Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
@@ -1,17 +1,12 @@
version: 2

# Private registries used by Dependabot
registries:
maven-releases:
type: maven-repository
url: https://maven.398ja.xyz/releases
username: ${{secrets.MVN_USER}}
password: ${{secrets.MVN_PASSWORD}}
maven-snapshots:
type: maven-repository
url: https://maven.398ja.xyz/snapshots
username: ${{secrets.MVN_USER}}
password: ${{secrets.MVN_PASSWORD}}

updates:
- package-ecosystem: "maven"
Expand All @@ -20,6 +15,9 @@ updates:
interval: "weekly"
open-pull-requests-limit: 5
target-branch: "develop"
registries:
- maven-releases
- maven-snapshots
- package-ecosystem: "github-actions"
directory: "/"
schedule:
Expand Down
48 changes: 48 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [0.2.0] - 2026-01-30

### Added
- Docker image build bound to Maven deploy phase for streamlined CI/CD
- E2E testing documentation and architecture guide
- CI configuration with build and test jobs

### Changed
- Domain verification now uses `_nostr-verification` naming for better protocol alignment
- Admin UI shows both DNS and Well-Known verification options without method selection
- Verification attempts both DNS and Well-Known methods automatically
- Auto-generates verification token when viewing unverified domains
- Updated nostr-java dependency to 1.3.0
- Removed nsecbunker-account dependency from bottin-core

### Fixed
- SecurityFilterChain conflict in E2E tests
- Qodana security findings addressed
- CI workflow fixes for google-java-format and Maven wrapper
- Admin credentials now properly use environment variables
- Fixed 500 error when viewing domains list

### Security
- Removed credentials from dependabot registry configuration

## [0.1.0] - 2025-01-15

### Added
- Initial release of Bottin NIP-05 Registry Service
- REST API for NIP-05 record management
- Admin dashboard with domain and record management
- Domain verification via DNS TXT and Well-Known file methods
- PostgreSQL and H2 database support
- Spring Boot starter for easy integration
- Docker support with Jib

[Unreleased]: https://github.com/tcheeric/bottin/compare/v0.2.0...HEAD
[0.2.0]: https://github.com/tcheeric/bottin/compare/v0.1.0...v0.2.0
[0.1.0]: https://github.com/tcheeric/bottin/releases/tag/v0.1.0
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -100,16 +100,16 @@ bottin:
### Method 1: DNS TXT Record

1. Register domain via API or admin dashboard
2. Add TXT record to `_bottin-verification.yourdomain.com`:
2. Add TXT record to `_nostr-verification.yourdomain.com`:
```
bottin-verification=<your-verification-token>
nostr-verification=<your-verification-token>
```
3. Trigger verification check (DNS propagation may take up to 24 hours)

### Method 2: Well-Known File

1. Register domain via API or admin dashboard
2. Create file at `https://yourdomain.com/.well-known/bottin-verification.txt`
2. Create file at `https://yourdomain.com/.well-known/nostr-verification.txt`
3. Add the exact verification token as file contents
4. Trigger verification check

Expand Down Expand Up @@ -222,5 +222,5 @@ MIT License - see LICENSE file for details.

## Related Projects

- [nsecbunker-java](https://github.com/tcheeric/nsecbunker-java) - Key management
- [nsecbunker-java](https://github.com/398ja/nsecbunker-java) - Key management
- [nostr-java](https://github.com/tcheeric/nostr-java) - Nostr protocol library
2 changes: 1 addition & 1 deletion bottin-admin-ui/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-admin-ui</artifactId>
Expand All @@ -17,7 +17,7 @@

<dependencies>
<!-- Internal modules -->
<dependency>

Check notice on line 20 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 20 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>
Expand All @@ -25,17 +25,17 @@
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-persistence</artifactId>
</dependency>
<dependency>

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-service</artifactId>
</dependency>
<dependency>

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-verification</artifactId>
</dependency>

<!-- Spring Boot Web -->
<dependency>

Check failure on line 38 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 38 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 38 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 38 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
Expand All @@ -61,7 +61,7 @@
</dependency>

<!-- Spring Security -->
<dependency>

Check failure on line 64 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 64 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
Expand All @@ -80,7 +80,7 @@
</dependency>

