Skip to content

Commit aead2eb

Browse files
thibauultthibauult
authored
Publish SNAPSHOT artifacts during PR builder (#876)
* Publish SNAPSHOT artifacts during PR builder execution * Update Gradle wrapper validation to use gradle/actions/wrapper-validation@v4 The old gradle/wrapper-validation-action is deprecated and was causing CI failures. * Fix SNAPSHOT repository URL for Sonatype Central Portal * Do not try to publish snapshot in case of a fork PR * Restart PR Builder * Cache OWASP Dependency Check database in CI * Suppress new Netty and Spring CVEs pending upstream fixes CVE-2026-42582 (Netty 4.1.134.Final) and CVE-2026-41840/41841/41842/41843/41850/41851 (Spring Framework 6.2.18 via spring-boot-dependencies:3.5.14) have no fixed release yet. Suppressed temporarily to unblock CI; a follow-up PR will bump the dependencies once fixed versions are available. * Upgrade to Spring Boot 3.5.15 to fix Netty and Spring CVEs 3.5.15 ships Netty 4.1.135.Final (fixes CVE-2026-42582 and 18 additional Netty CVEs) and Spring Framework 6.2.19 (fixes CVE-2026-41840 through CVE-2026-41851). Also ships Tomcat 10.1.55 so the explicit overrides for Netty and Tomcat are no longer needed. Reverts the CVE suppressions added in the previous commit. * Suppress CVE-2026-42582 for Netty pending upstream fix Netty 4.1.135.Final is the last 4.1.x release and Spring Boot 3.5.15 is the last 3.5.x release — no patched version is available upstream. * Improving CVE Scan exec time * Fix GitHub Actions workflow: secrets context not allowed in if conditions Move secrets to job-level env vars and use env context in the conditional expression to check whether Sonatype credentials are available before publishing snapshot artifacts. * Publish PR-specific SNAPSHOT versions in PR builder Sets the artifact version to PR-{number}-SNAPSHOT on PR builds so each PR publishes an independently addressable SNAPSHOT. Reports the published version in the GitHub Actions step summary. * Report published SNAPSHOT as PR comment instead of step summary
1 parent 80060e8 commit aead2eb

8 files changed

Lines changed: 357 additions & 25 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ jobs:
1212

1313
runs-on: ubuntu-latest
1414

15+
env:
16+
MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
17+
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
18+
1519
steps:
1620
- uses: actions/checkout@v4
1721

@@ -21,7 +25,27 @@ jobs:
2125
distribution: 'temurin'
2226
java-version: '17'
2327

28+
- name: Compute PR SNAPSHOT version
29+
if: github.event_name == 'pull_request'
30+
run: echo "SNAPSHOT_VERSION=PR-${{ github.event.pull_request.number }}-SNAPSHOT" >> $GITHUB_ENV
31+
2432
- name: Build with Gradle
2533
uses: gradle/gradle-build-action@v2.4.2
2634
with:
2735
arguments: build jacocoTestReport jacocoTestCoverageVerification
36+
37+
- name: Publish SNAPSHOT artifacts
38+
if: github.event_name == 'pull_request' && env.MAVEN_USERNAME != ''
39+
uses: gradle/gradle-build-action@v2.4.2
40+
with:
41+
arguments: publishToSonatype -PprojectVersion=${{ env.SNAPSHOT_VERSION }} -PmavenRepoUsername=${{ secrets.MAVEN_USERNAME }} -PmavenRepoPassword=${{ secrets.MAVEN_PASSWORD }}
42+
43+
- name: Report published SNAPSHOT
44+
if: github.event_name == 'pull_request' && env.MAVEN_USERNAME != ''
45+
env:
46+
GH_TOKEN: ${{ github.token }}
47+
run: |
48+
BODY="**SNAPSHOT published:** \`${SNAPSHOT_VERSION}\`
49+
Repository: https://central.sonatype.com/repository/maven-snapshots/"
50+
gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body "${BODY}" --edit-last \
51+
|| gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body "${BODY}"

