ASM-19589: SCA remediation - fix all fixable dependency vulnerabilities (50 -> 0)

[or-akl]

SCA remediation for ASM-19589. Trivy fs scan (vuln scanners, offline) on pom.xml reported 50 findings (21 HIGH / 26 MEDIUM / 3 LOW) - all with released fixes. After this change the same scan reports 0 findings.

Fixes by manifest

Manifest	Package	Old	New	How	CVEs addressed
pom.xml	com.fasterxml.jackson.core:jackson-databind (+jackson-core)	2.19.0	2.22.1	bump fasterxml_version property	CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, GHSA-r7wm-3cxj-wff9, GHSA-72hv-8253-57qq
pom.xml	io.netty:netty-handler (direct)	4.1.121.Final	4.1.137.Final	new netty_version property	CVE-2026-44249, CVE-2026-45416, CVE-2026-50010
pom.xml	io.netty:* (transitive via azure-identity: netty-codec, netty-codec-http, netty-codec-http2, netty-codec-dns, netty-resolver-dns, netty-handler-proxy, netty-transport-native-epoll/kqueue)	4.1.112-4.1.121.Final	4.1.137.Final	new <dependencyManagement> import of io.netty:netty-bom:4.1.137.Final	CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-67735, CVE-2026-33870, CVE-2026-33871, CVE-2026-41417, CVE-2026-42578..42585, CVE-2026-42587, CVE-2026-45536, CVE-2026-45673/45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-50020, CVE-2026-50560, CVE-2026-55831/55833, CVE-2026-56745/56746, CVE-2026-56819, CVE-2026-59898..59901, CVE-2026-59921, GHSA-mfg7-5gfp-c4w3
pom.xml	com.google.guava:guava (transitive via google-auth-library)	31.0.1-android	33.6.0-jre	bump google-auth-library-oauth2-http 1.5.3 -> 1.50.0	CVE-2023-2976, CVE-2020-8908
pom.xml	io.projectreactor.netty:reactor-netty-http (transitive via azure-identity)	1.0.48	1.2.18	bump azure-identity 1.15.2 -> 1.18.4	CVE-2025-22227
pom.xml	com.nimbusds:nimbus-jose-jwt (transitive via msal4j)	9.40	removed from tree (msal4j 1.23.1 shades its OIDC deps)	bump azure-identity 1.15.2 -> 1.18.4	CVE-2025-53864

Code changes required by bumps

None. Source uses only stable public APIs that are unchanged across the bumps, verified by review of all 6 source files (GoogleCredentials/IdTokenCredentials in GcpCloudIdProvider, DefaultAzureCredentialBuilder/TokenRequestContext in AzureCloudIdProvider, AWS SDK v2 Aws4Signer path in AwsCloudIdProvider - aws-core was not bumped) and by a clean compile plus the runtime smoke test below. Java 8 compiler target is preserved; all bumped versions (jackson 2.x, netty 4.1.x, azure-identity 1.18.x, google-auth-library 1.50.0) remain Java-8 compatible.

Residual findings

None. Post-fix trivy fs --scanners vuln --offline-scan on the tree: 0 findings. No findings were skipped, downgraded, or left without a fix.

Verification / TEST EVIDENCE

All verification ran on a local workstation (macOS, Maven with JDK 11, -Drevision=1.0.0-SNAPSHOT since the pom version is CI-injected). No production/SaaS endpoints and no internet-facing gateways were called; the only network access was Maven Central artifact downloads.

1. xmllint --noout pom.xml - pass (valid XML).
2. mvn -B clean package -Drevision=1.0.0-SNAPSHOT - BUILD SUCCESS (9.5 s): compiles all sources and builds the jar-with-dependencies assembly against the new versions.
3. mvn -B test -Drevision=1.0.0-SNAPSHOT - BUILD SUCCESS; surefire 3.5.4 reports "No tests to run": this repository contains no test sources at all (no src/test), so there is no unit suite to execute - on the base branch or on this one.
4. Offline runtime smoke test (written for this PR, compiled and run against the built fat jar; 20 assertions passed):
   • CloudProviderFactory.getCloudIdProvider dispatch for aws_iam, azure_ad, gcp + rejection of an unsupported type (4 assertions).
   • Full execution of AwsCloudIdProvider.getCloudId() with fake static env credentials (AWS_ACCESS_KEY_ID=AKIAFAKE..., AWS_EC2_METADATA_DISABLED=true): this code path signs the STS GetCallerIdentity request locally and never sends it, so it runs end-to-end offline. Verified the returned cloud-id decodes to the expected JSON and the headers JSON (serialized by jackson-databind 2.22.1) contains a SigV4 AWS4-HMAC-SHA256 Authorization header and X-Amz-Date (4 assertions). No request left the machine.
   • Class-linkage checks (Class.forName) for 10 classes across the bumped libraries: azure-identity, azure-core, google-auth-library, netty codec-http/ssl/resolver-dns, reactor-netty HttpClient, jackson ObjectMapper, guava (10 assertions).
   • Offline construction of DefaultAzureCredential via DefaultAzureCredentialBuilder().build() (no token fetch attempted) (1 assertion).
   • jackson-databind runtime version self-report equals 2.22.1 (1 assertion). Netty's version-properties files are merged away by the assembly plugin in the fat jar, so netty's runtime version is evidenced by mvn dependency:tree (all io.netty:* at 4.1.137.Final) instead.
5. mvn -B dependency:tree - confirms resolved tree: all netty artifacts 4.1.137.Final, reactor-netty-http/core 1.2.18, guava 33.6.0-jre, jackson 2.22.1/2.22, msal4j 1.23.1 with no standalone nimbus-jose-jwt.
6. Re-scan: trivy fs --scanners vuln --offline-scan -q -f json - 0 vulnerabilities (was 50).