<!-- Testing -->
<dependency>

Check warning on line 83 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 83 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 83 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 83 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
Expand Down Expand Up @@ -114,7 +114,7 @@
</dependency>

<!-- Spring Security Test -->
<dependency>

Check warning on line 117 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 117 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
Expand All @@ -128,7 +128,7 @@
</dependency>

<!-- Spring Boot Actuator for health checks -->
<dependency>

Check warning on line 131 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 131 in bottin-admin-ui/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,13 +48,20 @@
model.addAttribute("domains", domains);
model.addAttribute("createForm", new CreateDomainForm());
model.addAttribute("verificationMethods", VerificationMethod.values());
return "admin/domains";

Check warning on line 51 in bottin-admin-ui/src/main/java/xyz/tcheeric/bottin/admin/controller/AdminDomainsController.java

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Unresolved view reference

Cannot resolve MVC view 'admin/domains'

Check warning on line 51 in bottin-admin-ui/src/main/java/xyz/tcheeric/bottin/admin/controller/AdminDomainsController.java

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Unresolved view reference

Cannot resolve MVC view 'admin/domains'
}

@GetMapping("/{id}")
public String viewDomain(@PathVariable Long id, Model model) {
return domainService.findById(id)
.map(domain -> {
// Auto-initiate verification for unverified domains without a token
if (!domain.isVerified() && domain.getVerificationToken() == null) {
verificationService.initiateVerification(id);
// Reload domain to get the new token
domain = domainService.findById(id).orElse(domain);
}

VerificationStatus status = verificationService.getVerificationStatus(id);
model.addAttribute("domain", domain);
model.addAttribute("verificationStatus", status);
Expand Down
104 changes: 34 additions & 70 deletions bottin-admin-ui/src/main/resources/templates/admin/domain-detail.html
Original file line number Diff line number Diff line change
Expand Up @@ -91,81 +91,45 @@ <h3 class="text-lg font-medium leading-6 text-gray-900">Domain Information</h3>
<h3 class="text-lg font-medium leading-6 text-gray-900">Domain Verification</h3>
</div>
<div class="px-4 py-5 sm:p-6">
<div th:if="${domain.verificationToken}">
<p class="text-sm text-gray-600 mb-4">
Current method: <span class="font-semibold" th:text="${verificationStatus.method}">DNS_TXT</span>
</p>

<!-- DNS TXT Record Instructions -->
<div class="mb-6" th:if="${verificationStatus.method.name() == 'DNS_TXT'}">
<h4 class="text-sm font-medium text-gray-900 mb-2">DNS TXT Record</h4>
<p class="text-xs text-gray-500 mb-2">Add a TXT record to your DNS:</p>
<div class="bg-gray-50 rounded-md p-3">
<p class="text-xs text-gray-500">Name:</p>
<code class="text-sm font-mono text-gray-900" th:text="'_bottin-verification.' + ${domain.name}">_bottin-verification.example.com</code>
<p class="text-xs text-gray-500 mt-2">Value:</p>
<code class="text-sm font-mono text-gray-900 break-all" th:text="'bottin-verification=' + ${domain.verificationToken}">bottin-verification=token-here</code>
</div>
</div>
<p class="text-sm text-gray-600 mb-4">
Complete one of the following methods to verify domain ownership:
</p>

<!-- Well-Known File Instructions -->
<div class="mb-6" th:if="${verificationStatus.method.name() == 'WELL_KNOWN_FILE'}">
<h4 class="text-sm font-medium text-gray-900 mb-2">Well-Known File</h4>
<p class="text-xs text-gray-500 mb-2">Create a file at this URL:</p>
<div class="bg-gray-50 rounded-md p-3">
<code class="text-sm font-mono text-gray-900 break-all"
th:text="'https://' + ${domain.name} + '/.well-known/bottin-verification.txt'">
https://example.com/.well-known/bottin-verification.txt
</code>
<p class="text-xs text-gray-500 mt-2">With content:</p>
<code class="text-sm font-mono text-gray-900 break-all" th:text="${domain.verificationToken}">token-here</code>
</div>
<!-- DNS TXT Record Instructions -->
<div class="mb-6">
<h4 class="text-sm font-medium text-gray-900 mb-2">Option 1: DNS TXT Record</h4>
<p class="text-xs text-gray-500 mb-2">Add a TXT record to your DNS:</p>
<div class="bg-gray-50 rounded-md p-3">
<p class="text-xs text-gray-500">Name:</p>
<code class="text-sm font-mono text-gray-900" th:text="'_nostr-verification.' + ${domain.name}">_nostr-verification.example.com</code>
<p class="text-xs text-gray-500 mt-2">Value:</p>
<code class="text-sm font-mono text-gray-900 break-all" th:text="'nostr-verification=' + ${domain.verificationToken}">nostr-verification=token-here</code>
</div>
</div>

