From dd8adb4de8842352efbcbb1e26a86b85e0dfa9aa Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 22:40:38 +0000
Subject: [PATCH] fix(deps): hold vulnerable Maven transitives past their
 advisories in all three Java trees

osv-scanner 2.7.0 over each tree's CycloneDX aggregate SBOM (test scope
excluded) reported 6 findings in client/java, 14 in editors/syson and 6
in editors/mdk, all in transitive dependencies: grpc-netty-shaded,
bcprov/bcpkix and guava through the client's sigstore-java, jackson
through the SysON Spring Boot BOM. Each parent pom now manages them in
<dependencyManagement> (grpc-bom 1.85.1, bouncycastle 1.86, guava
33.7.2-jre, jackson-bom 3.1.8 in SysON); the scan reports no findings.

Co-Authored-By: jason.han <hanhuijun@gmail.com>
---
 ...ven-dependency-vulnerabilities.security.md |  1 +
 client/java/pom.xml                           | 32 +++++++++++++++
 editors/mdk/pom.xml                           | 32 +++++++++++++++
 editors/syson/pom.xml                         | 40 +++++++++++++++++++
 4 files changed, 105 insertions(+)
 create mode 100644 changes/unreleased/maven-dependency-vulnerabilities.security.md

diff --git a/changes/unreleased/maven-dependency-vulnerabilities.security.md b/changes/unreleased/maven-dependency-vulnerabilities.security.md
new file mode 100644
index 0000000000..cd906933ad
--- /dev/null
+++ b/changes/unreleased/maven-dependency-vulnerabilities.security.md
@@ -0,0 +1 @@
+- **Every Maven dependency osv-scanner reports as vulnerable in the Java client, the SysON plugin and the MDK plugin is replaced.** All of them are transitive — `grpc-netty-shaded`, `bcprov-jdk18on`/`bcpkix-jdk18on` and `guava` arrive through the client's `sigstore-java`, `jackson-core`/`jackson-databind` through the SysON plugin's Spring Boot BOM — so each tree's parent `pom.xml` now holds them in `<dependencyManagement>` rather than adding direct dependencies: `io.grpc` 1.70.0 → 1.85.1 through `grpc-bom` (GHSA-prj3-ccx8-p6x4), `bcprov-jdk18on` 1.80.2 → 1.86 (GHSA-9pwp-9qqc-pr26, GHSA-qp49-qgx5-5m26, GHSA-c3fc-8qff-9hwx) with `bcpkix-jdk18on` and `bcutil-jdk18on` 1.80 → 1.86 (GHSA-wg6q-6289-32hp), `guava` 33.3.1-android / 33.5.0-android / 32.0.1-jre → 33.7.2-jre (GHSA-xxph-c9ww-hj94), and in `editors/syson` `tools.jackson` 3.1.4 → 3.1.8 through `jackson-bom` (GHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89, GHSA-cxp5-3px4-pw24, GHSA-wv8q-qhhj-9h54, GHSA-q4xh-88c3-wmh7, GHSA-gx83-3vf8-gh7j, GHSA-wjgm-6hv5-3cvf, GHSA-5gvw-p9qm-jgwh, GHSA-vvgp-rfg2-7rr6). osv-scanner 2.7.0 over each tree's CycloneDX aggregate SBOM (test scope excluded) now reports no findings, down from 6 in `client/java`, 14 in `editors/syson` and 6 in `editors/mdk`.
diff --git a/client/java/pom.xml b/client/java/pom.xml
index e46e33e689..6baee678fa 100644
--- a/client/java/pom.xml
+++ b/client/java/pom.xml
@@ -65,6 +65,11 @@
     <junit.version>5.11.4</junit.version>
     <gson.version>2.11.0</gson.version>
     <sigstore.version>1.3.0</sigstore.version>
+    <!-- sigstore-java's transitive dependencies, held past their known advisories
+         (OSV over the CycloneDX SBOM): grpc-netty-shaded, bcprov/bcpkix and guava. -->
+    <grpc.version>1.85.1</grpc.version>
+    <bouncycastle.version>1.86</bouncycastle.version>
+    <guava.version>33.7.2-jre</guava.version>
     <maven.compiler.plugin.version>3.13.0</maven.compiler.plugin.version>
     <maven.surefire.plugin.version>3.5.2</maven.surefire.plugin.version>
     <maven.jar.plugin.version>3.4.2</maven.jar.plugin.version>
@@ -99,6 +104,33 @@
         <artifactId>sigstore-java</artifactId>
         <version>${sigstore.version}</version>
       </dependency>
+      <dependency>
+        <groupId>io.grpc</groupId>
+        <artifactId>grpc-bom</artifactId>
+        <version>${grpc.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcprov-jdk18on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcpkix-jdk18on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcutil-jdk18on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>
diff --git a/editors/mdk/pom.xml b/editors/mdk/pom.xml
index 34c6606431..f8c375a306 100644
--- a/editors/mdk/pom.xml
+++ b/editors/mdk/pom.xml
@@ -24,9 +24,41 @@
     <maven.surefire.plugin.version>3.5.2</maven.surefire.plugin.version>
     <jacoco.plugin.version>0.8.12</jacoco.plugin.version>
     <opensysml.client.version>0.11.0</opensysml.client.version>
+    <!-- The client's sigstore-java brings grpc-netty-shaded, bcprov/bcpkix and guava; a
+         consumer's own management is what holds them past their known advisories. -->
+    <grpc.version>1.85.1</grpc.version>
+    <bouncycastle.version>1.86</bouncycastle.version>
+    <guava.version>33.7.2-jre</guava.version>
   </properties>
   <dependencyManagement>
     <dependencies>
+      <dependency>
+        <groupId>io.grpc</groupId>
+        <artifactId>grpc-bom</artifactId>
+        <version>${grpc.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcprov-jdk18on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcpkix-jdk18on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcutil-jdk18on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>
diff --git a/editors/syson/pom.xml b/editors/syson/pom.xml
index e11f75900e..6e6d9df740 100644
--- a/editors/syson/pom.xml
+++ b/editors/syson/pom.xml
@@ -26,10 +26,50 @@
         <maven.compiler.plugin.version>3.13.0</maven.compiler.plugin.version>
         <maven.surefire.plugin.version>3.5.2</maven.surefire.plugin.version>
         <jacoco.plugin.version>0.8.12</jacoco.plugin.version>
+        <!-- Held past their known advisories ahead of the Spring Boot BOM, which manages
+             jackson and grpc lower; bouncycastle and guava arrive through the client's sigstore-java. -->
+        <jackson.version>3.1.8</jackson.version>
+        <grpc.version>1.85.1</grpc.version>
+        <bouncycastle.version>1.86</bouncycastle.version>
+        <guava.version>33.7.2-jre</guava.version>
     </properties>
 
     <dependencyManagement>
         <dependencies>
+            <dependency>
+                <groupId>tools.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.grpc</groupId>
+                <artifactId>grpc-bom</artifactId>
+                <version>${grpc.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcpkix-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcutil-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.google.guava</groupId>
+                <artifactId>guava</artifactId>
+                <version>${guava.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>