‎.github/workflows/cve-scanning-gradle.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,14 @@ jobs:
2424
uses: gradle/actions/setup-gradle@v3
2525
with:
2626
cache-read-only: ${{ github.ref != 'refs/heads/main' }}
27-
- name: Build with Gradle
28-
# The build action is not strictly necessary as dependencyCheckAggregate will build the project
29-
# but it's good practice to have it as a separate step to catch build errors earlier.
30-
run: ./gradlew build --no-daemon
27+
- name: Cache OWASP Dependency Check Database
28+
uses: actions/cache@v4
29+
with:
30+
path: ~/.gradle/dependency-check-data
31+
key: ${{ runner.os }}-owasp-db-${{ github.run_id }}
32+
restore-keys: |
33+
${{ runner.os }}-owasp-db-
3134
- name: CVEs
32-
# Using --no-daemon is a good practice in CI environments
33-
# It prevents potential conflicts or statefulness between job runs.
3435
env:
3536
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
36-
run: ./gradlew dependencyCheckAggregate --no-daemon -PdependencyCheck.nvd.apiKey=${{ secrets.NVD_API_KEY }}
37+
run: ./gradlew dependencyCheckAggregate --no-daemon

‎.github/workflows/gradle-wrapper-validation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- uses: actions/checkout@v4
12-
- uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4
12+
- uses: gradle/actions/wrapper-validation@v4

