Repository navigation
Define and enforce a meaningful Java dependency vulnerability gate #131
Description
Observed behavior
CI invokes org.owasp:dependency-check-maven:13.0.0:check with an NVD key, but neither pom.xml nor .github/workflows/ci.yml configures failBuildOnCVSS. The plugin default is 11, above the 0–10 CVSS range, so findings are reported without failing the build. Completed CI run 35766498882 / job 106877254883 exited successfully while its log listed CVE matches for dependencies including hutool-all, jackson-databind, log4j-api, spring-core, sqlite-jdbc, teaql-sqlite, and tomcat-embed-core.
This does not establish that every match affects TeaQL. For example, the teaql-sqlite artifact appears to have a broad SQLite CPE match and may be a false positive. The scan report and dependency paths need review before enforcing a threshold. This issue is distinct from #130, which tracks long-running NVD data acquisition.
Acceptance criteria
- Retain the full scanner output/report as an inspectable CI artifact and document the scan timestamp, plugin version, and database freshness.
- Triage each current finding against the actual artifact, dependency path, affected version, and reachable usage; record any false-positive suppression with a narrow justification and expiry/review date.
- Upgrade/remediate confirmed vulnerabilities or record an explicit accepted-risk decision with owner and review date.
- Configure a meaningful CVSS policy so future untriaged high-severity findings fail CI; verify this with a controlled negative test and a clean positive test.
- Keep this work separate from the ordered runtime PR queue and do not silently disable or skip the scan to make checks green.
References
- Successful scan with warnings: https://github.com/teaql/teaql-java/actions/runs/35766498882/job/106877254883
- Plugin documented default: https://dependency-check.github.io/DependencyCheck/dependency-check-maven/xref/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.html
Activity
philipgreat commentedon Sep 22, 2026
Prepared a stacked follow-up branch for report retention:
ci/retain-odc-reports-131(1db4569), based on draft #132. It adds HTML + JSON reports (-Dformat=HTML,JSON) and anif: always()artifact upload with 30-day retention. Local YAML parse, upload-step assertions, andgit diff --checkpassed. I have not opened the PR yet because #132 is still in its first NVD refresh; opening another stacked PR now would launch a redundant cold scan. This branch does not set a CVSS failure threshold or claim any finding is exploitable; those remain subject to the per-finding triage in this issue.philipgreat commentedon Sep 22, 2026
Concrete dependency mediation finding (source-only triage, not exploitability assessment): at the current queued source,
teaql-utils/pom.xmldirectly declarescommons-lang3:3.14.0, butmvn -B -pl teaql-core -am dependency:tree -Dverbose -Dincludes=org.apache.commons:commons-lang3resolvesteaql-core -> teaql-utils -> commons-lang3:3.13.0 (version managed from 3.14.0). The parent imports Spring Boot BOM 3.2.0. The completed CI scan also reports CVE-2025-48924 against both 3.13.0 and 3.14.0; Apache Commons Lang release notes say 3.18.0 rewrote the affectedClassUtils.getClassrecursion (https://commons.apache.org/proper/commons-lang/changes.html). Existing Dependabot PR #63 only editsteaql-utils/pom.xmlto 3.20.0, so it does not by itself prove reactor consumers resolve 3.20.0. Remediation should set one effective parent dependency-management version and verify the reactor dependency tree, then test. This does not claim TeaQL exposes the vulnerable method to untrusted input.philipgreat commentedon Sep 22, 2026
Prepared remediation branch
fix/commons-lang-management-131atbc8ae1c(based on current main, not merged): parent dependencyManagement now pins Commons Lang 3.20.0, and teaql-utils inherits it instead of declaring a separate version. Evidence on that branch:mvn -B dependency:tree -Dincludes=org.apache.commons:commons-lang3 -DoutputType=textreported only3.20.0across the complete reactor;mvn -q testexited 0;./scripts/verify-examples.shexited 0 (PASS: all Java examples);git diff --checkpassed. Test-generated.local/andteaql-sqlite/teaql_test.dbwere not committed. The branch is pushed but no PR opened yet, avoiding another concurrent cold OWASP scan while #114 and #132 are live. This addresses one dependency version finding only; other #131 acceptance criteria and impact triage remain open.philipgreat commentedon Sep 22, 2026
Jackson dependency-mediation evidence from current main 2af3701 (source-only triage, not an exploitability assessment):
The completed #132 OWASP log reports findings against all three library versions. Next triage must inspect exact advisories, affected ranges, dependency paths, reachable usage, and a compatible managed version. This comment does not assert that every scanner match is exploitable or prescribe a blind BOM upgrade.
