Repository navigation
[T2.17] Library replacements for EOL dependencies (30+ CVEs) #241
Description
Summary
jasypt replaced with Spring Security Crypto, json-lib fully migrated to Jackson (5 PRs), jettison migrated to Jackson, jtds replaced with mssql-jdbc, rhino replaced with Nashorn, sanselan replaced with a clean Java shim. Closing PRs: #77, #112 (issue #111), #120 (issue #119), #122 (issue #121), #126 (issue #125), #140 (issue #139), #142 (issue #141), #144 (issue #143), #146 (issue #145), #148 (issue #147), #150 (issue #149), #179 (issue #178), #185 (issue #184), #189 (issue #186).
Mitigation matrix
See docs/SECURITY-MITIGATIONS.md T2.17 entry.
Closing evidence
docs/SECURITY-MITIGATIONS.mdT2.17 entryowasp-suppressions.xml- Merged PRs listed above
Activity
docs(security): bulk backfill owasp-suppressions.xml + SECURITY-MITIG…
fix(security): T2.14 hardening: Hibernate ORM 5.6.15 + Validator 6.2.…
natechadwick-intsof commentedon Sep 17, 2026
Closing this sub-task
Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on
main:docs/SECURITY-MITIGATIONS.mdhas the per-GAV mitigation table for this sub-taskowasp-suppressions.xmlhas per-GAV<suppress>entries with<notes>describing the mitigation, pointing back at this issue and the merged PR(s)No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.