diff --git a/build-logic/convention/src/main/kotlin/sk/ainet/buildlogic/maven/MavenPinsPlugin.kt b/build-logic/convention/src/main/kotlin/sk/ainet/buildlogic/maven/MavenPinsPlugin.kt index cb50ea2ac..881afe547 100644 --- a/build-logic/convention/src/main/kotlin/sk/ainet/buildlogic/maven/MavenPinsPlugin.kt +++ b/build-logic/convention/src/main/kotlin/sk/ainet/buildlogic/maven/MavenPinsPlugin.kt @@ -7,7 +7,7 @@ import sk.ainet.buildlogic.root.SkainetRootExtension /** * Pins selected Maven/JVM coordinates to an audited version across every subproject's - * dependency graph. + * dependency graph, including each project's buildscript (plugin) classpath. * * ## Why this exists * @@ -71,6 +71,18 @@ class MavenPinsPlugin : Plugin { pins.get()[coordinate]?.let { pinned -> useVersion(pinned) } } } + + // The buildscript (plugin) classpath is a separate configuration container that + // `configurations.all` above never reaches, yet it is where most CVE-flagged + // libraries actually live: AGP ships BouncyCastle and commons-lang3, Dokka ships + // Jackson, Kover ships FreeMarker. Pin it with the same map so one declaration + // covers both worlds. + buildscript.configurations.all { + resolutionStrategy.eachDependency { + val coordinate = "${requested.group}:${requested.name}" + pins.get()[coordinate]?.let { pinned -> useVersion(pinned) } + } + } } // One verify task per subproject, each resolving only its own configurations. diff --git a/build.gradle.kts b/build.gradle.kts index 62cab047f..b393c2edf 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -40,6 +40,27 @@ skainet { pin("qs", libs.versions.npm.qs, NpmPinTarget.JS) pin("brace-expansion", libs.versions.npm.brace.expansion, NpmPinTarget.JS) pin("diff", libs.versions.npm.diff, NpmPinTarget.JS) + pin("engine.io", libs.versions.npm.engine.io, NpmPinTarget.JS) + } + // Maven pins reach every project configuration and every buildscript (plugin) + // classpath — AGP, Kover, and Dokka ship the flagged versions there. + mavenPins { + pin("org.bouncycastle:bcprov-jdk18on", libs.versions.maven.bouncycastle) + pin("org.bouncycastle:bcpkix-jdk18on", libs.versions.maven.bouncycastle) + pin("org.bouncycastle:bcutil-jdk18on", libs.versions.maven.bouncycastle) + pin("org.freemarker:freemarker", libs.versions.maven.freemarker) + pin("org.apache.commons:commons-lang3", libs.versions.maven.commons.lang3) + pin("org.apache.httpcomponents:httpclient", libs.versions.maven.httpclient) + pin("org.jsoup:jsoup", libs.versions.maven.jsoup) + pin("io.opentelemetry:opentelemetry-api", libs.versions.maven.opentelemetry.api) + // Jackson is pinned to the project's own audited line (already in the catalog + // for skainet's direct use) rather than the advisories' minimum 2.18.11, so the + // pin can never downgrade a project configuration. core moves with databind: + // forcing databind alone would strand core on Dokka's 2.15.3. jackson-annotations + // is deliberately NOT pinned — it has no patch releases (the 2.22 line is just + // "2.22"), so a 2.22.3 pin cannot resolve; databind's bom aligns it instead. + pin("com.fasterxml.jackson.core:jackson-databind", libs.versions.jacksonDatabind) + pin("com.fasterxml.jackson.core:jackson-core", libs.versions.jacksonDatabind) } } diff --git a/docs/.docker/package-lock.json b/docs/.docker/package-lock.json index 23d3cf1e1..7929e3570 100644 --- a/docs/.docker/package-lock.json +++ b/docs/.docker/package-lock.json @@ -170,7 +170,7 @@ }, "node_modules/@antora/lunr-extension": { "version": "1.0.0-alpha.8", - "resolved": "git+https://gitlab.com/antora/antora-lunr-extension.git#41975fc8f62cb2219a2de2f618de1ae1482bd0ce", + "resolved": "git+ssh://git@gitlab.com/antora/antora-lunr-extension.git#41975fc8f62cb2219a2de2f618de1ae1482bd0ce", "integrity": "sha512-VjZz/db9WE0C+VpHaY8lBi9KkGcsheyJ5FScRCFB15hdIEJ8TS7Xd1koDBKLe80glrKS1xSp1Crw42tbKca0jg==", "license": "MPL-2.0", "workspaces": [ @@ -576,7 +576,7 @@ }, "node_modules/@mermaid-js/mermaid-cli": { "version": "11.16.0", - "resolved": "git+https://github.com/mermaid-js/mermaid-cli.git#a85b11df7064498d5b6b97ee9b2d4a7c10cb42ae", + "resolved": "git+ssh://git@github.com/mermaid-js/mermaid-cli.git#a85b11df7064498d5b6b97ee9b2d4a7c10cb42ae", "integrity": "sha512-0InK2nbVIMtzVzCugmdvPkAuvS6wRUqU6Utntff1n8c7lgfRZAdhKY6PSKvcIK9nFmuOUzAgB5+x/XWcroZ7Zg==", "license": "MIT", "dependencies": { @@ -1436,7 +1436,7 @@ }, "node_modules/asciidoctor-kroki": { "version": "0.18.1", - "resolved": "git+https://github.com/asciidoctor/asciidoctor-kroki.git#d02fbf06cdb837524f5e4e12537c05e0bb83c715", + "resolved": "git+ssh://git@github.com/asciidoctor/asciidoctor-kroki.git#d02fbf06cdb837524f5e4e12537c05e0bb83c715", "integrity": "sha512-UFcYByBlxZ27nk+3meWv3A2GFDt6QH7Pt/Bn6cqq+uPzgjaBN9xRGBc7+LlC6aMvukCcF5efeCwzdakXejQItA==", "license": "MIT", "dependencies": { @@ -1635,9 +1635,9 @@ "license": "MIT" }, "node_modules/basic-ftp": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz", - "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==", + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.1.tgz", + "integrity": "sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA==", "license": "MIT", "peer": true, "engines": { @@ -2695,9 +2695,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.15", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz", - "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==", + "version": "3.4.16", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", + "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/docs/.docker/package.json b/docs/.docker/package.json index 7a6cdea8c..9abd7ff09 100644 --- a/docs/.docker/package.json +++ b/docs/.docker/package.json @@ -12,6 +12,8 @@ "asciidoctor-kroki": "github:asciidoctor/asciidoctor-kroki#d02fbf06cdb837524f5e4e12537c05e0bb83c715" }, "overrides": { - "js-yaml": "4.3.2" + "js-yaml": "4.3.2", + "basic-ftp": "6.2.1", + "dompurify": "3.4.16" } } diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 8ee971859..f7bcb3016 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -50,17 +50,32 @@ kotest = "6.2.5" npm-ws = "8.21.1" # GHSA-96hv-2xvq-fx4p npm-js-yaml = "4.3.2" # GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh npm-socketio-parser = "4.2.7" # GHSA-2m8v-j782-fhvr -npm-fast-uri = "3.1.7" # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-jqff-g426-hqxp, +npm-fast-uri = "3.1.8" # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-jqff-g426-hqxp, # GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8, - # GHSA-58mr-gqgx-xq4g, GHSA-qw65-cvwx-89v3 + # GHSA-58mr-gqgx-xq4g, GHSA-qw65-cvwx-89v3, GHSA-hrr3-gc8f-f4qj npm-serialize-javascript = "7.0.5" # GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v npm-qs = "6.16.0" # GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx # One pin covers both major lines in the graph: minimatch 3.x asks for ^1.1.7 and -# minimatch 9.x for ^2.0.2, and a Yarn resolution is global. 2.1.4 clears the fixed -# set of both advisories (<1.1.18 and >=2.0.0 <2.1.4); the exported API is unchanged -# between the two majors, so the 3.x consumer is unaffected. -npm-brace-expansion = "2.1.4" # GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg +# minimatch 9.x for ^2.0.2, and a Yarn resolution is global. 