hiveiq-src/hiveops-aria
7
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

[session 1] fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat CVE-2026-59083/59084, unblocks cd-develop) #14

Merged
hiveiq merged 1 commits from fix/bom-1.0.9-tomcat-cve into develop 2026-07-22 11:33:06 -04:00
Conversation 1 Commits 1 Files Changed 1
+1 -1

1 Commits

Author SHA1 Message Date
johannes 31cffa1b56 fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat 10.1.57, clears CVE-2026-59083/59084) 
aria's cd-develop OWASP gate was failing on tomcat-embed-core 10.1.56:
CVE-2026-59083 (9.1) and CVE-2026-59084 (9.1). bom 1.0.9 pins tomcat 10.1.57
(+ Spring Boot 3.5.16), which clears both — verified by reproducing the OWASP
scan on the CI runner against /opt/owasp-data (exit 0, BUILD SUCCESS). Pipeline
had been red fleet-wide since 2026-07-16; unrelated to the ingest-filter change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-22 11:19:48 -04:00