Repository navigation
[T2.20] Other minor deps (171 CVEs across ~50 GAVs) #244
Description
Summary
Catch-all bucket for GAVs that do not fit any other T2.x sub-task (commons-net, dom4j, jdom, jaxen, json, jsoup, gson, guava, httpclient, netty, jackson-dataformat-*, BouncyCastle JDK15to18 pin, Shiro 1.13.0 pin, jackrabbit-jcr-commons <2.21 pin, etc.). All CVEs are pinned at the latest Java 1.8 line; residual CVEs close when the Java 11+ migration epic lands. Per-GAV mitigations documented in docs/SECURITY-MITIGATIONS.md T2.20 entry.
Mitigation matrix
See docs/SECURITY-MITIGATIONS.md T2.20 entry for the per-GAV mitigation table.
OWASP suppressions
Per-GAV suppressions are in owasp-suppressions.xml with notes describing the per-GAV disposition.
Closing evidence
docs/SECURITY-MITIGATIONS.mdT2.20 entryowasp-suppressions.xml
Activity
docs(security): bulk backfill owasp-suppressions.xml + SECURITY-MITIG…
fix(security): T2.14 hardening: Hibernate ORM 5.6.15 + Validator 6.2.…
natechadwick-intsof commentedon Sep 17, 2026
Closing this sub-task
Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on
main:docs/SECURITY-MITIGATIONS.mdhas the per-GAV mitigation table for this sub-taskowasp-suppressions.xmlhas per-GAV<suppress>entries with<notes>describing the mitigation, pointing back at this issue and the merged PR(s)No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.