fix(deps): clear four OSV advisories flagged by Scorecard

[ginccc]

OpenSSF Scorecard's Vulnerabilities check dropped 10 → 6 (4 existing vulnerabilities detected). Four advisories across three libraries — jackson-databind carries two.

Advisory	Package	Was	Now	Reached us via
GHSA-5gvw-p9qm-jgwh (6.5)	jackson-databind	2.22.0	2.22.1	quarkus-jackson:3.38.1
GHSA-5jmj-h7xm-6q6v (5.3)	jackson-databind	2.22.0	2.22.1	same
GHSA-pmhh-3w7g-xqp8 (4.7)	jsoup	1.22.2	1.23.1	direct dependency
GHSA-mx76-r943-rf8g	bcprov-lts8on	2.73.10	2.73.12	io.nats:jnats:2.26.0

None of the four is reachable from our code

Checked against each advisory's stated precondition rather than assumed:

• GHSA-5gvw needs @JsonView on an @JsonUnwrapped container — @JsonView appears in zero files under src/main/java.
• GHSA-5jmj needs per-property @JsonIgnoreProperties and case-insensitive deserialization. All six usages are class-level ignoreUnknown = true with no property list, and ACCEPT_CASE_INSENSITIVE_PROPERTIES is enabled nowhere — every "case-insensitive" hit in the tree is Pattern.CASE_INSENSITIVE or a doc comment.
• GHSA-pmhh is specific to jsoup's Cleaner sanitiser. WebScraperTool is the only jsoup consumer and calls only Jsoup.parse() — never Cleaner, Safelist or clean().
• GHSA-mx76 is a GCM chunking defect throwing a bad-tag exception on decryption — availability, not confidentiality — under the NATS client.

Fixed anyway: Scorecard counts advisories regardless of reachability, and staying current is cheaper than re-litigating reachability every scan. This is score hygiene, not an incident.

Why two of three are dependencyManagement overrides

• jsoup is a direct dependency → plain version bump.
• jackson-databind is Quarkus-BOM-managed at 2.22.0, exactly like jackson-core — which this POM already pins to 2.22.1 for GHSA-r7wm-3cxj-wff9. The new entry follows that established pattern rather than importing jackson-bom ahead of the platform BOM, keeping the blast radius small.
• bcprov-lts8on needed a pin because the tidier option does not work: io.nats:jnats 2.26.1 still declares 2.73.10, verified by reading its POM, so bumping the parent would not clear it.

Known, pre-existing version skew

databind and core now sit at 2.22.1 while the rest of the Jackson family (datatype-*, dataformat-*) stays at 2.22.0 and jackson-annotations at 2.22. That skew already existed for jackson-core alone; patch differences inside 2.22.x are binary-compatible. Aligning the family via jackson-bom would be tidier but moves more versions than Quarkus 3.38.1 was tested against — deliberately not done here.

Verification

• dependency:tree re-run after the change confirms all three resolve to the patched versions — not inferred from the POM
• ./mvnw compile → BUILD SUCCESS, no formatter churn

Local compile is a weak signal for a dependency change; ./mvnw verify with the integration tests in CI is the real gate.

Summary by CodeRabbit

• Bug Fixes

  • Addressed multiple dependency security vulnerabilities.
  • Updated jsoup and pinned secure versions of Jackson Databind and Bouncy Castle components.
  • Improved application security while preserving existing functionality.

• Documentation

  • Added changelog details covering the security updates and verification results.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

pom.xml

Package	Version	License	Issue Type
org.jsoup:jsoup	1.23.1	Null	Unknown License

Denied Licenses:

GPL-3.0, AGPL-3.0

OpenSSF Scorecard

Package	Version	Score	Details
maven/com.fasterxml.jackson.core:jackson-databind	2.22.1	Unknown	Unknown
maven/org.bouncycastle:bcprov-lts8on	2.73.12	Unknown	Unknown
maven/org.jsoup:jsoup	1.23.1	🟢 6.5	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 0/17 approved changesets -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• pom.xml

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3cd9e52e-f4d5-47e8-a2cb-161b9e2615f1

📥 Commits

Reviewing files that changed from the base of the PR and between aaf8ef6 and 130625a.

📒 Files selected for processing (2)

• docs/changelog.md
• pom.xml

---

📝 Walkthrough

Walkthrough

Maven dependency management pins secure Jackson databind and bcprov-lts8on versions and updates jsoup. The changelog documents four OSV advisory remediations, reachability analysis, Jackson version skew, and dependency-tree verification.

Changes

Dependency vulnerability remediation

Layer / File(s)	Summary
Secure dependency versions and verification pom.xml, docs/changelog.md	Maven pins jackson-databind to 2.22.1 and bcprov-lts8on to 2.73.12, and updates jsoup to 1.23.1. The changelog records the advisory analysis and verification results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: rolandpickl

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main dependency updates that address four OSV advisories reported by Scorecard.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependency-vulnerabilities

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}