philipgreat commentedon Sep 22, 2026
Report-retention branch ci/retain-odc-reports-131 is refreshed to 7ec6fad on top of the fully green #132 head. Local workflow YAML parse, step-order inspection, clean worktree, and
git diff --checkpass. Official Dependency-Check Maven 13.0.0 documentation confirms theformatproperty accepts a comma-separated list, so-Dformat=HTML,JSONrequests both report types. This is not yet a PR or a validated uploaded CI artifact; it remains queued behind #132 and the runtime merge order.philipgreat commentedon Sep 22, 2026
Further local ordered-queue preflight for the Commons Lang remediation: combined fix/commons-lang-management-131 commit bc8ae1c with current-main + #126 + #128 + #129 + #120 + #134 as local commit 8c98d1f87971487108ff95f7244eaa969462c08a, without merge conflict. On JDK 21, the full-reactor dependency tree resolved every commons-lang3 occurrence to 3.20.0 and exited 0;
mvn -q testexited 0;./scripts/verify-examples.shexited 0;git diff --checkpassed. This is local source evidence, not a PR, vulnerability exploitability ruling, or completed CVSS gate. The queued main runtime PRs still await their current-head checks.philipgreat commentedon Sep 23, 2026
Ordered PRs are now available: #143 retains Dependency-Check HTML+JSON as a 30-day artifact (stacked after #142); #144 pins the effective reactor Commons Lang version to 3.20.0 (stacked after #143). On exact #144 head 9e197d7, the full JDK 21 Maven test reactor and all Java examples exited 0; the full dependency tree showed only commons-lang3 3.20.0. Both PRs remain draft and have not been merged. This is partial #131 progress only: per-finding triage, CVSS policy, and controlled negative/positive gate tests remain open.
philipgreat commentedon Sep 23, 2026
Scanner-match triage evidence for the own teaql-sqlite artifact (not a blanket waiver): completed CI run 35766498882 maps io.teaql:teaql-sqlite:1.548-RELEASE to CPE cpe:2.3:a:sqlite:sqlite:1.548:release and lists SQLite engine CVEs. The published local Maven jar at io/teaql/teaql-sqlite/1.548-RELEASE contains TeaQL Java classes (SingleConnectionDataSource, SqliteDataServiceExecutor, SqlitePortableSQLRepository), metadata, and module-info; it does not package the SQLite engine. Its POM declares org.xerial:sqlite-jdbc as a separate dependency, and that dependency is separately reported by the scanner. This supports a narrow false-positive suppression for only the TeaQL wrapper artifact plus the SQLite-engine CPE, not suppression of sqlite-jdbc or all SQLite findings. Exact suppressions and CVSS policy still require retained JSON reports and a controlled negative gate test; issue remains open.
philipgreat commentedon Sep 23, 2026
Additional dependency-path triage: full JDK 21 reactor dependency:tree shows httpclient:4.0.1 only under teaql-android -> com.google.android:android:4.1.1.4:provided -> org.apache.httpcomponents:httpclient:4.0.1:provided. This is a provided-scope Android compile stub path, not a TeaQL runtime-shipped dependency. The scanner default skipProvidedScope is false, so it reports this path. Any future scope exclusion must be explicit and tested; application/platform dependency scans remain responsible for what they actually ship. No scanner configuration has been changed from this observation alone.