‎AGENTS.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# AGENTS.md
2+
3+
This file provides guidance to AI Coding Assistants when working with code in this repository.
4+
5+
## Build & Test Commands
6+
7+
```bash
8+
# Full build (default task)
9+
./gradlew build
10+
11+
# Build with coverage reports (used in CI)
12+
./gradlew build jacocoTestReport jacocoTestCoverageVerification
13+
14+
# Run all tests
15+
./gradlew test
16+
17+
# Run tests for a specific module
18+
./gradlew :symphony-bdk-core:test
19+
20+
# Run a single test class or method
21+
./gradlew :symphony-bdk-core:test --tests "com.symphony.bdk.core.service.MessageServiceTest"
22+
./gradlew :symphony-bdk-core:test --tests "com.symphony.bdk.core.service.MessageServiceTest.shouldSendMessage"
23+
24+
# Publish to local Maven repository
25+
./gradlew publishToMavenLocal
26+
27+
# OWASP dependency vulnerability check (requires NVD_API_KEY env var for reasonable speed)
28+
./gradlew dependencyCheck
29+
30+
# Check for dependency updates
31+
./gradlew dependencyUpdates
32+
```
33+
34+
## Module Architecture
35+
36+
The project is a multi-module Gradle build. All modules import the `symphony-bdk-bom` platform for dependency version alignment.
37+
38+
### Core modules
39+
40+
| Module | Role |
41+
|--------|------|
42+
| `symphony-bdk-bom` | Bill of Materials — version constraints for all dependencies |
43+
| `symphony-bdk-config` | Loads and parses `bdk-config.yaml` into `BdkConfig` |
44+
| `symphony-bdk-core` | Entry point, services, auth, datafeed loop, activity framework |
45+
| `symphony-bdk-extension-api` | SPI for third-party BDK extensions |
46+
47+
### Abstraction layers with multiple implementations
48+
49+
| API module | Implementations |
50+
|------------|-----------------|
51+
| `symphony-bdk-http:symphony-bdk-http-api` | `symphony-bdk-http-jersey2`, `symphony-bdk-http-webclient` |
52+
| `symphony-bdk-template:symphony-bdk-template-api` | `symphony-bdk-template-freemarker`, `symphony-bdk-template-handlebars` |
53+
54+
### Spring Boot integration
55+
56+
`symphony-bdk-spring:symphony-bdk-core-spring-boot-starter` and `symphony-bdk-app-spring-boot-starter` wrap the core in auto-configured Spring beans. These do not change core behaviour — they only wire configuration and lifecycle.
57+
58+
### Test utilities
59+
60+
`symphony-bdk-test:symphony-bdk-test-jupiter` provides JUnit 5 extensions; `symphony-bdk-test-spring-boot` wraps them for Spring context tests.
61+
62+
## symphony-bdk-core Internals
63+
64+
`SymphonyBdk` is the user-facing entry point. It is built via `SymphonyBdkBuilder` and owns a `ServiceFactory` that instantiates all services lazily.
65+
66+
Key sub-packages:
67+
68+
- **`auth`** — session authentication and JWT token management (`AuthSession`, `BotAuthenticator`, `OboAuthenticator`)
69+
- **`service`** — one service class per Symphony API domain (`MessageService`, `StreamService`, `UserService`, `DatafeedService`, etc.)
70+
- **`activity`** — activity framework: `ActivityRegistry` dispatches `DatafeedEvent`s to registered `AbstractActivity` handlers (command, form reply, room events)
71+
- **`retry`** — Resilience4j-backed retry decorators applied to all HTTP calls
72+
- **`client`** — HTTP client load-balancing and exception translation
73+
74+
OBO (On-Behalf-Of) flows are surfaced through `OboServices` / `OboService`, which mirror the main services but authenticate with a delegated session.
75+
76+
## Build Conventions (`buildSrc/`)
77+
78+
Four Groovy convention plugins used by sub-modules:
79+
80+
- `bdk.java-common-conventions` — Java 17, UTF-8, JaCoCo, JUnit Platform, sources+javadoc jars, BOM platform import
81+
- `bdk.java-library-conventions` — extends common + `java-library` plugin (used by all published libs)
82+
- `bdk.java-publish-conventions` — `maven-publish` + `signing`; signing is **only required for release versions** (`isReleaseVersion = !version.endsWith('SNAPSHOT')`)
83+
- `bdk.java-codegen-conventions` — OpenAPI Generator (Jersey2, Java 8 date library) reading `src/main/resources/api.yaml`; generated sources land in `build/generated/openapi`
84+
85+
## Publishing
86+
87+
