From 9f053ff9ab377552637569bd1883797adcb0be1e Mon Sep 17 00:00:00 2001 From: Valandi Date: Mon, 27 Jul 2026 15:53:51 -0400 Subject: [PATCH 1/5] chore(security): add weekly Dependabot config for maven + actions Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2b8b560 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,42 @@ +version: 2 +updates: + - package-ecosystem: maven + directory: "/" + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: Etc/UTC + open-pull-requests-limit: 10 + groups: + jackson: + patterns: ["com.fasterxml.jackson*"] + twelvemonkeys: + patterns: ["com.twelvemonkeys*"] + jetty: + patterns: ["org.eclipse.jetty*"] + ignore: + # pdfbox 3.x is a breaking migration (PDF rendering is the core product + # path) — majors are deliberate work, not a Monday PR. + - dependency-name: "org.apache.pdfbox:pdfbox" + update-types: ["version-update:semver-major"] + # Jetty 12 moves package namespaces (ee9/ee10) — same reasoning. + - dependency-name: "org.eclipse.jetty:*" + update-types: ["version-update:semver-major"] + # slf4j 2.x changes the binding mechanism; stay on 1.7.x until chosen. + - dependency-name: "org.slf4j:*" + update-types: ["version-update:semver-major"] + # JUnit 5 is a rewrite of the test framework, not a bump. + - dependency-name: "junit:junit" + update-types: ["version-update:semver-major"] + # Internal artifact resolved from the checked-in libs/ file repo; + # Dependabot cannot see it. + - dependency-name: "com.applitools.eyesutilities:EyesUtilities" + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: Etc/UTC From f2048f61a1b6b21c5f9e9fca0da04064b312cef9 Mon Sep 17 00:00:00 2001 From: Valandi Date: Mon, 27 Jul 2026 15:56:05 -0400 Subject: [PATCH 2/5] ci(security): add PR gate + weekly audit (dependency-review, OSV, Trivy) Co-Authored-By: Claude Fable 5 --- .github/workflows/security.yml | 74 ++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..9c3f661 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,74 @@ +name: Security + +on: + pull_request: + schedule: + # Monday 05:00 UTC — one hour before Dependabot opens bump PRs, so the + # Security tab reflects reality when the PRs arrive. + - cron: "0 5 * * 1" + workflow_dispatch: + +permissions: + contents: read + +jobs: + # ---- PR gate: blocks CRITICAL/HIGH introduced by the PR ---- + + dependency-review: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4 + with: + fail-on-severity: high + + osv-pr: + if: github.event_name == 'pull_request' + permissions: + actions: read + contents: read + security-events: write + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + + trivy-pr: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 + with: + scan-type: fs + scan-ref: . + severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: "1" + + # ---- Weekly audit: full scans, all severities, SARIF to Security tab ---- + + osv-audit: + if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' + permissions: + actions: read + contents: read + security-events: write + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + + trivy-audit: + if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 + with: + scan-type: fs + scan-ref: . + format: sarif + output: trivy-results.sarif + - uses: github/codeql-action/upload-sarif@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + with: + sarif_file: trivy-results.sarif + category: trivy From 326985fd65b23809f84413b610d6df422c040501 Mon Sep 17 00:00:00 2001 From: Valandi Date: Mon, 27 Jul 2026 15:59:35 -0400 Subject: [PATCH 3/5] ci(security): pin actions to commit SHAs, least-privilege permissions Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 21 ++++++++++++--------- .github/workflows/multi-format.yml | 7 +++++-- .github/workflows/release.yml | 25 ++++++++++++++----------- 3 files changed, 31 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9042564..d46a786 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,8 @@ name: CI +permissions: + contents: read + on: push: branches: [main] @@ -15,7 +18,7 @@ jobs: pii-guard: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Scan tracked files for customer data run: bash .githooks/pii-guard.sh --all @@ -23,9 +26,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: 11 @@ -40,9 +43,9 @@ jobs: if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: 11 @@ -63,15 +66,15 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: 17 cache: maven - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 @@ -81,7 +84,7 @@ jobs: run: mvn -Pgui-installers -DskipTests -Dowasp.skip=true clean verify --batch-mode - name: Upload installer - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: imagetester-installer-${{ matrix.os }} path: target/installers/* diff --git a/.github/workflows/multi-format.yml b/.github/workflows/multi-format.yml index 4f4b18a..6f26df6 100644 --- a/.github/workflows/multi-format.yml +++ b/.github/workflows/multi-format.yml @@ -1,5 +1,8 @@ name: multi-format-tests +permissions: + contents: read + on: push: branches: [main] @@ -10,10 +13,10 @@ jobs: multi-format: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up JDK 11 - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: '11' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 85087c0..f45147a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,8 @@ name: Release +permissions: + contents: read + on: push: tags: ['v*'] @@ -16,9 +19,9 @@ jobs: version: ${{ steps.ver.outputs.version }} tag: ${{ steps.ver.outputs.tag }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: 17 @@ -75,15 +78,15 @@ jobs: HAS_WINDOWS_SIGNING: ${{ secrets.WINDOWS_SIGNING_CERT != '' }} HAS_APPLE_SIGNING: ${{ secrets.APPLE_SIGNING_CERT != '' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: 17 cache: maven - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 @@ -125,7 +128,7 @@ jobs: mv "$file" "ImageTester-${{ needs.validate.outputs.version }}-${{ matrix.label }}.