philipgreat commentedon Sep 23, 2026
Partial Jackson remediation prepared as stacked draft PR #150, head 3497a4b. The full runtime reactor previously resolved databind 2.13.5, 2.15.3, and 2.16.1; PR #150 manages Jackson with BOM 2.22.3 and removes three direct old versions. The full runtime dependency tree now resolves databind/core 2.22.3 and annotations 2.22; a checked-in CI verifier enforces those effective versions. JDK 21 full Maven tests and all Java examples passed locally. Generated conformance applications still use their independent Boot BOM and resolve databind 2.21.4, so this is not a full-repository claim or a clean security scan. FasterXML release information: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.22 . Per-finding vulnerability triage and failBuildOnCVSS remain open.
philipgreat commentedon Sep 23, 2026
Prepared a narrow false-positive rule in draft PR #152, head 10cbb9e (stacked on #150). It selects only pkg:maven/io.teaql/teaql-sqlite@1.548-RELEASE plus the exact misidentified SQLite-engine CPE and expires 2026-10-23; no org.xerial:sqlite-jdbc or CVSS-wide waiver is present. Source JAR inspection and prior scanner log support this classification. OWASP suppression XSD validation passed; the new Python scope/expiry tests passed (10/10 discovery); Maven effective POM resolves the file from the root reactor; JDK 21 full mvn test exited 0. Do not close #131 yet: a fresh trusted NVD report must prove actual scanner behavior, and high-severity failBuildOnCVSS plus controlled negative/positive tests are still open.
philipgreat commentedon Sep 23, 2026
PR #152 exact-head Example Gate run 35805365241 completed successfully (all Java examples). Static inspection of the locally resolved Dependency-Check 13.0.0 SuppressionRule.process bytecode confirms packageUrl matching is checked first and returns on mismatch, then CPE matching is applied; the rule therefore requires both the TeaQL wrapper PURL and the exact false-positive CPE. This is stronger rule-scope evidence, but it is not a completed fresh NVD scan or a positive/negative failBuildOnCVSS gate test. The main-branch NVD refresh run 35798370962 is still in progress; no duplicate scan was launched.
philipgreat commentedon Sep 23, 2026
Additional partial consistency fix: draft Java PR #153 aligns the retained conformance and school application examples plus the provider test dependency to the
teaql-sqlitemodule’s existingsqlite-jdbc:3.53.2.1. JDK 21 full Maven tests, all Java examples, and exact-head hosted Example Gate passed; the full-reactor dependency tree confirms the application example uses 3.53.2.1. Its generated conformance core still resolves 3.53.2.0 and was not edited manually. The generator’s older 3.45.2.0 default is addressed in separate draft teaql/teaql-code-gen#211. This is not a clean vulnerability-scan claim; current NVD refresh and CVSS policy validation remain open.philipgreat commentedon Sep 23, 2026
Precise Maven mediation correction for generated core:
mvn -pl examples/conformance/lib dependency:tree -Dverbose -Dincludes=org.xerial:sqlite-jdbcreportsteaql-sqlite:1.548-RELEASE -> sqlite-jdbc:3.53.2.0 (version managed from 3.53.2.1). The 3.53.2.0 selection comes from the generated core Spring Boot 4.1.0 BOM, not an explicit old driver in its POM. Generator draft PR teaql/teaql-code-gen#211 now adds driver dependencyManagement to the core template; its live Maven-tree assertion proves 3.53.2.1 on the generated fixture. The app examples separately pin 3.53.2.1 under Java draft #153. A future scan must still establish what findings remain.philipgreat commentedon Sep 23, 2026
Generated Java example dependency triage progressed in teaql/teaql-code-gen#213 (draft, stacked after #211): the
java-lib-coretemplate now selects Hutool 5.8.47 instead of 5.8.20, with actual generated-core Maven dependency-tree and School/SQLite integration evidence on JDK 21. GitHub Advisory GHSA-gcfh-36x4-mgj6 reports its QLExpressEngine issue affected versions below 5.8.40; generated TeaQL entity code usesDigestUtil.bcrypt, whose method is still present in the selected artifact. This is not proof that all Hutool advisories or the full reactor vulnerability gate are clear; the fresh trusted Dependency-Check report and reachability triage remain required.philipgreat commentedon Sep 23, 2026
