[NCL-9724] Fix CVEs by patrikk0123 · Pull Request #727 · project-ncl/dependency-analysis

patrikk0123 · 2026-06-30T11:27:12Z

Checklist:

Have you added unit tests for your change?

github-actions · 2026-06-30T11:39:46Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output

grpc-4.5.28.jar
					|-- grpc-netty-1.81.0.jar
						|-- netty-codec-http2-4.1.135.Final.jar [1 HIGH]
					|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-client-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-grpc-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-oidc-3.37.0.jar
		|-- quarkus-oidc-common-3.37.0.jar
			|-- smallrye-mutiny-vertx-web-client-3.22.2.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- smallrye-mutiny-vertx-uri-template-3.22.2.jar
					|-- vertx-uri-template-4.5.28.jar
						|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-web-client-4.5.28.jar [1 HIGH]
					|-- jackson-databind-2.22.0.jar [2 MEDIUM]
					|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- quarkus-vertx-3.37.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH]
			|-- quarkus-netty-3.37.0.jar
				|-- netty-codec-http2-4.1.135.Final.jar [1 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 1 MEDIUM]
			|-- quarkus-virtual-threads-3.37.0.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- smallrye-mutiny-vertx-core-3.22.2.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- smallrye-mutiny-vertx-runtime-3.22.2.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- smallrye-fault-tolerance-vertx-6.11.1.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-rest-client-jackson-3.37.0.jar
		|-- resteasy-reactive-jackson-3.37.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- quarkus-rest-jackson-common-3.37.0.jar
			|-- quarkus-jackson-3.37.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-smallrye-health-3.37.0.jar
		|-- quarkus-vertx-http-3.37.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- quarkus-tls-registry-3.37.0.jar
				|-- smallrye-private-key-pem-parser-0.9.3.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- smallrye-common-vertx-context-2.18.1.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-4.5.28.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- vertx-auth-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-bridge-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-web-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-smallrye-openapi-3.37.0.jar
		|-- smallrye-open-api-core-4.3.3.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- jackson-dataformat-yaml-2.22.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- reports-rest-3.0.1-SNAPSHOT.jar
		|-- quarkus-rest-jackson-3.37.0.jar
			|-- quarkus-rest-3.37.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- resteasy-reactive-vertx-3.37.0.jar
					|-- vertx-web-client-4.5.28.jar [1 HIGH]
		|-- quarkus-websockets-3.37.0.jar
			|-- quarkus-http-websocket-vertx-5.5.0.jar
				|-- quarkus-http-websocket-core-5.5.0.jar
					|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 1 MEDIUM]
		|-- reports-backend-3.0.1-SNAPSHOT.jar
			|-- communication-3.0.1-SNAPSHOT.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- galley-maven-1.22-jakarta.jar
					|-- atlas-relationships-api-1.2.2.jar
						|-- jackson-databind-2.22.0.jar [2 MEDIUM]
						|-- atlas-bindings-jackson-identities-1.2.2.jar
							|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- galley-transport-httpclient-1.22-jakarta.jar
					|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- rest-client-jakarta-3.6.0-SNAPSHOT.jar
	|-- jackson-jakarta-rs-json-provider-2.22.0.jar
		|-- jackson-jakarta-rs-base-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- common-3.6.0-SNAPSHOT-jakarta.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- opentelemetry-instrumentation-annotations-2.27.0.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- dto-3.6.0-SNAPSHOT-patch-builders-jakarta.jar
		|-- jackson-datatype-jsr310-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- json-patch-1.13.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- jackson-coreutils-2.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jsoup-1.22.2.jar
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 1 MEDIUM]
	|-- pnc-api-3.5.1-jakarta.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- pnc-common-3.5.2-jakarta.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-module-parameter-names-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- pom-manipulation-common-lite-5.3.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- opentelemetry-ext-cli-java-2.1.0.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- rest-api-3.6.0-SNAPSHOT-java-client-jakarta.jar
		|-- jackson-datatype-jdk8-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- rest-client-3.6.0-SNAPSHOT-jakarta.jar
		|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH]
			|-- netty-codec-http2-4.1.135.Final.jar [1 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 1 MEDIUM]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 1 MEDIUM]
			|-- netty-handler-proxy-4.1.135.Final.jar
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 1 MEDIUM]


No Policy violations were detected

Project 'dependency-analysis' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=17cd357b-3d0e-43ac-a982-661505cac482
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=d38fa0abfb554c9cac571a09497e0af3f534680889b74705ab11e416b1c07dd4

Mend AI scan succeeded.

