From 040294ce4a170ba7cabfc4e7958d1d43502ebcad Mon Sep 17 00:00:00 2001
From: Russ Poetker <rpoetke1@jh.edu>
Date: Mon, 6 Apr 2026 14:08:54 -0400
Subject: [PATCH 1/2] Update deps for secops

---
 pass-core-main/pom.xml |  6 ------
 pom.xml                | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/pass-core-main/pom.xml b/pass-core-main/pom.xml
index 90742f47..0ea56f3c 100644
--- a/pass-core-main/pom.xml
+++ b/pass-core-main/pom.xml
@@ -114,12 +114,6 @@
     <dependency>
       <groupId>org.apache.activemq</groupId>
       <artifactId>artemis-jakarta-server</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>commons-logging</groupId>
-          <artifactId>commons-logging</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
 
     <dependency>
diff --git a/pom.xml b/pom.xml
index 15b37867..d4127c87 100644
--- a/pom.xml
+++ b/pom.xml
@@ -231,6 +231,42 @@
         <version>3.52.0</version>
       </dependency>
       <!-- End of transitive deps with convergence issues. -->
+
+      <!-- The following deps were declared to resolve CVEs from transitive deps. -->
+      <!-- These should all be checked whenever deps are upgraded. Should be removed if possible once parent -->
+      <!-- dep updates with fixed version. -->
+
+      <!-- CVE-2026-22732 -->
+      <dependency>
+          <groupId>org.springframework.security</groupId>
+          <artifactId>spring-security-web</artifactId>
+          <version>6.5.9</version>
+      </dependency>
+
+      <!-- CVE-2026-27446 -->
+      <dependency>
+          <groupId>org.apache.activemq</groupId>
+          <artifactId>artemis-jakarta-server</artifactId>
+          <version>2.53.0</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>commons-logging</groupId>
+                  <artifactId>commons-logging</artifactId>
+              </exclusion>
+          </exclusions>
+      </dependency>
+      <dependency>
+          <groupId>org.apache.activemq</groupId>
+          <artifactId>artemis-jakarta-client</artifactId>
+          <version>2.53.0</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>commons-logging</groupId>
+                  <artifactId>commons-logging</artifactId>
+              </exclusion>
+          </exclusions>
+      </dependency>
+      <!-- End of transitive deps with CVE issues. -->
     </dependencies>
   </dependencyManagement>
 

From 39179438c158404f0947cfb161afc0de15434677 Mon Sep 17 00:00:00 2001
From: Russ Poetker <rpoetke1@jh.edu>
Date: Fri, 10 Apr 2026 09:12:49 -0400
Subject: [PATCH 2/2] Import spring-security bom

---
 pom.xml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index d4127c87..862c481c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,6 +119,15 @@
         <scope>import</scope>
       </dependency>
 
+        <!-- Added to fix CVE-2026-22732 -->
+      <dependency>
+        <groupId>org.springframework.security</groupId>
+        <artifactId>spring-security-bom</artifactId>
+        <version>6.5.9</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
@@ -236,13 +245,6 @@
       <!-- These should all be checked whenever deps are upgraded. Should be removed if possible once parent -->
       <!-- dep updates with fixed version. -->
 
-      <!-- CVE-2026-22732 -->
-      <dependency>
-          <groupId>org.springframework.security</groupId>
-          <artifactId>spring-security-web</artifactId>
-          <version>6.5.9</version>
-      </dependency>
-
       <!-- CVE-2026-27446 -->
       <dependency>
           <groupId>org.apache.activemq</groupId>