Retained generated-library scope note: three checked-in Java example core POM snapshots (
examples/conformance/lib,examples/school-management/lib,examples/order-management/java-lib-core/lib) still declare Hutool 5.8.20. Upstream generator fix teaql/teaql-code-gen#213 is draft and not released. These generated libraries should be regenerated from the corrected generator in a controlled follow-up; manually patching their POMs would make the snapshot diverge from its source. Until that replay and a fresh OWASP scan, the Java reactor may continue to report the old Hutool dependency despite upstream source remediation.philipgreat commentedon Sep 23, 2026
The first completed cold-data CI scan is run 35809567981 on #147. Bootstrap mirror, authenticated NVD delta, OWASP check and cache save all succeeded, so this is real execution evidence, unlike prior NVD timeouts. The scan log reports vulnerable dependencies in multiple modules, including old generated Hutool 5.8.20, Commons Lang 3.13.0, Jackson Databind 2.15.3 and Spring/Tomcat lines. It still exits 0 because the current dependency-check Maven configuration does not enforce an effective CVSS failure threshold. Do not call the vulnerability gate closed. Follow-up queue includes managed dependency updates, narrow false-positive suppression, generated Hutool update, report artifacts, then an explicit fail threshold after actual findings are triaged.
philipgreat commentedon Sep 23, 2026
Java runtime and checked-in example gate merged in #160 (caf3b32): CI Build/Test, Example Gate, and live PG/MySQL passed; 37 reactor reports plus standalone example scans retain HTML/JSON and fail at CVSS >= 7. The issue remains open intentionally because newly generated Java projects still depend on generator-template follow-up teaql/teaql-code-gen#212 (Hutool) and teaql/teaql-code-gen#214 / PR #215 (Boot/Tomcat). Audit evidence is in docs/security/2026-09-23-dependency-check-gate.md. GitHub auto-closed this issue on merge despite the PR wording, so it was reopened.
philipgreat commentedon Sep 23, 2026
Follow-up: generator Boot/Tomcat templates are now merged via teaql/teaql-code-gen#215 (3de5c6e). Generated Java lib/app dependency trees resolve Spring Core 7.0.9 and Tomcat Core 11.0.26. The remaining generator dependency gap for a fully clean newly generated project is Hutool #212 / draft PR #213; #131 stays open until that path is merged and reverified.
philipgreat commentedon Sep 23, 2026
2026-09-23 fresh exact-head evidence from Java release-preparation PR #162 / Build and Test run 35826794294 (head 21a39c5): downloaded retained
dependency-check-reportsartifact ID 10735642048 and parsed all 40 JSON reports (reactor plus standalone examples). Dependency-Check engineVersion is 13.0.0; report NVD API Last Checked is 2026-09-23T02:52:46Z and Last Modified is 2026-09-23T02:16:55Z. Across these reports there are zero distinct CVSS >= 7 findings. Five distinct medium findings remain: CVE-2011-1498 (4.3), CVE-2012-6636 (6.8), CVE-2014-3577 (5.8), CVE-2020-13956 (5.3), CVE-2026-54285 (5.3); they remain visible, not blanket-suppressed. The generated conformance-core report resolveshutool-all-5.8.47.jarwith zero listed vulnerabilities. This strengthens the checked-in Java source/example gate, but does not validate future generator output: teaql-code-gen #211 and #213 are still draft/stacked, so #131 remains open.philipgreat commentedon Sep 23, 2026
Generator adoption boundary found during the #131 follow-up: current teaql-code-gen
Domain.DEFAULT_TEAQL_JAVA_VERSIONis still1.547-RELEASE, while Java source/main has prepared1.549-RELEASEand the last public artifact is 1.548. The generator templates usedomain.teaqlVersion, so even after draft #211/#213 land, a new model withoutteaql_java_versionwill not automatically consume Java 1.549. Do not bump this default until the signed 1.549 tag is published and a clean generated-workspace consumer passes; then update the default and replay Java Console/Spring/Micronaut/Quarkus before claiming public adoption. This does not change the current CVSS gate result or imply that #211/#213 can be merged while draft.