Conversation
Clears 9 HIGH/CRITICAL findings from the container image vulnerability scan (issue #36546) with no API, coordinate, or scope change — every bump stays within the same major version and the same artifact coordinates. tomcat-catalina/jasper/jdbc 9.0.120 -> 9.0.122 (3 CRITICAL) org.postgresql:postgresql 42.7.2 -> 42.7.13 (CVE-2026-42198) dnsjava:dnsjava 3.5.3 -> 3.6.5 (CVE-2024-25638, 2x GHSA KeyTrap) core5:httpcore5 (+ h2) 5.3.4 -> 5.4.3 (CVE-2026-54399, CVE-2026-54428) xstream:xstream 1.4.20 -> 1.4.21 (CVE-2024-47072) io.micrometer:* 1.13.10 -> 1.15.12 (CVE-2026-40984) tomcat.version additionally drives the Tomcat distribution zip fetched by the assembly and the tomcat-* jars. The 9.0.122 zip and every 9.0.122 artifact were confirmed present on Maven Central. It does not affect a Docker base image: the product image builds FROM dotcms/java-base (Java 25), and the docker.base.image property that names a tomcat image is unreferenced dead config. Deliberately out of scope: commons-fileupload and grpc (both need code changes; PR #36548 covers them), ion-java (the fix lives at a different groupId, com.amazon.ion, while the artifact in use stops at 1.5.1), jackson, graphql-java, elasticsearch and jdom (breaking upgrades or deliberate pins), and cryptacular/xmlsec (ship from the dotCMS/com.dotcms.dotsaml repo). Verified: ./mvnw install -pl :dotcms-core --am -DskipTests succeeds, and dependency:list resolves all six at the new versions with no superseded version left in the tree. Committed with HUSKY=0 — the pre-commit hook cannot run under pnpm 9, and lint-staged only matches core-web TS/JS files.
wezell
requested review from
dcolina,
dsantos-dcms,
sfreudenthaler,
swicken and
yolabingo
September 18, 2026 17:02
Contributor
|
Claude finished @wezell's task in 1m 29s —— View job Code Review
New Issues
Notes (non-blocking, no action required)
No 🔴 Critical or 🟠 High issues. Nothing here blocks merge; the two mediums are "verify at runtime" items the PR description already anticipates. The choice to batch these into one PR is reasonable given they're all self-contained coordinate bumps within the same major version. |
dotCMS-Machine-User
previously approved these changes
Sep 18, 2026
dotCMS-Machine-User
left a comment
dotCMS-Machine-User
left a comment
Collaborator
There was a problem hiding this comment.
✅ dotbot review: all reviewer models (meta/muse-spark-1.3, ~z-ai/glm-latest) agree — patch is correct.
approved automatically by dotbot
…mirror
The PR test suite failed on a Docker Hub network timeout while pulling
opensearchproject/opensearch:1.3.6:
[ERROR] DOCKER> Unable to pull 'opensearchproject/opensearch:1.3.6' :
Head "https://registry-1.docker.io/v2/..." : Get
"https://auth.docker.io/token?..." : net/http: request canceled
(Client.Timeout exceeded while awaiting headers) (Internal Server Error: 500)
The docker-maven-plugin pulls this image on every test run, so a failure to
reach Docker Hub takes down the whole PR test phase: one job fails and the rest
are cancelled. Point it at mirror.gcr.io, Google's Docker Hub pull-through
cache, to take registry-1.docker.io and auth.docker.io out of the critical path.
Verified the mirror serves the identical image for this tag — the manifest
digest is the same as Docker Hub's, and the pull succeeds locally.
Scope: only docker.image.search, the image that actually failed. The other
images this file pins (opensearch:3.8.0 for the upgrade suite, pgvector:pg18,
wiremock:3.5.3) are also available on the mirror and can be moved the same way
if the direct pulls prove flaky too; they are left on Docker Hub here to keep
this change to the one that broke.
dotCMS-Machine-User
previously approved these changes
Sep 18, 2026
dotCMS-Machine-User
left a comment
dotCMS-Machine-User
left a comment
Collaborator
There was a problem hiding this comment.