2.1.7 clears the fixed +# sets of all advisories to date; the exported API is unchanged between the two +# majors, so the 3.x consumer is unaffected. +npm-brace-expansion = "2.1.7" # GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, + # GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr npm-diff = "8.0.3" # GHSA-73rr-hh4g-fpgx +npm-engine-io = "6.6.10" # GHSA-2gc4-cqfq-p2gv + +# --- maven pins --------------------------------------------------------------- +# Versions forced across every project configuration AND every buildscript +# (plugin) classpath via sk.ainet.maven-pins — see MavenPinsPlugin. A version +# here does nothing on its own; the root build script must name the coordinate +# in skainet { mavenPins { } }. Verify with ./gradlew verifyMavenPins. +maven-bouncycastle = "1.85" # GHSA-9pwp-9qqc-pr26, GHSA-qp49-qgx5-5m26, GHSA-c3fc-8qff-9hwx, + # GHSA-wg6q-6289-32hp (AGP ships 1.80.2) +maven-freemarker = "2.3.35" # GHSA-27j2-h3m2-8237 (Kover ships 2.3.32) +maven-commons-lang3 = "3.18.0" # GHSA-j288-q9x7-2f5v (AGP ships 3.16.0) +maven-httpclient = "4.5.14" # GHSA-7r82-7xv7-xcpj +maven-jsoup = "1.23.1" # GHSA-pmhh-3w7g-xqp8 +maven-opentelemetry-api = "1.62.0" # GHSA-rcgg-9c38-7xpx [libraries] jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "jacksonDatabind" } diff --git a/kotlin-js-store/yarn.lock b/kotlin-js-store/yarn.lock index 2633c227b..9eca4c7b4 100644 --- a/kotlin-js-store/yarn.lock +++ b/kotlin-js-store/yarn.lock @@ -317,7 +317,7 @@ balanced-match@^1.0.0: resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee" integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw== -base64id@2.0.0, base64id@~2.0.0: +base64id@~2.0.0: version "2.0.0" resolved "https://registry.yarnpkg.com/base64id/-/base64id-2.0.0.tgz#2770ac6bc47d312af97a8bf9a634342e0cd25cb6" integrity sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog== @@ -350,10 +350,10 @@ body-parser@^1.19.0: type-is "~1.6.18" unpipe "~1.0.0" -brace-expansion@2.1.4, brace-expansion@^1.1.7, brace-expansion@^2.0.2: - version "2.1.4" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.4.tgz#589dab11c0018d0366be64cd8bf12c8dbecc8326" - integrity sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg== +brace-expansion@2.1.7, brace-expansion@^1.1.7, brace-expansion@^2.0.2: + version "2.1.7" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.7.tgz#14ea3836731823bb24740225ea43b941b436f9d1" + integrity sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g== dependencies: balanced-match "^1.0.0" @@ -640,16 +640,15 @@ engine.io-parser@~5.2.1: resolved "https://registry.yarnpkg.com/engine.io-parser/-/engine.io-parser-5.2.3.tgz#00dc5b97b1f233a23c9398d0209504cf5f94d92f" integrity sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q== -engine.io@~6.6.0: - version "6.6.9" - resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.9.tgz#fd17e9f4e3a256423592574b60ac262e91af4b82" - integrity sha512-clKkw4C7nJ22mGgoVcCg6V/W/TxdNyIOTr89k2ONZu81qqkddPFDF0LXcbAwhzPD8DjkiRCjzuiO6Y+fkpD4vg== +engine.io@6.6.10, engine.io@~6.6.0: + version "6.6.10" + resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.10.tgz#67822e942929c10c5918fb6fb7c71bde0fe01ef3" + integrity sha512-9/lX2bdlizlCXMHRMOIm03VBQHQYC7VvydcxtTAUJRxNW1QzM/2PMFSmr6h/lCiMHcyCP6abK+t9Q+j4vekk8Q== dependencies: "@types/cors" "^2.8.12" "@types/node" ">=10.0.0" "@types/ws" "^8.5.12" accepts "~1.3.4" - base64id "2.0.0" cookie "~0.7.2" cors "~2.8.5" debug "~4.4.1" @@ -761,10 +760,10 @@ fast-deep-equal@^3.1.3: resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525" integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q== -fast-uri@3.1.7, fast-uri@^3.0.1: - version "3.1.7" - resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.7.tgz#743157d957f3cbb4c65310e033dc2ad4ad7dc60a" - integrity sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg== +fast-uri@3.1.8, fast-uri@^3.0.1: + version "3.1.8" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.8.tgz#f7db8d942e20eead3cfe93b0beeb4eb0169e938b" + integrity sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg== fill-range@^7.1.1: version "7.1.1"