MOSIP-44772: SECURITY: update vulnerable libraries #1860

Activity

1. exalate-issue-sync commented on May 13, 2026

   

   exalate-issue-syncBot

   on May 13, 2026 – with Exalate Issue Sync

   Author

   More actions

   Jira Assignee: Rachik Sharma (no valid GitHub user found)
2. exalate-issue-sync

   added

   bugSomething isn't workingSomething isn't working

   devsecops

   security

   on May 13, 2026
3. rachik-hue

   added this to the eSignet_v1.8.1 milestone on May 18, 2026
4. rachik-hue

   assigned

   Md-Humair-KK

   on May 18, 2026
5. rachik-hue

   added the

   Bug

   issue type on May 25, 2026
6. Md-Humair-KK commented on Jun 1, 2026

   

   Md-Humair-KK

   on Jun 1, 2026

   Collaborator

   More actions

   The vulnerability run is done on master branch can we please re run this on release branches, as I cannot run this because of the access denied from Infosys side for forked repos.

   
7. Md-Humair-KK commented on Jun 11, 2026

   

   Md-Humair-KK

   on Jun 11, 2026

   Collaborator

   More actions

   Not updating:

   1. org.springframework.boot:spring-boot-starter-data-redis@3.4.11 -> org.springframework.boot:spring-boot-starter-data-redis@4.0.0 MAJOR UPGRADE
   2. org.springframework.boot:spring-boot-starter-actuator -> CloudFoundry Actuator path is not supported by esignet
8. rachik-hue

   set

   Priority

   to

   High

   on Jun 22, 2026
9. Md-Humair-KK commented on Jun 28, 2026

   

   Md-Humair-KK

   on Jun 28, 2026

   Last edited by Md-Humair-KK

   Collaborator

   More actions

   based on new reports:

   snyk.zip

   eSignet — SCA Verified Report issues - Fixed - #2060
   eSignet — SAST Verified Report - needs UI fixes.
10. Md-Humair-KK commented on Jul 1, 2026

    

    Md-Humair-KK

    on Jul 1, 2026

    Last edited by Md-Humair-KK

    Collaborator

    More actions

    According to the latest reports there are 3 critical issues in eSignet repo:

    1. axios @1.13.5 -> updated to 1.16.0
    2. io.netty:netty-handler @4.1.107.Final -> updated to netty-handler ≥ 4.2.15.Final
    3. org.springframework.kafka:spring-kafka @3.1.2 -> not changed as we are using spring version of 3.2.3 which has to be changed in order change the kafka dependency version to 3.3.16

    PR - #2060
11. Md-Humair-KK commented on Jul 2, 2026

    

    Md-Humair-KK

    on Jul 2, 2026

    Last edited by Md-Humair-KK

    Collaborator

    More actions

    According to the latest reports there are 5 critical issues in Signup repo:

    1. axios @1.13.5 -> updated to 1.16.0
    2. io.netty:netty-handler @4.1.107.Final -> not changed as we are using spring version of 3.2.3
    3. org.springframework.kafka:spring-kafka @3.1.2 -> not changed as we are using spring version of 3.2.3 which has to be changed in order change the kafka dependency version to 3.3.16
    4. com.fasterxml.jackson.core:jackson-databind@2.15.0 -> not updated as we are using spring version of 3.2.3 which has to be changed in order change the jackson-databind dependency version to 2.21.4
    5. org.bouncycastle:bcpkix-jdk18on@1.78 -> updated to 1.84

    PR - mosip/esignet-signup#942
12. Md-Humair-KK commented on Jul 3, 2026

    

    Md-Humair-KK

    on Jul 3, 2026

    Last edited by Md-Humair-KK

    Collaborator

    More actions

    io.netty:netty-handler@4.1.104 - not changed as we are using spring version of 3.2.3

    Mock plugin:

    1. org.apache.tomcat.embed:tomcat-embed-core@10.1.19 -> not changed as this is transitive dependency io.mosip.kernel:kernel-keymanager-service
    2. org.bouncycastle:bcpkix-jdk18on@1.78.1 -> added dependency in respective pom to overide with version 1.80

    Mosip plugin:

    1. org.springframework.security:spring-security-web@6.2.2 , org.springframework.security:spring-security-crypto
       @6.2.2-> updated to spring-security-web ≥ 6.2.8 by adding a new BOM in pom xml, which is compatible with spring 3.2.2 the 6.5.11 will not be compatible with spring 3.2.2.
    2. com.fasterxml.jackson.core:jackson-databind@2.15.0 -> not changed
    3. org.bouncycastle:bcpkix-jdk18on@1.78.1 -> added dependency in respective pom to overide with version 1.80

    Sunbird:

    1. com.fasterxml.jackson.core:jackson-databind@2.15.4 -> not changed
    2. commons-collections:commons-collections@3.2.1 -> transitive from velocity:1.7 changed it to velocity-engine-core:2.3
    3. org.bouncycastle:bcpkix-jdk18on@1.78.1 -> added dependency in respective pom to overide with version 1.80

    org.springframework.boot:spring-boot-autoconfigure@3.2.3 -> since we are using spring 3.2.3 not changed
    org.springframework.boot:spring-boot-actuator-autoconfigure@3.2.3 -> since we are using spring 3.2.3 not changed
    org.springframework.kafka:spring-kafka@3.1.2 -> since we are using spring 3.2.3 not changed
    org.springframework.boot:spring-boot-actuator@3.2.3 -> since we are using spring 3.2.3 not changed

    PR - mosip/esignet-plugins#213