Repository navigation
Enable Gradle dependency locking + clear the CVEs it revealed - #184
Merged
Merged
Conversation
The CVE scan reads resolved deps from a lock file; java-sdk committed none, so it scanned thin and showed a false-clean 0. Lock the runtime classpath of the six published client libraries (committed gradle.lockfile per module), which surfaced real HIGH findings -- fixed here: - jackson 2.18.6 -> 2.18.11 (versions.gradle): 8 CVEs incl. 2 RCE (CVE-2026-54512/54513) across jackson-core + jackson-databind - spring-boot-starter 3.5.13 -> 3.5.15 (conductor-client-spring): clears the spring-boot CVE and pulls spring-framework 6.2.19 (spring-expression CVE-2026-41850) - spring-boot-starter 4.0.6 -> 4.0.7 (conductor-client-spring-boot4): pulls spring-framework 7.0.8 (spring-expression CVE-2026-41850) - micrometer-registry-prometheus 1.15.1 -> 1.15.12 (conductor-client-metrics): CVE-2026-40983/40984 Only runtimeClasspath is locked (what ships); all six lockfiles now scan clean and all published modules assemble.
c4lm
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes java-sdk's CVE-scan blind spot and clears the HIGH findings it was hiding.
Why this was invisible: the Trivy scan reads resolved deps from a lock file. java-sdk committed none, so it scanned thin (no pinned transitive graph) and showed a false-clean
0. This enables Gradle dependency locking on theruntimeClasspathof the six published client libraries and commits agradle.lockfileper module -- which immediately surfaced real HIGH CVEs, fixed here.jackson is a global bump in
versions.gradle; the spring-boot and micrometer bumps are per-module. OnlyruntimeClasspathis locked (what ships) -- test and compile-only configs stay unlocked.Verification: all six published modules assemble under JDK 21, and every committed
gradle.lockfilenow scans 0 HIGH/CRITICAL (Trivy 0.76). CI runs the full build + tests.User impact: the Java client libraries were pulling jackson with two remote-code-execution bugs plus high-severity spring and micrometer issues, all unseen because the scan couldn't read the dependency graph. This both fixes them and makes future dependency CVEs detectable.
Parent: #180
Fixes #181
Fixes #182
Fixes #183