From df51e1c98dfa9b1a940770c5a2ba191d1d4b2184 Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 12:34:32 +1000
Subject: [PATCH 1/2] [Security] Upgrade jackson to 2.21.4 and Netty to
 4.1.136.Final

Resolves HIGH-severity vulnerabilities flagged by the Trivy scan:
- jackson-databind: CVE-2026-54512 (arbitrary code execution), CVE-2026-54513
  (security bypass). Fixed by importing jackson-bom 2.21.4 in
  dependencyManagement (before vertx-stack-depchain so it wins for the
  transitively-resolved jackson).
- Netty: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901.
  Fixed by bumping netty.version 4.1.135.Final -> 4.1.136.Final.

UID2-7569 UID2-7570 UID2-7571 UID2-7572 UID2-7573 UID2-7574

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 pom.xml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 5dd9cc2..dcd86a2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -25,7 +25,8 @@
         <launcher.class>io.vertx.core.Launcher</launcher.class>
 
         <uid2-shared.version>11.6.0</uid2-shared.version>
-        <netty.version>4.1.135.Final</netty.version>
+        <netty.version>4.1.136.Final</netty.version>
+        <jackson.version>2.21.4</jackson.version>
         <image.version>${project.version}</image.version>
     </properties>
 
@@ -50,6 +51,15 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Force jackson to a fixed version to resolve CVE-2026-54512, CVE-2026-54513 (UID2-7569, UID2-7570).
+                 Declared before vertx-stack-depchain so this version wins for transitively-managed jackson. -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>

From 7fa050554fde430f645be409c141636f06edc751 Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 16:24:51 +1000
Subject: [PATCH 2/2] [Security] Remove obsolete jackson CVE-2026-54512/54513
 .trivyignore suppression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These entries (exp:2026-07-25) were the interim suppression from UID2-7364 while
awaiting a jackson fix, and they had already expired. This PR applies the real
fix (jackson 2.21.4), so the suppression is now dead cruft — removing it.

UID2-7569 UID2-7570

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .trivyignore | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index cc7f674..3511344 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -15,14 +15,6 @@ GHSA-72hv-8253-57qq exp:2026-09-01
 # Availability only (C:N/I:N/A:H). Tracking via UID2-7035; revisit on vert.x 5 migration.
 CVE-2026-42577 exp:2026-09-11
 
-# jackson-databind data-binding vulnerability - no upstream fix released yet (fix targets: 2.18.8, 2.21.4, 3.1.4)
-# jackson-databind is pulled in transitively via uid2-shared; the version fix is tracked in
-# uid2-shared (https://github.com/IABTechLab/uid2-shared/pull/631) and will flow here on the
-# next uid2-shared release. Suppressing in the interim.
-# See: UID2-7364
-CVE-2026-54512 exp:2026-07-25
-CVE-2026-54513 exp:2026-07-25
-
 # CVE-2026-2100 — p11-kit NULL dereference via C_DeriveKey in the Alpine base image.
 # uid2-core is a pure Java service; the JVM uses JSSE for TLS and the bundled Java cacerts keystore for trust — it does
 # not load the native p11-kit PKCS#11 module loader and never calls C_DeriveKey, so the