fix

Dockerfile

@@ -43,6 +43,7 @@ ENV DISABLE_ADDITIONAL_FEATURES=true \
 RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
     echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
     echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
+    apk update && \
     apk upgrade --no-cache -a && \
     apk add --no-cache \
     ca-certificates \
@@ -55,6 +56,11 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     openssl \
     openssl-dev \
     openjdk21-jre \
+    # Security updates - remove when Alpine base image updates these
+    # libjxl fixes CVE-2024-11403, CVE-2024-11498
+    # rav1e fixes CVE-2025-4574, GHSA-2rxc-gjrp-vjhx, RUSTSEC-2024-0404, GHSA-pg9f-39pc-qf8g
+    libjxl \
+    rav1e \
     # Doc conversion
     gcompat \
     libc6-compat \
@@ -73,8 +79,9 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     python3 \
     ocrmypdf \
     py3-pip \
-    py3-pillow@testing \
-    py3-pdf2image@testing \
+    # py3-pillow fixes CVE-2025-48379 - ensure Pillow 11.3.0+ instead of 11.2.1
+    py3-pillow \
+    py3-pdf2image \
     # URW Base 35 fonts for better PDF rendering
     font-urw-base35 && \
     python3 -m venv /opt/venv && \

Dockerfile.fat

@@ -57,6 +57,7 @@ ENV DISABLE_ADDITIONAL_FEATURES=true \
 RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
     echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
     echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
+    apk update && \
     apk upgrade --no-cache -a && \
     apk add --no-cache \
     ca-certificates \
@@ -69,6 +70,11 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     openssl \
     openssl-dev \
     openjdk21-jre \
+    # Security updates - remove when Alpine base image updates these
+    # libjxl fixes CVE-2024-11403, CVE-2024-11498
+    # rav1e fixes CVE-2025-4574, GHSA-2rxc-gjrp-vjhx, RUSTSEC-2024-0404, GHSA-pg9f-39pc-qf8g
+    libjxl \
+    rav1e \
     # Doc conversion
     gcompat \
     libc6-compat \
@@ -88,8 +94,9 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     python3 \
     ocrmypdf \
     py3-pip \
-    py3-pillow@testing \
-    py3-pdf2image@testing && \
+    # py3-pillow fixes CVE-2025-48379 - ensure Pillow 11.3.0+ instead of 11.2.1
+    py3-pillow \
+    py3-pdf2image && \
     python3 -m venv /opt/venv && \
     /opt/venv/bin/pip install --no-cache-dir --upgrade pip setuptools && \
     /opt/venv/bin/pip install --no-cache-dir --upgrade unoserver weasyprint && \

Dockerfile.ultra-lite

@@ -24,9 +24,10 @@ COPY scripts/installFonts.sh /scripts/installFonts.sh
 COPY app/core/build/libs/*.jar app.jar
 
 # Set up necessary directories and permissions
-RUN echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
-    echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
+RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
+    echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
     echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
+    apk update && \
     apk upgrade --no-cache -a && \
     apk add --no-cache \
         ca-certificates \
@@ -36,7 +37,12 @@ RUN echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /et
         curl \
         shadow \
         su-exec \
-        openjdk21-jre && \
+        openjdk21-jre \
+        # Security updates - remove when Alpine base image updates these
+        # libjxl fixes CVE-2024-11403, CVE-2024-11498
+        # rav1e fixes CVE-2025-4574, GHSA-2rxc-gjrp-vjhx, RUSTSEC-2024-0404, GHSA-pg9f-39pc-qf8g
+        libjxl \
+        rav1e && \
     # User permissions
     mkdir -p /configs /logs /customFiles /usr/share/fonts/opentype/noto /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
     chmod +x /scripts/*.sh && \

app/proprietary/build.gradle

@@ -56,6 +56,9 @@ dependencies {
         implementation "org.opensaml:opensaml-core:$openSamlVersion"
         implementation "org.opensaml:opensaml-saml-api:$openSamlVersion"
         implementation "org.opensaml:opensaml-saml-impl:$openSamlVersion"
+        // Security vulnerability fixes - remove when parent dependencies update
+        implementation 'com.nimbusds:nimbus-jose-jwt:10.0.2' // CVE-2025-53864 - from spring-boot-starter-oauth2-client
+        implementation 'com.google.guava:guava:33.4.8-jre' // CVE-2023-2976, CVE-2020-8908 - from OpenSAML dependencies above
     }
     implementation 'com.coveo:saml-client:5.0.0'
 }

build.gradle

@@ -57,7 +57,7 @@ repositories {
 
 allprojects {
     group = 'stirling.software'
-    version = '1.1.1'
+    version = '1.1.2'
 
     configurations.configureEach {
         exclude group: 'commons-logging', module: 'commons-logging'
@@ -128,6 +128,13 @@ subprojects {
         imports {
             mavenBom "org.springframework.boot:spring-boot-dependencies:$springBootVersion"
         }
+        dependencies {
+            // Security vulnerability fixes - remove when Spring Security updates these
+            dependency 'com.nimbusds:nimbus-jose-jwt:10.0.2' // CVE-2025-53864 - from spring-boot-starter-oauth2-client
+            dependency 'com.google.guava:guava:33.4.8-jre' // CVE-2023-2976, CVE-2020-8908 - from OpenSAML dependencies
+            dependency 'commons-io:commons-io:2.14.0' // CVE-2024-47554 - from various dependencies
+            dependency 'org.apache.commons:commons-lang3:3.18.0' // CVE-2025-48924 - from transitive dependencies
+        }
     }
 
     dependencies {