[T2.10] Apache POI 5.2.x hardening (9 CVEs) #235

Activity

1. natechadwick-intsof

   added

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   on Sep 17, 2026
2. natechadwick-intsof

   added a parent issue on Sep 17, 2026

   • [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
3. natechadwick-intsof

   added a commit that references this issue on Sep 17, 2026

   docs(security): bulk backfill owasp-suppressions.xml + SECURITY-MITIG…

   ...

   058c7ba
4. vijaya-boddipudi

   added a commit that references this issue on Sep 17, 2026

   fix(security): T2.14 hardening: Hibernate ORM 5.6.15 + Validator 6.2.…

   ...

   4ebc0bd
5. natechadwick-intsof commented on Sep 17, 2026

   

   natechadwick-intsof

   on Sep 17, 2026

   CollaboratorAuthor

   More actions

   Closing this sub-task

   Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on main:

   • Merged PR(s) referenced in the sub-task body
   • docs/SECURITY-MITIGATIONS.md has the per-GAV mitigation table for this sub-task
   • owasp-suppressions.xml has per-GAV <suppress> entries with <notes> describing the mitigation, pointing back at this issue and the merged PR(s)

   No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.
6. natechadwick-intsof

   closed this as completedon Sep 17, 2026