<div class="space-y-3">
<form th:action="@{/admin/domains/{id}/verify/attempt(id=${domain.id})}" method="post">
<button type="submit"
class="w-full inline-flex justify-center items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-green-600 hover:bg-green-700">
<svg class="w-4 h-4 mr-2" fill="none" viewBox="0 0 24 24" stroke="currentColor">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
</svg>
Verify Domain Now
</button>
</form>

<p class="text-xs text-gray-500 text-center">or change verification method:</p>
<form th:action="@{/admin/domains/{id}/verify(id=${domain.id})}" method="post" class="flex space-x-2">
<select name="method" class="flex-1 rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 text-sm">
<option th:each="m : ${verificationMethods}" th:value="${m}" th:text="${m}" th:selected="${m == verificationStatus.method}">DNS_TXT</option>
</select>
<button type="submit"
class="inline-flex items-center px-3 py-2 border border-gray-300 shadow-sm text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50">
Change
</button>
</form>
<!-- Well-Known File Instructions -->
<div class="mb-6">
<h4 class="text-sm font-medium text-gray-900 mb-2">Option 2: Well-Known File</h4>
<p class="text-xs text-gray-500 mb-2">Create a file at this URL:</p>
<div class="bg-gray-50 rounded-md p-3">
<code class="text-sm font-mono text-gray-900 break-all"
th:text="'https://' + ${domain.name} + '/.well-known/nostr-verification.txt'">
https://example.com/.well-known/nostr-verification.txt
</code>
<p class="text-xs text-gray-500 mt-2">With content:</p>
<code class="text-sm font-mono text-gray-900 break-all" th:text="${domain.verificationToken}">token-here</code>
</div>
</div>
<div th:unless="${domain.verificationToken}">
<p class="text-sm text-gray-600 mb-4">
Choose a verification method to prove ownership of this domain.
</p>
<form th:action="@{/admin/domains/{id}/verify(id=${domain.id})}" method="post" class="space-y-4">
<div>
<label for="method" class="block text-sm font-medium text-gray-700">Verification Method</label>
<select name="method" id="method" required
class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm">
<option th:each="m : ${verificationMethods}" th:value="${m}" th:text="${m}">DNS_TXT</option>
</select>
</div>
<button type="submit"
class="w-full inline-flex justify-center items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700">
<svg class="w-4 h-4 mr-2" fill="none" viewBox="0 0 24 24" stroke="currentColor">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
</svg>
Start Verification
</button>
</form>
</div>

<form th:action="@{/admin/domains/{id}/verify/attempt(id=${domain.id})}" method="post">
<button type="submit"
class="w-full inline-flex justify-center items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-green-600 hover:bg-green-700">
<svg class="w-4 h-4 mr-2" fill="none" viewBox="0 0 24 24" stroke="currentColor">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
</svg>
Verify Domain Now
</button>
</form>
</div>
</div>

Expand Down
2 changes: 1 addition & 1 deletion bottin-core/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-core</artifactId>
Expand All @@ -19,7 +19,7 @@

