michalharakal · Oct 9, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/build-logic/convention/src/main/kotlin/sk/ainet/buildlogic/maven/MavenPinsPlugin.kt b/build-logic/convention/src/main/kotlin/sk/ainet/buildlogic/maven/MavenPinsPlugin.kt
@@ -7,7 +7,7 @@ import sk.ainet.buildlogic.root.SkainetRootExtension
 
 /**
  * Pins selected Maven/JVM coordinates to an audited version across every subproject's
- * dependency graph.
+ * dependency graph, including each project's buildscript (plugin) classpath.
  *
  * ## Why this exists
  *
@@ -71,6 +71,18 @@ class MavenPinsPlugin : Plugin<Project> {
                     pins.get()[coordinate]?.let { pinned -> useVersion(pinned) }
                 }
             }
+
+            // The buildscript (plugin) classpath is a separate configuration container that
+            // `configurations.all` above never reaches, yet it is where most CVE-flagged
+            // libraries actually live: AGP ships BouncyCastle and commons-lang3, Dokka ships
+            // Jackson, Kover ships FreeMarker. Pin it with the same map so one declaration
+            // covers both worlds.
+            buildscript.configurations.all {
+                resolutionStrategy.eachDependency {
+                    val coordinate = "${requested.group}:${requested.name}"
+                    pins.get()[coordinate]?.let { pinned -> useVersion(pinned) }
+                }
+            }
         }
 
         // One verify task per subproject, each resolving only its own configurations.

diff --git a/build.gradle.kts b/build.gradle.kts
@@ -40,6 +40,27 @@ skainet {
         pin("qs", libs.versions.npm.qs, NpmPinTarget.JS)
         pin("brace-expansion", libs.versions.npm.brace.expansion, NpmPinTarget.JS)
         pin("diff", libs.versions.npm.diff, NpmPinTarget.JS)
+        pin("engine.io", libs.versions.npm.engine.io, NpmPinTarget.JS)
+    }
+    // Maven pins reach every project configuration and every buildscript (plugin)
+    // classpath — AGP, Kover, and Dokka ship the flagged versions there.
+    mavenPins {
+        pin("org.bouncycastle:bcprov-jdk18on", libs.versions.maven.bouncycastle)
+        pin("org.bouncycastle:bcpkix-jdk18on", libs.versions.maven.bouncycastle)
+        pin("org.bouncycastle:bcutil-jdk18on", libs.versions.maven.bouncycastle)
+        pin("org.freemarker:freemarker", libs.versions.maven.freemarker)
+        pin("org.apache.commons:commons-lang3", libs.versions.maven.commons.lang3)
+        pin("org.apache.httpcomponents:httpclient", libs.versions.maven.httpclient)
+        pin("org.jsoup:jsoup", libs.versions.maven.jsoup)
+        pin("io.opentelemetry:opentelemetry-api", libs.versions.maven.opentelemetry.api)
+        // Jackson is pinned to the project's own audited line (already in the catalog
+        // for skainet's direct use) rather than the advisories' minimum 2.18.11, so the
+        // pin can never downgrade a project configuration. core moves with databind:
+        // forcing databind alone would strand core on Dokka's 2.15.3. jackson-annotations
+        // is deliberately NOT pinned — it has no patch releases (the 2.22 line is just
+        // "2.22"), so a 2.22.3 pin cannot resolve; databind's bom aligns it instead.
+        pin("com.fasterxml.jackson.core:jackson-databind", libs.versions.jacksonDatabind)
+        pin("com.fasterxml.jackson.core:jackson-core", libs.versions.jacksonDatabind)
     }
 }
 