${ext}" ls - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: installer-${{ matrix.label }} path: target/installers/* @@ -135,9 +138,9 @@ jobs: needs: validate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: temurin java-version: 11 @@ -166,7 +169,7 @@ jobs: done ls -la ImageTester_*.jar - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: cli-jars path: jars/ImageTester_*.jar @@ -179,9 +182,9 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: path: dist merge-multiple: true From fc7f6136d34676b90c0552029766f49ed8f7f2c7 Mon Sep 17 00:00:00 2001 From: Valandi Date: Mon, 27 Jul 2026 16:09:47 -0400 Subject: [PATCH 4/5] fix(security): patch vulnerable dependency backlog pdfbox 2.0.29->2.0.37, commons-io 2.11.0->2.22.0, jbig2-imageio 3.0.4->3.0.5, opencsv 5.8->5.12.0, jetty 11.0.20->11.0.26, slf4j-simple 1.7.32->1.7.36. All within current majors; jetty 12 / pdfbox 3 migrations are deliberate follow-ups. jackson-core / jackson-dataformat-csv left at 2.13.4 (not bumped): bumping either to 2.22.1 broke BatchMapDeserializerTest with NoSuchMethodError on ParserMinimalBase.(int, StreamReadConstraints). Applied the documented contingency (drop both to 2.19.4) and reran -- same 4 errors. Root-caused: EyesUtilities-1.6.6.jar bundles an unrelocated, partial jackson-core 2.16.1 (com/fasterxml/jackson/core/base/ParserMinimalBase.class only) that shadows the real dependency on the classpath. Any jackson-core >= 2.15 introduces classes (e.g. UTF8StreamJsonParser) that call a ParserMinimalBase constructor overload absent from that embedded 2.16.1 fragment, so the mismatch is unavoidable via version choice alone -- confirmed by isolating: reverting only the jackson pair back to 2.13.4 with the other six bumps in place fully restores the suite (487 tests, 0 failures/errors, 1 pre-existing unrelated skip). Fixing this needs either a rebuilt EyesUtilities without the embedded jackson-core, or a pom exclusion of that transitive class, both out of scope for a version-only patch. Follow-up needed to close out the jackson-core / jackson-databind CVEs. Co-Authored-By: Claude Fable 5 --- pom.xml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pom.xml b/pom.xml index 689c87a..731dad3 100644 --- a/pom.xml +++ b/pom.xml @@ -84,7 +84,7 @@ org.apache.pdfbox pdfbox - 2.0.29 + 2.0.37 com.applitools @@ -109,7 +109,7 @@ commons-io commons-io - 2.11.0 + 2.22.0 compile @@ -120,12 +120,12 @@ org.apache.pdfbox jbig2-imageio - 3.0.4 + 3.0.5 com.opencsv opencsv - 5.8 + 5.12.0 com.fasterxml.jackson.dataformat @@ -135,7 +135,7 @@ org.slf4j slf4j-simple - 1.7.32 + 1.7.36 compile @@ -166,12 +166,12 @@ org.eclipse.jetty jetty-server - 11.0.20 + 11.0.26 org.eclipse.jetty jetty-servlet - 11.0.20 + 11.0.26 com.github.javakeyring From 9257f146afe290978e3d3fcc4b6bfae51d797c16 Mon Sep 17 00:00:00 2001 From: Valandi Date: Mon, 27 Jul 2026 16:13:11 -0400 Subject: [PATCH 5/5] fix(security): bump jackson to 2.22.1 by fixing dependency declaration order jackson-core / jackson-dataformat-csv (2.13.4->2.22.1) previously failed BatchMapDeserializerTest with NoSuchMethodError on ParserMinimalBase.(int, StreamReadConstraints) -- root cause was EyesUtilities-1.6.6.jar embedding an unrelocated, partial jackson-core 2.16.1 fragment (ParserMinimalBase.class only) under the real com.fasterxml.jackson.core package. Maven/JVM classpath resolution is first-declared-wins for same-named classes, and EyesUtilities was declared before jackson-core/jackson-dataformat-csv in , so its stale embedded class shadowed the real, newer jackson-core whenever other jackson-core classes (e.g. UTF8StreamJsonParser) called the newer constructor. Moving both jackson dependency blocks above EyesUtilities makes the coherent, newer jackson-core win on the classpath (and in the shaded uber jar, for the same first-artifact-wins reason). Verified: full suite passes clean at 2.22.1 with this reordering (487 tests, 0 failures, 0 errors, 1 pre-existing unrelated skip) -- closing out the jackson exception noted in the prior commit. Co-Authored-By: Claude Fable 5 --- pom.xml | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/pom.xml b/pom.xml index 731dad3..076291d 100644 --- a/pom.xml +++ b/pom.xml @@ -76,6 +76,19 @@ 4.11.0 test + + + com.fasterxml.jackson.core + jackson-core + 2.22.1 + + + com.fasterxml.jackson.dataformat + jackson-dataformat-csv + 2.22.1 + com.applitools.eyesutilities EyesUtilities @@ -112,11 +125,6 @@ 2.22.0 compile - - com.fasterxml.jackson.core - jackson-core - 2.13.4 - org.apache.pdfbox jbig2-imageio @@ -127,11 +135,6 @@ opencsv 5.12.0 - - com.fasterxml.jackson.dataformat - jackson-dataformat-csv - 2.13.4 - org.slf4j slf4j-simple