Support Token: 3da93b0f607f64ded85321324830249fe1784733116514

SAST scan output

*no findings*

Full logs and artifacts

patrikk0123 · 2026-06-30T13:41:33Z

First migrated to maven scm provider v2, which brought more CVEs.
v2 also doesn't support cloning by hash, so made the implementation fully cover the git cloning, without the scm provider.
Now scm provider isn't needed for the git part.

rnc · 2026-07-08T08:25:41Z

I've been looking at the original code and I hadn't realised it was also executing the git binary and only using maven-scm (and jgit) as a fallback. I'm not completely convinced by this in the sense the maven-scm stuff seems pointless - we don't support SVN so that is irrelevant now. I am not sure of the need to use maven-scm as opposed to using jgit directly. As for executing git, @akridl has a set of nice git execution functions in reqour that could be reused (and also he is using smallrye processexecutor which avoids pitfalls in the java process code. I would be tempted to add shallow clone to reqour, strip out all of the maven-scm code, and reuse reqour code here. ( cc @akridl @thescouser89 )

patrikk0123 · 2026-07-08T08:42:24Z

@rnc
you mean these?
https://github.com/project-ncl/reqour/blob/main/core/src/main/java/org/jboss/pnc/reqour/common/GitCommands.java
https://github.com/project-ncl/reqour/blob/main/core/src/main/java/org/jboss/pnc/reqour/common/utils/GitUtils.java

do you think it should be added to pnc-common? though, there is a lot of it

rnc · 2026-07-08T10:35:00Z

@patrikk0123 Yes ; good question ; that probably should be discussed with @akridl and others offline on the best approach here. While your PR probably will fix the issue, I think it would be simpler to strip out all the maven-scm stuff entirely.

rnc · 2026-07-17T09:18:22Z

@patrikk0123 I've had another look at reqour code - I would potentially agree that importing reqour core might be 'too much' and equally those commands are interleaved with other reqour code (specifically things like the process executor to make them hard to migrate elsewhere. However, perhaps some parts could be used as inspiration or some way to share, liaising with @akridl might be possible. I think using the smallrye ProcessBuilder is important to avoid pitfalls with the JDK one (Quarkus specifically migrated to it so its well tested).

patrikk0123 · 2026-07-21T07:34:49Z

@rnc I agree with extracting Git "manipulation" codebase, ideally to PNC common, also with the process executor if that's generic enough for our organization or suitable for the DA.

rnc · 2026-07-21T16:01:29Z

@rnc I agree with extracting Git "manipulation" codebase, ideally to PNC common, also with the process executor if that's generic enough for our organization or suitable for the DA.

I think my point was the code might be too hard to extract and it's just using the smallrye process executor anyway...

patrikk0123 · 2026-07-22T15:00:09Z

@rnc I introduced some of the Git commands in likeness to Reqour, including SmallRye ProcessBuilder.
Then also deleted mentions of SVN and dependency on Maven SCM manager.

patrikk0123 force-pushed the ncl9724-2 branch 2 times, most recently from bd9bf97 to ccbd608 Compare June 30, 2026 12:48

patrikk0123 force-pushed the ncl9724-2 branch 2 times, most recently from 645370f to 4a505b1 Compare June 30, 2026 13:57

patrikk0123 requested a review from rnc June 30, 2026 14:14

patrikk0123 force-pushed the ncl9724-2 branch from 4a505b1 to c04595d Compare July 8, 2026 08:14

patrikk0123 added 4 commits July 22, 2026 11:37

NCL-9724 Bump jsonrpc2-base to v2.2.1

1cd4985

NCL-9724 Remove scm provider git implementation

041f91c

NCL-9724 Remove infinispan coming from partyline

06f4826

NCL-9724 Extract git commands and introduce SmallRye ProcessBuilder

4a20d9c

patrikk0123 force-pushed the ncl9724-2 branch from c04595d to 4a20d9c Compare July 22, 2026 14:45

NCL-9724 Remove SVN type and Maven SCM dependency

1184df2

rnc approved these changes Aug 3, 2026

View reviewed changes

patrikk0123 merged commit 2db4cf6 into project-ncl:master Aug 3, 2026
4 checks passed

Navigation Menu

Uh oh!

[NCL-9724] Fix CVEs - #727

[NCL-9724] Fix CVEs#727
patrikk0123 merged 5 commits into
project-ncl:masterfrom
patrikk0123:ncl9724-2

patrikk0123 commented Jun 30, 2026

Uh oh!

github-actions Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

patrikk0123 commented Jun 30, 2026

Uh oh!

rnc commented Jul 8, 2026

Uh oh!

patrikk0123 commented Jul 8, 2026 •

edited

Loading

Uh oh!

rnc commented Jul 8, 2026

Uh oh!

rnc commented Jul 17, 2026

Uh oh!

patrikk0123 commented Jul 21, 2026

Uh oh!

rnc commented Jul 21, 2026

Uh oh!

patrikk0123 commented Jul 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

patrikk0123 commented Jun 30, 2026

Checklist:

Uh oh!

github-actions Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mend Scan Results

Uh oh!

patrikk0123 commented Jun 30, 2026

Uh oh!

rnc commented Jul 8, 2026

Uh oh!

patrikk0123 commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rnc commented Jul 8, 2026

Uh oh!

rnc commented Jul 17, 2026

Uh oh!

patrikk0123 commented Jul 21, 2026

Uh oh!

rnc commented Jul 21, 2026

Uh oh!

patrikk0123 commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 30, 2026 •

edited

Loading

patrikk0123 commented Jul 8, 2026 •

edited

Loading

patrikk0123 commented Jul 22, 2026 •

edited

Loading