diff --git a/docs/.docker/package-lock.json b/docs/.docker/package-lock.json
diff --git a/docs/.docker/package.json b/docs/.docker/package.json
@@ -12,6 +12,8 @@
     "asciidoctor-kroki": "github:asciidoctor/asciidoctor-kroki#d02fbf06cdb837524f5e4e12537c05e0bb83c715"
   },
   "overrides": {
-    "js-yaml": "4.3.2"
+    "js-yaml": "4.3.2",
+    "basic-ftp": "6.2.1",
+    "dompurify": "3.4.16"
   }
 }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -50,17 +50,32 @@ kotest = "6.2.5"
 npm-ws = "8.21.1"   # GHSA-96hv-2xvq-fx4p
 npm-js-yaml = "4.3.2"              # GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh
 npm-socketio-parser = "4.2.7"      # GHSA-2m8v-j782-fhvr
-npm-fast-uri = "3.1.7"             # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-jqff-g426-hqxp,
+npm-fast-uri = "3.1.8"             # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-jqff-g426-hqxp,
                                     # GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8,
-                                    # GHSA-58mr-gqgx-xq4g, GHSA-qw65-cvwx-89v3
+                                    # GHSA-58mr-gqgx-xq4g, GHSA-qw65-cvwx-89v3, GHSA-hrr3-gc8f-f4qj
 npm-serialize-javascript = "7.0.5" # GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v
 npm-qs = "6.16.0"                  # GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx
 # One pin covers both major lines in the graph: minimatch 3.x asks for ^1.1.7 and
-# minimatch 9.x for ^2.0.2, and a Yarn resolution is global. 2.1.4 clears the fixed
-# set of both advisories (<1.1.18 and >=2.0.0 <2.1.4); the exported API is unchanged
-# between the two majors, so the 3.x consumer is unaffected.
-npm-brace-expansion = "2.1.4"      # GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg
+# minimatch 9.x for ^2.0.2, and a Yarn resolution is global. 2.1.7 clears the fixed
+# sets of all advisories to date; the exported API is unchanged between the two
+# majors, so the 3.x consumer is unaffected.
+npm-brace-expansion = "2.1.7"      # GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg,
+                                    # GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr
 npm-diff = "8.0.3"                 # GHSA-73rr-hh4g-fpgx
+npm-engine-io = "6.6.10"           # GHSA-2gc4-cqfq-p2gv
+
+# --- maven pins ---------------------------------------------------------------
+# Versions forced across every project configuration AND every buildscript
+# (plugin) classpath via sk.ainet.maven-pins — see MavenPinsPlugin. A version
+# here does nothing on its own; the root build script must name the coordinate
+# in skainet { mavenPins { } }. Verify with ./gradlew verifyMavenPins.
+maven-bouncycastle = "1.85"        # GHSA-9pwp-9qqc-pr26, GHSA-qp49-qgx5-5m26, GHSA-c3fc-8qff-9hwx,
+                                    # GHSA-wg6q-6289-32hp (AGP ships 1.80.2)
+maven-freemarker = "2.3.35"        # GHSA-27j2-h3m2-8237 (Kover ships 2.3.32)
+maven-commons-lang3 = "3.18.0"     # GHSA-j288-q9x7-2f5v (AGP ships 3.16.0)
+maven-httpclient = "4.5.14"        # GHSA-7r82-7xv7-xcpj
+maven-jsoup = "1.23.1"             # GHSA-pmhh-3w7g-xqp8
+maven-opentelemetry-api = "1.62.0" # GHSA-rcgg-9c38-7xpx
 
 [libraries]
 jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "jacksonDatabind" }

diff --git a/kotlin-js-store/yarn.lock b/kotlin-js-store/yarn.lock
@@ -317,7 +317,7 @@ balanced-match@^1.0.0:
   resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee"
   integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==
 
-base64id@2.0.0, base64id@~2.0.0:
+base64id@~2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/base64id/-/base64id-2.0.0.tgz#2770ac6bc47d312af97a8bf9a634342e0cd25cb6"
   integrity sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog==
@@ -350,10 +350,10 @@ body-parser@^1.19.0:
     type-is "~1.6.18"
     unpipe "~1.0.0"
 
-brace-expansion@2.1.4, brace-expansion@^1.1.7, brace-expansion@^2.0.2:
-  version "2.1.4"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.4.tgz#589dab11c0018d0366be64cd8bf12c8dbecc8326"
-  integrity sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==
+brace-expansion@2.1.7, brace-expansion@^1.1.7, brace-expansion@^2.0.2:
+  version "2.1.7"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.7.tgz#14ea3836731823bb24740225ea43b941b436f9d1"
+  integrity sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==
   dependencies:
     balanced-match "^1.0.0"
 
@@ -640,16 +640,15 @@ engine.io-parser@~5.2.1:
   resolved "https://registry.yarnpkg.com/engine.io-parser/-/engine.io-parser-5.2.3.tgz#00dc5b97b1f233a23c9398d0209504cf5f94d92f"
   integrity sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==
 
-engine.io@~6.6.0:
-  version "6.6.9"
-  resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.9.tgz#fd17e9f4e3a256423592574b60ac262e91af4b82"
-  integrity sha512-clKkw4C7nJ22mGgoVcCg6V/W/TxdNyIOTr89k2ONZu81qqkddPFDF0LXcbAwhzPD8DjkiRCjzuiO6Y+fkpD4vg==
+engine.io@6.6.10, engine.io@~6.6.0:
+  version "6.6.10"
+  resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.10.tgz#67822e942929c10c5918fb6fb7c71bde0fe01ef3"
+  integrity sha512-9/lX2bdlizlCXMHRMOIm03VBQHQYC7VvydcxtTAUJRxNW1QzM/2PMFSmr6h/lCiMHcyCP6abK+t9Q+j4vekk8Q==
   dependencies:
     "@types/cors" "^2.8.12"
     "@types/node" ">=10.0.0"
     "@types/ws" "^8.5.12"
     accepts "~1.3.4"
-    base64id "2.0.0"
     cookie "~0.7.2"
     cors "~2.8.5"
     debug "~4.4.1"
@@ -761,10 +760,10 @@ fast-deep-equal@^3.1.3:
   resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
   integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
 
-fast-uri@3.1.7, fast-uri@^3.0.1:
-  version "3.1.7"
-  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.7.tgz#743157d957f3cbb4c65310e033dc2ad4ad7dc60a"
-  integrity sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==
+fast-uri@3.1.8, fast-uri@^3.0.1:
+  version "3.1.8"
+  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.8.tgz#f7db8d942e20eead3cfe93b0beeb4eb0169e938b"
+  integrity sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==
 
 fill-range@^7.1.1:
   version "7.1.1"