chore(deps): automated dependency updates 2026-08-31 - #165
Closed
izg-dependency-bot[bot] wants to merge 2 commits into
Closed
chore(deps): automated dependency updates 2026-08-31#165izg-dependency-bot[bot] wants to merge 2 commits into
izg-dependency-bot[bot] wants to merge 2 commits into
Conversation
The 2026-08-31 nightly failed its post-update CVE scan. The 7 camel CVEs fixed by 4.18.4 are gone; this is a new finding published since. CVE-2026-66908 (CVSS 7.5) is in the Apache Camel Platform HTTP Main component: the camel-main embedded HTTP server built Vert.x JWTAuth from the keystore alone when neither jwtIssuer nor jwtAudience was set, so inbound tokens were checked only for signature and expiry. See CAMEL-24281. No upgrade clears it on our line. The advisory is explicit: "This behaviour is fixed only on 4.22.0 ... The fail-closed guard could not be backported." 4.18.4 is the newest 4.18.x release. Camel 4.22.0 is not available to us. camel-spring-boot switched to Spring Boot 4 at 4.19.0: 4.19.0 and 4.20.0 resolve Spring Boot 4.0.5, 4.21.0 and 4.22.0 resolve Spring Boot 4.1.0 with Spring Framework 7.0.8. Pinning Spring Boot 3.5.16 underneath camel 4.22.0 resolves cleanly but does not run — camel-spring-boot-4.22.0.jar is compiled against Spring Boot 4 package locations that do not exist in 3.5.16: org.springframework.boot.EnvironmentPostProcessor -> 3.5.16 has org.springframework.boot.env.EnvironmentPostProcessor org.springframework.boot.tomcat.servlet.TomcatServletWebServerFactory -> 3.5.16 has org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory Both ship in the core spring-boot artifact, which is on the classpath at 3.5.16, so these are NoClassDefFoundError at startup, not unresolved optional jars. izgw-core, izgw-hub, izgw-transform and v2tofhir all take this BOM as parent and none declares its own spring-boot.version, so moving off 3.5.x is a coordinated four-repo major upgrade. Suppress with an expiry of 2027-02-28 to put a date on that decision. The vulnerable code is not on the classpath: camel-platform-http-main and io.vertx are absent from both the BOM validation tree and izgw-transform, and camel-main-4.18.4.jar carries no JWT, platform-http or Vert.x classes. Matched on <cve> alone. Per the suppression XSD, <cpe> is a suppress-what element rather than a dependency selector, so keying on cpe:/a:apache:camel would have hidden every camel finding including future ones. Also remove the CVE-2026-54285 opentelemetry entry added in fa8bd73. It never matched: it was keyed on <packageUrl>, but opentelemetry-api ships no META-INF/maven (the Java client builds with Gradle) so Dependency-Check derives no purl for it. Rather than re-key it, let the finding stand. At CVSS 5.3 it is below the --failOnCVSS 7 gate, so it never fails a build; it sets HAS_CVES, which labels the nightly PR "security" and leaves it for a human to merge. That is the intended behaviour of that gate. Verified: xmllint --schema dependency-suppression.1.3.xsd validates. Suppression matching itself is unverified locally — Dependency-Check needs the NVD database and an API key. Confirm with a workflow_dispatch run.
izg-dependency-bot
Bot
added
dependencies
Contributor
|
Closing because this was a test run out of a branch to test suppression. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Dependency Updates
This PR was created automatically by the
Automated Dependency Updatesworkflow.Version Changes (property-backed)
aws-sdk2.54.62.54.7Transitive Dependencies Auto-fixed
None — all transitives are already property-backed.
Transitives Requiring Manual Action
None.
Dependency Tree Changes
Excluded Libraries (not updated automatically)
org.bouncycastle:bc-fips(manually managed — not updated automatically)org.bouncycastle:bcpkix-fips(manually managed — not updated automatically)org.bouncycastle:bctls-fips(manually managed — not updated automatically)CVE Scan Results
dependency-check-report-pre-updateartifact.dependency-check-report-post-updateartifact.Notes
allowMajorUpdates=false).mvn dependency:resolveon the validation project.