Not run, and why: AzureCloudIdProvider.getCloudId() and GcpCloudIdProvider.getCloudId() end-to-end - both require live cloud credentials/metadata endpoints (Azure IMDS / GCP ADC), which are unavailable locally and out of scope per policy of not touching live environments; their code paths are covered by compile, class-linkage, and object-construction checks above. No integration/e2e suites, containers, or CI-only jobs exist in this repository (the .github directory contains no test workflows).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated third-party components supporting authentication, cloud identity, JSON processing, and networking.
  • Improved compatibility and reliability by aligning networking component versions and coordinating related updates.
  • Refreshed dependency management to help ensure consistent behavior across supported integrations and reduce version mismatches.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: be1444f7-a704-4eb7-a675-d9d63f896b84

📥 Commits

Reviewing files that changed from the base of the PR and between 2b5a7c9 and b2ab5cb.

📒 Files selected for processing (1)

• pom.xml

🚧 Files skipped from review as they are similar to previous changes (1)

• pom.xml

---

📝 Walkthrough

Walkthrough

The Maven configuration updates FasterXML, Google Auth, and Azure Identity versions. It adds a shared Netty version and imports the Netty BOM. Netty Handler now uses the shared version.

Changes

Dependency alignment

Layer / File(s)	Summary
Version and Netty dependency management pom.xml	The build updates dependency versions and aligns Netty artifacts through a shared version property and imported BOM.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit in the build,
Hopping where the versions yield.
Netty links in one neat line,
Fresh libraries now align.
Hop, hop, green and bright—
Maven’s garden grows just right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the pull request's main change: remediating all fixable dependency vulnerabilities from 50 findings to 0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch appsec/sca-remediation-2026-08

---

_{Comment @coderabbitai help to get the list of available commands.}

[or-akl]

AppSec Review - PASS

Ticket: ASM-19589 - [SCA] Remediate dependency vulnerabilities in akeyless-java-cloud-id (50 findings -> 0)

What Was Verified

• Root cause addressed: every bump claimed in the ticket is present in the pom.xml diff - jackson 2.19.0 -> 2.22.1, google-auth-library-oauth2-http 1.5.3 -> 1.50.0, azure-identity 1.15.2 -> 1.18.4, netty-handler 4.1.121.Final -> 4.1.137.Final plus a netty-bom import in dependencyManagement pinning all transitive Netty artifacts.
• Fix is at the correct layer: the BOM import is the right mechanism for a Maven project - it forces the Netty version on transitives pulled in by azure-identity/reactor-netty, not just the direct netty-handler dependency.
• Independent re-scan on this workstation (Trivy 0.71.1, trivy fs --scanners vuln): base commit 1ccb3fd = 51 findings (21 HIGH / 27 MEDIUM / 3 LOW - one more than the ticket's Aug 9 count because a new CVE was published since); merged main b06fa57 = 0 findings.
• mvn dependency:tree on merged main confirms the ticket's transitive claims: all io.netty:* at 4.1.137.Final, guava 33.6.0-jre, reactor-netty-core/http 1.2.18, nimbus-jose-jwt no longer in the tree.
• No new dependencies, no removed code, no source changes - pom.xml is the only file touched. All bumps stay within the same major version; Java 8 source/target retained.
• Fix fails safe: if a transitive tried to pull an older Netty, the BOM pin wins, so there is no path back to a vulnerable version without editing the POM.

Tests

PR #19 (hermetic unit suite + CI) landed on main before this PR merged, so the merged tree now has coverage: mvn clean package on merged main -> BUILD SUCCESS, 25 tests run, 0 failures (AWS 12, Azure 3, GCP 2, factory 8); the 3 LiveCloudIdE2ETest cases are skipped without real cloud creds. GitHub Actions "Tests" run on the merge commit is green (run 34090057304).

Notes

• azure-identity and google-auth are live auth libraries. The ticket already flags "validation level 3": before cutting a new SDK release, do one manual staging validation of AWS + Azure + GCP cloud-id auth against a real gateway (the skipped LiveCloudIdE2ETest cases cover exactly this when run with creds). Non-blocking for this review.
• Dependabot PRs Bump io.netty:netty-handler from 4.1.121.Final to 4.1.135.Final #15 (netty-handler 4.1.135) and Bump com.fasterxml.jackson.core:jackson-databind from 2.19.0 to 2.21.5 #17 (jackson-databind 2.21.5) are now superseded by this PR and can be closed.

---

Reviewed HEAD: b2ab5cb (merged as b06fa57)
Ticket moving to: Pending Deployment