Stirling-Tools/Stirling-PDF
1
0
Fork 0
mirror of https://github.com/Stirling-Tools/Stirling-PDF.git synced 2026-09-03 05:10:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Refresh CVE pins to latest patched releases and unify temurin digest

Browse Source
This commit is contained in:
Anthony Stirling
2026-07-31 14:13:10 +01:00
parent 92dd7f42e5
commit 47f74f89ce
7 changed files with 20 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/proprietary/build.gradle
+1 -1
View File
@@ -59,7 +59,7 @@ dependencies {
runtimeOnly "io.jsonwebtoken:jjwt-impl:${jwtVersion}"
runtimeOnly "io.jsonwebtoken:jjwt-jackson:${jwtVersion}"
runtimeOnly 'com.h2database:h2:2.3.232' // Don't upgrade h2database - file format incompatible with 2.4.x, would break existing user databases
runtimeOnly 'org.postgresql:postgresql:42.7.11'
runtimeOnly "org.postgresql:postgresql:${postgresqlVersion}"
implementation('com.coveo:saml-client:5.0.0') {
exclude group: 'org.opensaml', module: 'opensaml-core'
}
build.gradle
+14 -23
View File
@@ -45,13 +45,13 @@ ext {
awsSdkVersion = "2.44.12"
testcontainersMinioVersion = "1.21.4"
// Security CVE overrides for Spring Boot 4 BOM-managed transitives
nettyVersion = "4.2.15.Final"
jackson2Version = "2.22.0"
// jackson-annotations ships 2-component versions (2.22, not 2.22.0)
nettyVersion = "4.2.16.Final"
jackson2Version = "2.22.1"
// jackson-annotations ships 2-component versions (2.22, not 2.22.1)
jackson2AnnotationsVersion = "2.22"
// Jackson 3 (tools.jackson) used by Spring Boot 4; 3.1.4 patches CVE-2026-54512..54518
jackson3Version = "3.1.4"
postgresqlVersion = "42.7.11"
// Jackson 3 (tools.jackson) used by Spring Boot 4; stays on Spring's 3.1.x line
jackson3Version = "3.1.5"
postgresqlVersion = "42.7.13"
// velocity-engine-core 2.3 (via shib-velocity SAML stack) shades a vulnerable
// commons-io 2.8.0 (CVE-2024-47554) into its jar; 2.4.1 no longer shades it
velocityVersion = "2.4.1"
@@ -241,36 +241,27 @@ subprojects {
resolutionStrategy.force "commons-io:commons-io:${commonsIoVersion}"
// CVE-2024-47554: velocity-engine-core 2.3 shades commons-io 2.8.0; 2.4.1 unshades it
resolutionStrategy.force "org.apache.velocity:velocity-engine-core:${velocityVersion}"
// Jackson 2 is transitive-only here (jinjava, opensaml, jjwt request older versions);
// pin the family to a current release and keep modules aligned.
resolutionStrategy.force "com.fasterxml.jackson.core:jackson-core:${jackson2Version}"
resolutionStrategy.force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}"
resolutionStrategy.force "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${jackson2Version}"
resolutionStrategy.force "com.fasterxml.jackson.datatype:jackson-datatype-jdk8:${jackson2Version}"
resolutionStrategy.force "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${jackson2Version}"
// Keep BouncyCastle modules aligned to avoid runtime linkage errors
resolutionStrategy.force "org.bouncycastle:bcprov-jdk18on:${bouncycastleVersion}"
resolutionStrategy.force "org.bouncycastle:bcpkix-jdk18on:${bouncycastleVersion}"
resolutionStrategy.force "org.bouncycastle:bcutil-jdk18on:${bouncycastleVersion}"
resolutionStrategy.eachDependency { details ->
// Netty 4.2.x: CVE-2026-44249/45416/45673/45674/47244/47691/48043/50010/50020/50560
// /42579/42580/42581/42583/42584/42585/42587/41417 - force 4.2.15.Final across all modules
// Netty: GHSA-gcjf-9mgh-3p7g/q4f6-jm68-57ww/4mp9-239f-g9hg/6cqp-g7gg-8hr5 need 4.2.16+
if (details.requested.group == "io.netty") {
details.useVersion nettyVersion
details.because "CVE-2026 netty fixes (>=4.2.15.Final)"
details.because "netty CVE fixes (>=4.2.16.Final)"
}
// Jackson 2.x: CVE-2026-54512/54513/54514/54515/54516/54517/54518 - force 2.22.0.
