From 62548afe68b716705e9c49b791488f3036ab3c4b Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Sun, 6 Sep 2026 02:56:00 +0200 Subject: [PATCH 1/4] fix(security): bump tomcat-embed 10.1.55 -> 10.1.59 (3 CRITICAL CVEs) Nightly Trivy scan has been failing since 2026-09-03 on three CRITICAL auth-bypass CVEs in org.apache.tomcat.embed:tomcat-embed-core 10.1.55: CVE-2026-68525 FORM authentication bypass -> unauthorized resource access CVE-2026-65905 DIGEST authenticator replay -> authentication bypass CVE-2026-65182 security constraint bypass (improper access control) tomcat-embed-core is transitive-only (Spring Boot BOM -> starter-tomcat), so Dependabot's direct-only security update could not patch it and failed with security_update_dependency_not_found. Spring Boot 3.5.16 is already the latest 3.5.x and still pins 10.1.55, so a BOM property override is the fix -- same pattern as the existing jackson/logback/postgresql overrides. The advisories name 10.1.58 as the fixed version, but that release was never published to Maven Central (404); 10.1.59 is the first available release carrying the fixes. Co-Authored-By: Claude Opus 5 --- backend/build.gradle.kts | 9 +++++++++ backend/gradle.lockfile | 6 +++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/backend/build.gradle.kts b/backend/build.gradle.kts index ddcf102..135501a 100644 --- a/backend/build.gradle.kts +++ b/backend/build.gradle.kts @@ -74,6 +74,15 @@ extra["logback.version"] = "1.5.35" // postgresql 42.7.11 -> 42.7.12 fixes CVE-2026-54291 (HIGH). Spring Boot 3.5.16 BOM pins 42.7.11; // override the managed property so the runtime JDBC driver picks up the patched release. extra["postgresql.version"] = "42.7.12" +// tomcat-embed 10.1.55 -> 10.1.59 fixes three CRITICAL auth-bypass CVEs (disclosed 2026-09-03, +// caught by the nightly Trivy scan): CVE-2026-68525 (FORM authentication bypass), CVE-2026-65905 +// (DIGEST authenticator replay) and CVE-2026-65182 (security constraint bypass). +// The advisories name 10.1.58 as the fix, but that release was never published to Maven Central +// (404) — 10.1.59 is the first available release carrying the fixes. Spring Boot 3.5.16 is the +// latest 3.5.x and still pins 10.1.55, and tomcat-embed-core is transitive-only here, so +// Dependabot's direct-only security update could not patch it (security_update_dependency_not_found). +// Override the shared property so core, el and websocket move together. +extra["tomcat.version"] = "10.1.59" // Override Spring Boot BOM version for Testcontainers to support Docker Desktop 4.x on Windows dependencyManagement { diff --git a/backend/gradle.lockfile b/backend/gradle.lockfile index 92ea768..a1bee43 100644 --- a/backend/gradle.lockfile +++ b/backend/gradle.lockfile @@ -73,9 +73,9 @@ org.apache.commons:commons-compress:1.28.0=testCompileClasspath,testRuntimeClass org.apache.commons:commons-lang3:3.18.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.apache.logging.log4j:log4j-api:2.24.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.apache.logging.log4j:log4j-to-slf4j:2.24.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -org.apache.tomcat.embed:tomcat-embed-core:10.1.55=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -org.apache.tomcat.embed:tomcat-embed-el:10.1.55=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -org.apache.tomcat.embed:tomcat-embed-websocket:10.1.55=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apache.tomcat.embed:tomcat-embed-core:10.1.59=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apache.tomcat.embed:tomcat-embed-el:10.1.59=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apache.tomcat.embed:tomcat-embed-websocket:10.1.59=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath org.aspectj:aspectjweaver:1.9.25.1=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.assertj:assertj-core:3.27.7=testCompileClasspath,testRuntimeClasspath From 868294692b83bbf477e143154779f88e984bc83a Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Sun, 6 Sep 2026 03:10:54 +0200 Subject: [PATCH 2/4] fix(ci): upgrade openssl/libssl3 to 3.5.8-r0 in backend image (CVE-2026-14456) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer. Alpine already ships the patched 3.5.8-r0, so extend the