✅ dotbot review: all reviewer models (meta/muse-spark-1.3, ~z-ai/glm-latest) agree — patch is correct.
approved automatically by dotbot
Contributor
|
dotbot code review:
Test-only image reference swap to Google Docker Hub mirror for two remaining test containers; no production code or security boundary affected. Tip: comment with "/dotbot address comments" to attempt automated fixes for unresolved review threads. reviewed by dotbot · meta/muse-spark-1.3 · medium |
Contributor
|
dotbot code review:
The incremental change applies the same mirror.gcr.io pull-through mirror prefix to the two remaining Docker Hub-pulled test container images (opensearch upgrade, pgvector postgres), consistent with the previously reviewed docker.image.search change. These properties only feed docker-maven-plugin test containers in parent/pom.xml, so no production behavior is affected and the image tags are unchanged. Tip: comment with "/dotbot address comments" to attempt automated fixes for unresolved review threads. reviewed by dotbot · ~z-ai/glm-latest · medium |
dotCMS-Machine-User
approved these changes
Sep 18, 2026
dotCMS-Machine-User
left a comment
dotCMS-Machine-User
left a comment
Collaborator
There was a problem hiding this comment.
✅ dotbot review: all reviewer models (meta/muse-spark-1.3, ~z-ai/glm-latest) agree — patch is correct.
approved automatically by dotbot
wezell
added
the
PR: docker image
Contributor
🐳 PR Docker test imageLatest build for commit docker pull dotcms/dotcms-test:pr-37626-issue-36546-safe-dependency-bumps
docker pull dotcms/dotcms-test:pr-37626-issue-36546-safe-dependency-bumps_3dd5501 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why is this one PR?
Because do you know how many cycles of checks and runners and merge queues are needed to get these 6 library bumps in the code base? It would clog up our pipelines for days....
Proposed Changes
Bump six libraries that have published fixes, clearing 9 HIGH/CRITICAL findings from the
container image vulnerability scan. Every bump stays within the same major version and the
same artifact coordinates — no API change, no scope change, no new dependency.
tomcat-catalina/-jasper/-jdbcorg.postgresql:postgresqldnsjava:dnsjavacore5:httpcore5(+httpcore5-h2)com.thoughtworks.xstream:xstreamio.micrometer:*Files:
bom/application/pom.xml,parent/pom.xml. Two files, seven lines.tomcat.versionadditionally drives the Tomcat distribution zip fetched by the assembly andevery
tomcat-*jar, so the 9.0.122 zip and all 9.0.122 artifacts were confirmed present onMaven Central before the bump. It does not affect a Docker base image: the product image
builds
FROM dotcms/java-base(Java 25), and thedocker.base.imageproperty that names atomcat:*image is unreferenced dead config.How This Was Verified
./mvnw install -pl :dotcms-core --am -DskipTests -Dmaven.build.cache.enabled=false—BUILD SUCCESS, all 12 reactor modules, 6:04.
The build cache was disabled deliberately so the compile could not be short-circuited.
dependency:listconfirms all six at the new versions, with no superseded version leftanywhere in the tree — including all 13
tomcat-*artifacts at 9.0.122.Not verified: runtime behaviour. No tests were run. The realistic risk areas are
micrometer (a minor bump, and it feeds the telemetry system) and Tomcat (it drives the
servlet container). Reviewers may want at least a smoke test on those two.
Checklist
exclusions below for the deliberate non-changes
Additional Info
Refs #36546 — deliberately not a closing reference. This PR covers only the subset of that
issue that is fixable by a version bump, and the issue still has open work under PR #36548
(commons-fileupload, grpc). It should stay open.
Deliberately out of scope, with reasons:
commons-fileupload,io.grpc:grpc-netty-shadedsoftware.amazon.ion:ion-java1.0.2com.amazon.ion); the coordinate in use (software.amazon.ion) stops at 1.5.1, so the scan's "fixed in 1.10.5" is unreachable without a coordinate migrationjackson2.17.2graphql-java17.5elasticsearch7.10.2org.jdom:jdom1.1.3jdom2migration with WebDAV riskcryptacular,xmlsecdotCMS/com.dotcms.dotsamlrepotinymceAlso worth noting for reviewers:
nettyfrom the same issue is already fixed onmain(
b6a18e74b1), so it is not part of this PR.The scan that produced this list was run as
linux/arm64. The Java and Node layers arearchitecture-independent, but the apt package set can differ on
linux/amd64, so the OS-layerpicture in production may differ slightly.