Snapshots are published to Sonatype OSSRH via the `publishToSonatype` Gradle task (nexus-publish-plugin). This task is automatically triggered in CI on every PR build. Releases use `publishToSonatype closeAndReleaseStagingRepository` and are triggered by a GitHub Release event.
88+
89+
Credentials are passed as Gradle properties: `-PmavenRepoUsername` and `-PmavenRepoPassword`.
90+
91+
# context-mode — MANDATORY routing rules
92+
93+
You have context-mode MCP tools available. These rules are NOT optional — they protect your context window from flooding. A single unrouted command can dump 56 KB into context and waste the entire session.
94+
95+
## BLOCKED commands — do NOT attempt these
96+
97+
### curl / wget — BLOCKED
98+
Any Bash command containing `curl` or `wget` is intercepted and replaced with an error message. Do NOT retry.
99+
Instead use:
100+
- `ctx_fetch_and_index(url, source)` to fetch and index web pages
101+
- `ctx_execute(language: "javascript", code: "const r = await fetch(...)")` to run HTTP calls in sandbox
102+
103+
### Inline HTTP — BLOCKED
104+
Any Bash command containing `fetch('http`, `requests.get(`, `requests.post(`, `http.get(`, or `http.request(` is intercepted and replaced with an error message. Do NOT retry with Bash.
105+
Instead use:
106+
- `ctx_execute(language, code)` to run HTTP calls in sandbox — only stdout enters context
107+
108+
### WebFetch — BLOCKED
109+
WebFetch calls are denied entirely. The URL is extracted and you are told to use `ctx_fetch_and_index` instead.
110+
Instead use:
111+
- `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` to query the indexed content
112+
113+
## REDIRECTED tools — use sandbox equivalents
114+
115+
### Bash (>20 lines output)
116+
Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `npm install`, `pip install`, and other short-output commands.
117+
For everything else, use:
118+
- `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
119+
- `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context
120+
121+
### Read (for analysis)
122+
If you are reading a file to **Edit** it → Read is correct (Edit needs content in context).
123+
If you are reading to **analyze, explore, or summarize** → use `ctx_execute_file(path, language, code)` instead. Only your printed summary enters context. The raw file content stays in the sandbox.
124+
125+
### Grep (large results)
126+
Grep results can flood context. Use `ctx_execute(language: "shell", code: "grep ...")` to run searches in sandbox. Only your printed summary enters context.
127+
128+
## Tool selection hierarchy
129+
130+
1. **GATHER**: `ctx_batch_execute(commands, queries)` — Primary tool. Runs all commands, auto-indexes output, returns search results. ONE call replaces 30+ individual calls.
131+
2. **FOLLOW-UP**: `ctx_search(queries: ["q1", "q2", ...])` — Query indexed content. Pass ALL questions as array in ONE call.
132+
3. **PROCESSING**: `ctx_execute(language, code)` | `ctx_execute_file(path, language, code)` — Sandbox execution. Only stdout enters context.
133+
4. **WEB**: `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` — Fetch, chunk, index, query. Raw HTML never enters context.
134+
5. **INDEX**: `ctx_index(content, source)` — Store content in FTS5 knowledge base for later search.
135+
136+
## Subagent routing
137+
138+
When spawning subagents (Agent/Task tool), the routing block is automatically injected into their prompt. Bash-type subagents are upgraded to general-purpose so they have access to MCP tools. You do NOT need to manually instruct subagents about context-mode.
139+
140+
## Output constraints
141+
142+
- Keep responses under 500 words.
143+
- Write artifacts (code, configs, PRDs) to FILES — never return them as inline text. Return only: file path + 1-line description.
144+
- When indexing content, use descriptive source labels so others can `ctx_search(source: "label")` later.
145+
146+
## ctx commands
147+
148+
| Command | Action |
149+
|---------|--------|
150+
| `ctx stats` | Call the `ctx_stats` MCP tool and display the full output verbatim |
151+
| `ctx doctor` | Call the `ctx_doctor` MCP tool, run the returned shell command, display as checklist |
152+
| `ctx upgrade` | Call the `ctx_upgrade` MCP tool, run the returned shell command, display as checklist |