// jackson-annotations uses 2-component versions (2.22), unlike core/databind (2.22.0).
// Jackson 2.x: GHSA-5gvw-p9qm-jgwh (@JsonView bypass) fixed in 2.22.1.
// jackson-annotations uses 2-component versions (2.22), unlike core/databind.
if (details.requested.group.startsWith("com.fasterxml.jackson")) {
details.useVersion(details.requested.name == "jackson-annotations"
? jackson2AnnotationsVersion : jackson2Version)
details.because "CVE-2026-54512..54518 jackson 2.x fixes (>=2.22.0)"
details.because "jackson 2.x CVE fixes (>=2.22.1)"
}
// Jackson 3 (tools.jackson) ships with Spring Boot 4; same CVE-2026-54512..54518
// family is fixed in 3.1.4 (stays in Spring Boot's 3.1.x line).
// Jackson 3 (tools.jackson) ships with Spring Boot 4; same advisory fixed in 3.1.5
if (details.requested.group.startsWith("tools.jackson")) {
details.useVersion jackson3Version
details.because "CVE-2026-54512..54518 jackson 3.x fixes (>=3.1.4)"
details.because "jackson 3.x CVE fixes (>=3.1.5)"
}
}
}
@@ -282,7 +273,7 @@ subprojects {
dependencies {
// Override BOM-managed commons-lang3 for CVE-2025-48924 fix
dependency "org.apache.commons:commons-lang3:$commonsLang3"
// CVE-2026-42198: Spring Boot 4 BOM pins postgresql 42.7.10; override to patched 42.7.11
// GHSA-j92g-9f8w-j867 (channel-binding downgrade): BOM pins 42.7.10, needs 42.7.12+
dependency "org.postgresql:postgresql:$postgresqlVersion"
}
}
docker/backend/Dockerfile
+1 -1
View File
@@ -43,7 +43,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
--no-daemon
# Stage 2: Extract Spring Boot Layers
FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
WORKDIR /tmp
COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
docker/base/Dockerfile
+1 -1
View File
@@ -365,7 +365,7 @@ RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
# Final runtime image - the actual base image
FROM eclipse-temurin:25-jre-noble@sha256:f9bd8815e73632c22985ebb133ec49b9fc4ad5ffe0657594ac02748ad0431ab7 AS runtime
FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS runtime
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
docker/embedded/Dockerfile
+1 -1
View File
@@ -59,7 +59,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
--no-daemon
# Stage 2: Extract Spring Boot Layers
FROM eclipse-temurin:25-jre-noble@sha256:f9bd8815e73632c22985ebb133ec49b9fc4ad5ffe0657594ac02748ad0431ab7 AS jar-extract
FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
WORKDIR /tmp
COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
docker/embedded/Dockerfile.fat
+1 -1
View File
@@ -54,7 +54,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
--no-daemon
# Stage 2: Extract Spring Boot Layers
FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
WORKDIR /tmp
COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
docker/embedded/Dockerfile.ultra-lite
+1 -1
View File
@@ -55,7 +55,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
# Stage 2: Runtime image
# glibc base (not Alpine/musl): JPDFium's PDFium natives are glibc-linked.
FROM eclipse-temurin:25-jre-noble@sha256:f9bd8815e73632c22985ebb133ec49b9fc4ad5ffe0657594ac02748ad0431ab7
FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175
ENV DEBIAN_FRONTEND=noninteractive \
LANG=C.UTF-8 \