Security: high-severity CVEs in transitive dependencies

[dfcoffin]

Summary

High-severity CVEs flagged in transitive dependencies during the PR #116 session. Captured in PR_116_FOLLOWUP_NOTES.md; filing as a tracked issue.

Affected dependency areas

• Spring Boot 4.0.x — transitive CVEs
• Tomcat 11.0.15
• Jackson 3.0.3
• AssertJ 3.27.6

(Exact CVE IDs to be confirmed by running the dependency scan — see below.)

Action

1. Run mvn org.owasp:dependency-check-maven:check (the OWASP step exists in .github/workflows/ci.yml) to enumerate the current CVE set with IDs and CVSS scores.
2. For each high-severity finding, determine whether a patched version is available and bump it (prefer aligning with the Spring Boot 4.0.x BOM where possible).
3. For findings with no upgrade path, document risk acceptance or add an OWASP suppression with justification (openespi-authserver/owasp-suppressions.xml exists as a pattern).

Acceptance criteria

• Current high-severity CVEs enumerated with IDs + CVSS
• Each resolved by upgrade, or explicitly suppressed with written justification
• dependency-check passes at the configured failBuildOnCVSS threshold

Source

PR_116_FOLLOWUP_NOTES.md item 1 (post-PR #116, 2026-05-19).