‎CLAUDE.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# CLAUDE.md
2+
3+
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
4+
5+
## Build & Test Commands
6+
7+
```bash
8+
# Full build (default task)
9+
./gradlew build
10+
11+
# Build with coverage reports (used in CI)
12+
./gradlew build jacocoTestReport jacocoTestCoverageVerification
13+
14+
# Run all tests
15+
./gradlew test
16+
17+
# Run tests for a specific module
18+
./gradlew :symphony-bdk-core:test
19+
20+
# Run a single test class or method
21+
./gradlew :symphony-bdk-core:test --tests "com.symphony.bdk.core.service.MessageServiceTest"
22+
./gradlew :symphony-bdk-core:test --tests "com.symphony.bdk.core.service.MessageServiceTest.shouldSendMessage"
23+
24+
# Publish to local Maven repository
25+
./gradlew publishToMavenLocal
26+
27+
# OWASP dependency vulnerability check (requires NVD_API_KEY env var for reasonable speed)
28+
./gradlew dependencyCheck
29+
30+
# Check for dependency updates
31+
./gradlew dependencyUpdates
32+
```
33+
34+
## Module Architecture
35+
36+
The project is a multi-module Gradle build. All modules import the `symphony-bdk-bom` platform for dependency version alignment.
37+
38+
### Core modules
39+
40+
| Module | Role |
41+
|--------|------|
42+
| `symphony-bdk-bom` | Bill of Materials — version constraints for all dependencies |
43+
| `symphony-bdk-config` | Loads and parses `bdk-config.yaml` into `BdkConfig` |
44+
| `symphony-bdk-core` | Entry point, services, auth, datafeed loop, activity framework |
45+
| `symphony-bdk-extension-api` | SPI for third-party BDK extensions |
46+
47+
### Abstraction layers with multiple implementations
48+
49+
| API module | Implementations |
50+
|------------|-----------------|
51+
| `symphony-bdk-http:symphony-bdk-http-api` | `symphony-bdk-http-jersey2`, `symphony-bdk-http-webclient` |
52+
| `symphony-bdk-template:symphony-bdk-template-api` | `symphony-bdk-template-freemarker`, `symphony-bdk-template-handlebars` |
53+
54+
### Spring Boot integration
55+
56+
`symphony-bdk-spring:symphony-bdk-core-spring-boot-starter` and `symphony-bdk-app-spring-boot-starter` wrap the core in auto-configured Spring beans. These do not change core behaviour — they only wire configuration and lifecycle.
57+
58+
### Test utilities
59+
60+
`symphony-bdk-test:symphony-bdk-test-jupiter` provides JUnit 5 extensions; `symphony-bdk-test-spring-boot` wraps them for Spring context tests.
61+
62+
## symphony-bdk-core Internals
63+
64+
`SymphonyBdk` is the user-facing entry point. It is built via `SymphonyBdkBuilder` and owns a `ServiceFactory` that instantiates all services lazily.
65+
66+
Key sub-packages:
67+
68+
- **`auth`** — session authentication and JWT token management (`AuthSession`, `BotAuthenticator`, `OboAuthenticator`)
69+
- **`service`** — one service class per Symphony API domain (`MessageService`, `StreamService`, `UserService`, `DatafeedService`, etc.)
70+
- **`activity`** — activity framework: `ActivityRegistry` dispatches `DatafeedEvent`s to registered `AbstractActivity` handlers (command, form reply, room events)
71+
- **`retry`** — Resilience4j-backed retry decorators applied to all HTTP calls
72+
- **`client`** — HTTP client load-balancing and exception translation
73+
74+
OBO (On-Behalf-Of) flows are surfaced through `OboServices` / `OboService`, which mirror the main services but authenticate with a delegated session.
75+
76+
## Build Conventions (`buildSrc/`)
77+
78+
Four Groovy convention plugins used by sub-modules:
79+
80+
- `bdk.java-common-conventions` — Java 17, UTF-8, JaCoCo, JUnit Platform, sources+javadoc jars, BOM platform import
81+
- `bdk.java-library-conventions` — extends common + `java-library` plugin (used by all published libs)
82+
- `bdk.java-publish-conventions` — `maven-publish` + `signing`; signing is **only required for release versions** (`isReleaseVersion = !version.endsWith('SNAPSHOT')`)
83+
- `bdk.java-codegen-conventions` — OpenAPI Generator (Jersey2, Java 8 date library) reading `src/main/resources/api.yaml`; generated sources land in `build/generated/openapi`
84+
85+
## Publishing
86+
87+
Snapshots are published to Sonatype OSSRH via the `publishToSonatype` Gradle task (nexus-publish-plugin). This task is automatically triggered in CI on every PR build. Releases use `publishToSonatype closeAndReleaseStagingRepository` and are triggered by a GitHub Release event.
88+
89+
Credentials are passed as Gradle properties: `-PmavenRepoUsername` and `-PmavenRepoPassword`.
90+
91+
# context-mode — MANDATORY routing rules
92+
93+
