[devin-ai-integration]

What and why

#1593 (feature/sca-gates) adds a failing make audit-java step — a CycloneDX aggregate SBOM per Maven tree (cyclonedx-maven-plugin:2.9.1:makeAggregateBom, test scope excluded) scanned by osv-scanner 2.7.0 — to the Java client, SysON plugin and MDK plugin CI jobs. #1589 moved the Go, npm and cargo pins; this is the Maven half, so #1593 can go green without weakening its gate.

Measured on develop 1f4892cbc (before) and on this branch (after):

tree	before	after
client/java	6 findings in 4 packages	0
editors/syson	14 findings in 5 packages	0
editors/mdk	6 findings in 4 packages	0

Every flagged artifact is transitive — none is a direct dependency of our code — so each tree's parent pom.xml holds it in <dependencyManagement>; no direct dependency was added and no generated stub changed (the client talks Connect over the JDK HttpClient; gRPC only arrives through sigstore-java's release-signature verification, so grpc-java has no stubs to regenerate here).

artifact	path	before	after	clears
io.grpc:grpc-netty-shaded (and every io.grpc:*, via grpc-bom import)	sigstore-java → client, syson, mdk	1.70.0	1.85.1	GHSA-prj3-ccx8-p6x4 (fixed ≥ 1.75.0)
org.bouncycastle:bcprov-jdk18on	sigstore-java	1.80.2	1.86	GHSA-9pwp-9qqc-pr26, GHSA-qp49-qgx5-5m26, GHSA-c3fc-8qff-9hwx (fixed ≥ 1.85)
org.bouncycastle:bcpkix-jdk18on (+ bcutil-jdk18on, kept in step)	sigstore-java	1.80	1.86	GHSA-wg6q-6289-32hp (fixed ≥ 1.84)
com.google.guava:guava	sigstore-java / grpc	33.3.1-android (client), 33.5.0-android (syson), 32.0.1-jre (mdk)	33.7.2-jre	GHSA-xxph-c9ww-hj94 (fixed ≥ 33.7.2)
tools.jackson.core:jackson-core, jackson-databind (via jackson-bom import, syson only)	Spring Boot 4.1.0 BOM	3.1.4	3.1.8	GHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89, GHSA-cxp5-3px4-pw24, GHSA-wv8q-qhhj-9h54, GHSA-q4xh-88c3-wmh7, GHSA-gx83-3vf8-gh7j, GHSA-wjgm-6hv5-3cvf, GHSA-5gvw-p9qm-jgwh, GHSA-vvgp-rfg2-7rr6 (fixed ≥ 3.1.7)

Versions are the current patch release of the same major in each case (gRPC 1.x, Bouncy Castle 1.x, Guava 33.x, Jackson 3.1.x), not the bare fixed-version floor. In editors/syson the overrides are declared before the Spring Boot BOM import so Maven's first-declaration rule lets them win; the Spring Boot BOM manages jackson at 3.1.4 and grpc at 1.70.0 otherwise. The editors need their own management because a consumer's <dependencyManagement> is what decides a transitive's version — the client's pins would not carry over on their own.

How it was verified

Measurement (the exact commands, from the repo root; osv-scanner 2.7.0 provisioned with #1593's scripts/download-sca-tools.sh, SHA-256 verified):

export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64 PATH=$JAVA_HOME/bin:$PATH   # 21 for editors/syson
mvn -q -f client/java/pom.xml install -DskipTests                               # editors resolve the client at the tree's version
for dir in client/java editors/syson editors/mdk; do
  mvn -B -q -f "$dir/pom.xml" org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeAggregateBom \
      -DoutputFormat=json -DoutputName=bom -DincludeTestScope=false
  osv-scanner scan source -L "$dir/target/bom.json"
done

All three scans print No issues found.

CI job steps run locally, at the workflow's JDK majors, against a freshly built bin/sysml-grpc (make build):

• java-test (JDK 17): mvn -B -f client/java/pom.xml install -Dopensysml.requireService=true — BUILD SUCCESS, 340 tests, 0 failures (1 skipped: ReleaseAssetsTest's pinned-release case, gated on an env var the job does not set — same as develop); conformance module 37 tests, 0 failures.
• mdk-plugin (JDK 17): mvn -B -f editors/mdk/pom.xml verify -Dopensysml.requireService=true — BUILD SUCCESS, 47 + 16 tests, 0 failures.
• syson-plugin (JDK 21): mvn -B -f editors/syson/pom.xml install -Dopensysml.requireService=true — BUILD SUCCESS, 73 tests, 0 failures.
• go build ./... && go vet ./... && gofmt -l . — clean (no Go touched).
• python3 scripts/changelog.py check — passes.

Not run: the SysON frontend npm steps (untouched by this change) and the Cameo-side MDK packaging — the mdk-plugin job's mvn verify is the whole Maven surface and needs no non-public artifact.

Checklist

• make test and make lint pass locally — Go untouched: go build ./... && go vet ./... && gofmt -l . clean; Maven suites above
• Tests added or updated for the change — none: dependency pins only; feat(ci): audit every dependency tree for known vulnerabilities #1593's audit-java gate is the test
• Documentation extended where it already covers the surface — docs/project/releasing.md has no pin table listing these artifacts
• Changelog entry added as changes/unreleased/maven-dependency-vulnerabilities.security.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved — no gate count moved
• No internal work-item labels in the body, docs, or changelog

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/f2db20fc999c44dd8d60457e741b1ca2
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/f2db20fc999c44dd8d60457e741b1ca2?variant=devin
Requested by: @HuiJun

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.