From e4e4007ea25a075f005394f5c042aafb0f3b97cd Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Thu, 8 Oct 2026 17:13:30 +0200 Subject: [PATCH 1/2] fix(security): source-map-js 1.2.2 + trivyignore spring-webmvc XsltView CVE - frontend: source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q, HIGH), transitive via postcss/@tailwindcss/node. Unblocks the npm-audit gate that fails CI on all open Dependabot PRs. - .trivyignore: CVE-2026-47884 (spring-webmvc 6.2.19, XsltView path limitation). No OSS fix for 6.2.x (only 7.0.9 / Boot 4); XsltView is not used anywhere in backend/src. Unblocks the nightly Trivy scan. Co-Authored-By: Claude Opus 5.5 --- .trivyignore | 1 + frontend/package-lock.json | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.trivyignore b/.trivyignore index 2357007b..c53d32f4 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,2 +1,3 @@ # Begründete Ausnahmen. Format pro Zeile: CVE-ID # Grund + Datum # z.B.: CVE-2024-12345 # nicht ausnutzbar (Komponente ungenutzt), 2026-06-28 +CVE-2026-47884 # spring-webmvc XsltView path limitation; kein OSS-Fix für 6.2.x (nur 7.0.9 = Boot 4), XsltView im Code ungenutzt (grep -ri xslt backend/src leer). Entfernen bei Boot-4-Migration. 2026-10-08 diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 483572cb..56320270 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -3887,9 +3887,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, "license": "BSD-3-Clause", "engines": { From ad29f348abf3e9735ed8b194a3857ad86f2a37a2 Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Thu, 8 Oct 2026 17:21:00 +0200 Subject: [PATCH 2/2] fix(security): frontend image pcre2 10.47 -> 10.49 (4x HIGH CVE) Co-Authored-By: Claude Opus 5.5 --- frontend/Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 23506e76..4226e8b7 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -12,7 +12,8 @@ FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2 # curl/libcurl 8.19.0-r0 -> 8.20.0-r0 (CVE-2026-5773/6276) # libssl3/libcrypto3 3.5.7-r0 -> 3.5.8-r0 (CVE-2026-14456, same openssl flaw patched in backend/Dockerfile) # libuuid 2.42.1-r0 -> 2.42.3-r1 (CVE-2026-78408/78409/78410, -76642, -53612/53613/53614) -RUN apk upgrade --no-cache libexpat c-ares curl libssl3 libcrypto3 libuuid +# pcre2 10.47-r1 -> 10.49-r0 (CVE-2026-86145/89157/89161/103111) +RUN apk upgrade --no-cache libexpat c-ares curl libssl3 libcrypto3 libuuid pcre2 COPY --from=builder /app/dist /usr/share/nginx/html COPY nginx-spa.conf /etc/nginx/conf.d/default.conf EXPOSE 80