:*) — Spring Boot does not propagate it to them, so the property override by itself is a no-op. Explicit <dependencyManagement> entries for jackson-core / -databind / -annotations are required until the Boot BOM catches up. Revert hints are captured in the pom's comment blocks so when Spring Boot 4.0.6+ / the Spring-AI BOM / Neo4j 2026.02.4 ship with these versions naturally, these overrides can go away. Verified: mvn test -> 3,059 tests, 0 failures, 0 errors osv-scanner -> 0 findings (was 12: 4 HIGH / 7 MOD / 1 LOW) dependency:tree -> all 6 Maven and 1 npm versions match fix targets

coderabbitai · 2026-04-17T13:40:58Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ba982259-f39c-4e2a-b3d1-cf21a0757007

📥 Commits

Reviewing files that changed from the base of the PR and between 066d870 and 9a1a771.

⛔ Files ignored due to path filters (1)

src/main/frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

pom.xml
src/main/frontend/package.json

📝 Walkthrough

Walkthrough

Maven property definitions and transitive dependency management overrides were added to pin versions for Tomcat (11.0.21), Jackson 3.x components (3.1.1), Log4j (2.25.4), Apache Shiro (2.1.0), and MCP SDK (1.1.1). Frontend build tool Vite was updated from ^6.1.0 to ^6.4.2, with package ordering adjusted.

Changes

Cohort / File(s)	Summary
Maven Dependency Management `pom.xml`	Introduced `tomcat.version` and `jackson.version` properties. Added `dependencyManagement` entries explicitly pinning transitive dependencies: log4j-core/log4j-layout-template-json (2.25.4), shiro-core (2.1.0), mcp-core (1.1.1), and Jackson 3.x modules (3.1.1) to override defaults.
Frontend Dependencies `src/main/frontend/package.json`	Reordered dependency entries. Updated Vite from ^6.1.0 to ^6.4.2 in devDependencies.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Versions pinned with careful care,
Dependencies updated, patches fair,
Tomcat, Jackson, Log4j too,
Vite jumps forward, shiny new! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch phase-b/dep-bumps

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sonarqubecloud · 2026-04-17T13:43:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…ner (#50) (#55) Replace full @SpringBootTest bootstrap with ApplicationContextRunner that loads only UnifiedConfigBeans + ProjectConfigLoader. All 4 tests pass in under a second vs. multi-second full-context startup, same correctness guarantee for the config-wiring surface. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

aksOps merged commit 2f398fb into main Apr 17, 2026
5 of 6 checks passed

This was referenced Apr 23, 2026

chore(config): retire legacy ProjectConfigLoader static API (#52) #52

Merged

chore(config): freeze CodeIqConfig mutation surface (#49) #53

Merged

aksOps deleted the phase-b/dep-bumps branch April 26, 2026 05:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): clear all 12 known CVEs from the 2026-04-17 baseline#50

fix(deps): clear all 12 known CVEs from the 2026-04-17 baseline#50
aksOps merged 1 commit into
mainfrom
phase-b/dep-bumps

aksOps commented Apr 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 17, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

sonarqubecloud Bot commented Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

aksOps commented Apr 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Release Notes

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

sonarqubecloud Bot commented Apr 17, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aksOps commented Apr 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 17, 2026 •

edited

Loading