existing `apk upgrade` line rather than chasing a new base-image digest. Verified by building the image locally: before: openssl-3.5.7-r0 / libssl3-3.5.7-r0 after: openssl-3.5.8-r0 / libssl3-3.5.8-r0 Pre-existing failure, not introduced by the tomcat bump — backend-docker was already red on PRs #118 and #120. Co-Authored-By: Claude Opus 5 --- backend/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index eb2cb45..6c00f63 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -1,6 +1,6 @@ # eclipse-temurin:21-jre-alpine FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 -RUN apk upgrade --no-cache p11-kit p11-kit-trust libexpat +RUN apk upgrade --no-cache p11-kit p11-kit-trust libexpat openssl libssl3 RUN addgroup -S appgroup && adduser -S appuser -G appgroup WORKDIR /app COPY build/libs/*.jar app.jar From 92fc95db19b5d3383faea7cca91f5e75352af6e5 Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Sun, 6 Sep 2026 03:10:54 +0200 Subject: [PATCH 3/4] fix(ci): bump nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The frontend npm-audit gate blocks on GHSA-2v37-7h3g-55p8 (high): custom generators can loop indefinitely when size is zero. nanoid is a dev-only transitive of postcss (`^3.3.12`), so the 3.3.18 patch fits the existing range — no postcss major bump needed. `node .github/scripts/audit-gate.mjs` passes locally and `npm run build` is green. Also normalises a pre-existing drift: package-lock.json still carried project version 1.0.13 while package.json is at 1.0.15 (the v1.0.15 release bumped package.json only). package.json itself is untouched. Pre-existing failure, not introduced by the tomcat bump — frontend-build was already red on PR #120. Co-Authored-By: Claude Opus 5 --- frontend/package-lock.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index b512ee7..082d0ea 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "taskowolf-frontend", - "version": "1.0.13", + "version": "1.0.15", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "taskowolf-frontend", - "version": "1.0.13", + "version": "1.0.15", "dependencies": { "@dnd-kit/core": "^6.1.0", "@dnd-kit/sortable": "^10.0.0", @@ -3201,9 +3201,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { From 4d73b90b39d6e488830f65545097b6fee5139411 Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Sun, 6 Sep 2026 03:17:54 +0200 Subject: [PATCH 4/4] fix(ci): upgrade libssl3/libcrypto3 + libuuid in frontend image (9 HIGH CVEs) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx Alpine base layer: libuuid 2.42.1-r0 -> 2.42.3-r1 CVE-2026-78408/78409/78410, -76642, CVE-2026-53612/53613/53614 libssl3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456 libcrypto3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456 CVE-2026-14456 is the same openssl flaw already patched in backend/Dockerfile; Alpine names the packages differently in the nginx image (libcrypto3 rather than openssl). Extends the existing `apk upgrade` line, consistent with the libexpat / c-ares / curl entries already there. This gate was previously masked: frontend-docker depends on frontend-build, which was failing on the nanoid advisory, so the job was skipped rather than run. It was already red on PR #118. Verified by running the exact apk upgrade line against the pinned base image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer than the 2.42.3-r0 named in the advisories). Co-Authored-By: Claude Opus 5 --- frontend/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 0edb156..23506e7 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -10,7 +10,9 @@ RUN npm run build FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752 # libexpat 2.8.1-r0 -> 2.8.2-r0 (CVE-2026-56131/56407/56408); c-ares 1.34.6-r0 -> 1.34.8-r0 (CVE-2026-33630) # curl/libcurl 8.19.0-r0 -> 8.20.0-r0 (CVE-2026-5773/6276) -RUN apk upgrade --no-cache libexpat c-ares curl +# libssl3/libcrypto3 3.5.7-r0 -> 3.5.8-r0 (CVE-2026-14456, same openssl flaw patched in backend/Dockerfile) +# libuuid 2.42.1-r0 -> 2.42.3-r1 (CVE-2026-78408/78409/78410, -76642, -53612/53613/53614) +RUN apk upgrade --no-cache libexpat c-ares curl libssl3 libcrypto3 libuuid COPY --from=builder /app/dist /usr/share/nginx/html COPY nginx-spa.conf /etc/nginx/conf.d/default.conf EXPOSE 80