You have context-mode MCP tools available. These rules are NOT optional — they protect your context window from flooding. A single unrouted command can dump 56 KB into context and waste the entire session.
94+
95+
## BLOCKED commands — do NOT attempt these
96+
97+
### curl / wget — BLOCKED
98+
Any Bash command containing `curl` or `wget` is intercepted and replaced with an error message. Do NOT retry.
99+
Instead use:
100+
- `ctx_fetch_and_index(url, source)` to fetch and index web pages
101+
- `ctx_execute(language: "javascript", code: "const r = await fetch(...)")` to run HTTP calls in sandbox
102+
103+
### Inline HTTP — BLOCKED
104+
Any Bash command containing `fetch('http`, `requests.get(`, `requests.post(`, `http.get(`, or `http.request(` is intercepted and replaced with an error message. Do NOT retry with Bash.
105+
Instead use:
106+
- `ctx_execute(language, code)` to run HTTP calls in sandbox — only stdout enters context
107+
108+
### WebFetch — BLOCKED
109+
WebFetch calls are denied entirely. The URL is extracted and you are told to use `ctx_fetch_and_index` instead.
110+
Instead use:
111+
- `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` to query the indexed content
112+
113+
## REDIRECTED tools — use sandbox equivalents
114+
115+
### Bash (>20 lines output)
116+
Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `npm install`, `pip install`, and other short-output commands.
117+
For everything else, use:
118+
- `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
119+
- `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context
120+
121+
### Read (for analysis)
122+
If you are reading a file to **Edit** it → Read is correct (Edit needs content in context).
123+
If you are reading to **analyze, explore, or summarize** → use `ctx_execute_file(path, language, code)` instead. Only your printed summary enters context. The raw file content stays in the sandbox.
124+
125+
### Grep (large results)
126+
Grep results can flood context. Use `ctx_execute(language: "shell", code: "grep ...")` to run searches in sandbox. Only your printed summary enters context.
127+
128+
## Tool selection hierarchy
129+
130+
1. **GATHER**: `ctx_batch_execute(commands, queries)` — Primary tool. Runs all commands, auto-indexes output, returns search results. ONE call replaces 30+ individual calls.
131+
2. **FOLLOW-UP**: `ctx_search(queries: ["q1", "q2", ...])` — Query indexed content. Pass ALL questions as array in ONE call.
132+
3. **PROCESSING**: `ctx_execute(language, code)` | `ctx_execute_file(path, language, code)` — Sandbox execution. Only stdout enters context.
133+
4. **WEB**: `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` — Fetch, chunk, index, query. Raw HTML never enters context.
134+
5. **INDEX**: `ctx_index(content, source)` — Store content in FTS5 knowledge base for later search.
135+
136+
## Subagent routing
137+
138+
When spawning subagents (Agent/Task tool), the routing block is automatically injected into their prompt. Bash-type subagents are upgraded to general-purpose so they have access to MCP tools. You do NOT need to manually instruct subagents about context-mode.
139+
140+
## Output constraints
141+
142+
- Keep responses under 500 words.
143+
- Write artifacts (code, configs, PRDs) to FILES — never return them as inline text. Return only: file path + 1-line description.
144+
- When indexing content, use descriptive source labels so others can `ctx_search(source: "label")` later.
145+
146+
## ctx commands
147+
148+
| Command | Action |
149+
|---------|--------|
150+
| `ctx stats` | Call the `ctx_stats` MCP tool and display the full output verbatim |
151+
| `ctx doctor` | Call the `ctx_doctor` MCP tool, run the returned shell command, display as checklist |
152+
| `ctx upgrade` | Call the `ctx_upgrade` MCP tool, run the returned shell command, display as checklist |

‎allow-list.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,15 @@
2323
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib(-jdk7|-jdk8|-common)?@.*$</packageUrl>
2424
<cve>CVE-2020-29582</cve>
2525
</suppress>
26+
<suppress>
27+
<notes><![CDATA[
28+
Netty 4.1.135.Final is the last release in the 4.1.x line; no patch exists for CVE-2026-42582.
29+
Spring Boot 3.5.15 (the latest 3.5.x) pins Netty 4.1.135.Final. Suppressing pending either a
30+
Netty 4.1.136+ fix or a Spring Boot upgrade to a version that ships a patched Netty.
31+
]]></notes>
32+
<packageUrl regex="true">^pkg:maven/io\.netty/netty.*@.*$</packageUrl>
33+
<cve>CVE-2026-42582</cve>
34+
</suppress>
2635
<suppress>
2736
<notes><![CDATA[
2837
handlebars.java 4.5.0 still bundles handlebars-v4.7.7.js as a resource. We use the

0 commit comments

Comments
 (0)