[session 1] fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat CVE-2026-59083/59084, unblocks cd-develop) #14

2026-07-22T11:30:32-04:00

hiveiq commented

2026-07-22 11:30:32 -04:00

Session: 1

Unblocks aria's cd-develop, which has been red fleet-wide since 2026-07-16 — not caused by the ingest-filter PR (#13).

Root cause (diagnosed by reproducing the OWASP gate on the CI runner)

The OWASP Dependency Check step fails on tomcat-embed-core-10.1.56:

CVE-2026-59083 (CVSS 9.1)
CVE-2026-59084 (CVSS 9.1)

A newly-published NVD batch; real vulns, so the fix is to upgrade Tomcat, not suppress.

Fix

Bump parent hiveops-bom 1.0.8 → 1.0.9 (one line). bom 1.0.9 pins tomcat 10.1.57 (+ Spring Boot 3.5.16) and is already published to the Gitea Maven registry.

Verification (reproduced the exact CI toolchain container + `/opt/owasp-data`)

tomcat 10.1.56 → OWASP exit 1 (the two 9.1 CVEs) ✅ reproduced the failure
this branch (parent 1.0.9) → packaged tomcat-embed-core-10.1.57.jar, OWASP exit 0, BUILD SUCCESS ✅
mvn test green locally under Boot 3.5.16 (4/4).

Note

Every service still on bom 1.0.8 has the same Tomcat CVE and the same red pipeline — the same one-line parent bump fixes each. Worth a fleet-wide sweep (separate).

**Session:** 1 Unblocks aria's `cd-develop`, which has been red **fleet-wide since 2026-07-16** — **not** caused by the ingest-filter PR (#13). ### Root cause (diagnosed by reproducing the OWASP gate on the CI runner) The OWASP Dependency Check step fails on **`tomcat-embed-core-10.1.56`**: - `CVE-2026-59083` (CVSS **9.1**) - `CVE-2026-59084` (CVSS **9.1**) A newly-published NVD batch; real vulns, so the fix is to upgrade Tomcat, not suppress. ### Fix Bump parent `hiveops-bom` **1.0.8 → 1.0.9** (one line). bom 1.0.9 pins **tomcat 10.1.57** (+ Spring Boot 3.5.16) and is already published to the Gitea Maven registry. ### Verification (reproduced the exact CI toolchain container + `/opt/owasp-data`) - tomcat 10.1.56 → OWASP **exit 1** (the two 9.1 CVEs) ✅ reproduced the failure - this branch (parent 1.0.9) → packaged `tomcat-embed-core-10.1.57.jar`, OWASP **exit 0**, BUILD SUCCESS ✅ - `mvn test` green locally under Boot 3.5.16 (4/4). ### Note Every service still on bom 1.0.8 has the same Tomcat CVE and the same red pipeline — the same one-line parent bump fixes each. Worth a fleet-wide sweep (separate).

hiveiq added 1 commit 2026-07-22 11:30:32 -04:00

fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat 10.1.57, clears CVE-2026-59083/59084) 31cffa1b56

aria's cd-develop OWASP gate was failing on tomcat-embed-core 10.1.56:
CVE-2026-59083 (9.1) and CVE-2026-59084 (9.1). bom 1.0.9 pins tomcat 10.1.57
(+ Spring Boot 3.5.16), which clears both — verified by reproducing the OWASP
scan on the CI runner against /opt/owasp-data (exit 0, BUILD SUCCESS). Pipeline
had been red fleet-wide since 2026-07-16; unrelated to the ingest-filter change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

johannes approved these changes 2026-07-22 11:31:21 -04:00

hiveiq merged commit 7d0e8a867c into develop

2026-07-22 11:33:06 -04:00

hiveiq deleted branch fix/bom-1.0.9-tomcat-cve

2026-07-22 11:33:06 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hiveiq-src/hiveops-aria#14

[session 1] fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat CVE-2026-59083/59084, unblocks cd-develop) #14

Root cause (diagnosed by reproducing the OWASP gate on the CI runner)

Fix

Verification (reproduced the exact CI toolchain container + /opt/owasp-data)

Note

Verification (reproduced the exact CI toolchain container + `/opt/owasp-data`)