<dependencies>
<!-- nostr-java for key handling -->
<dependency>

Check notice on line 22 in bottin-core/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 22 in bottin-core/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>nostr-java-id</artifactId>
</dependency>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ public class VerificationFailedException extends BottinException {

private static final String ERROR_CODE = "VERIFICATION_FAILED";
private static final String DNS_SUGGESTION =
"Ensure the DNS TXT record '_bottin-verification.{domain}' contains the verification token. DNS propagation may take up to 24 hours.";
"Ensure the DNS TXT record '_nostr-verification.{domain}' contains the verification token. DNS propagation may take up to 24 hours.";
private static final String WELLKNOWN_SUGGESTION =
"Ensure the file at 'https://{domain}/.well-known/bottin-verification.txt' contains the exact verification token.";
"Ensure the file at 'https://{domain}/.well-known/nostr-verification.txt' contains the exact verification token.";

public VerificationFailedException(String domain, String method, String reason) {
super(ERROR_CODE, true,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ public class VerificationChallenge {
*/
public static VerificationChallenge forDnsTxt(String domain, String token, Instant expiresAt) {
String instructions = String.format(
"Add a TXT record to _bottin-verification.%s with value: bottin-verification=%s",
"Add a TXT record to _nostr-verification.%s with value: nostr-verification=%s",
domain, token);
return VerificationChallenge.builder()
.domain(domain)
Expand All @@ -65,7 +65,7 @@ public static VerificationChallenge forDnsTxt(String domain, String token, Insta
*/
public static VerificationChallenge forWellKnown(String domain, String token, Instant expiresAt) {
String instructions = String.format(
"Create a file at https://%s/.well-known/bottin-verification.txt with content: %s",
"Create a file at https://%s/.well-known/nostr-verification.txt with content: %s",
domain, token);
return VerificationChallenge.builder()
.domain(domain)
Expand All @@ -88,6 +88,6 @@ public boolean isExpired() {
* Returns the full verification value for DNS TXT records.
*/
public String getDnsTxtValue() {
return "bottin-verification=" + token;
return "nostr-verification=" + token;
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,15 @@ public enum VerificationMethod {

/**
* DNS TXT record verification.
* User adds a TXT record to _bottin-verification.{domain} with the verification token.
* User adds a TXT record to _nostr-verification.{domain} with the verification token.
*/
DNS_TXT("DNS TXT Record", "_bottin-verification.{domain}"),
DNS_TXT("DNS TXT Record", "_nostr-verification.{domain}"),

/**
* Well-known file verification.
* User creates a file at https://{domain}/.well-known/bottin-verification.txt
* User creates a file at https://{domain}/.well-known/nostr-verification.txt
*/
WELL_KNOWN_FILE("Well-Known File", "/.well-known/bottin-verification.txt");
WELL_KNOWN_FILE("Well-Known File", "/.well-known/nostr-verification.txt");

private final String displayName;
private final String location;
Expand Down
2 changes: 1 addition & 1 deletion bottin-persistence/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-persistence</artifactId>
Expand All @@ -19,13 +19,13 @@

<dependencies>
<!-- Internal -->
<dependency>

Check notice on line 22 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 22 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>

<!-- Spring Boot Data JPA -->
<dependency>

Check notice on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
Expand Down Expand Up @@ -68,12 +68,12 @@
</dependency>

<!-- Testing -->
<dependency>

Check warning on line 71 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 71 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 71 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 71 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>

Check notice on line 76 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 76 in bottin-persistence/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<scope>test</scope>
Expand Down
2 changes: 1 addition & 1 deletion bottin-service/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-service</artifactId>
Expand All @@ -17,17 +17,17 @@

<dependencies>
<!-- Internal modules -->
<dependency>

Check notice on line 20 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 20 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>
<dependency>

Check notice on line 24 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-persistence</artifactId>
</dependency>

<!-- Spring Boot -->
<dependency>

Check notice on line 30 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 30 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 30 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 30 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 30 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 30 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
</dependency>
Expand Down Expand Up @@ -56,7 +56,7 @@
</dependency>

<!-- Testing -->
<dependency>

Check warning on line 59 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 59 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 59 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 59 in bottin-service/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
Expand Down
2 changes: 1 addition & 1 deletion bottin-spring-boot-starter/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-spring-boot-starter</artifactId>
Expand All @@ -21,7 +21,7 @@
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>
<dependency>

Check warning on line 24 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-persistence</artifactId>
</dependency>
Expand All @@ -29,17 +29,17 @@
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-service</artifactId>
</dependency>
<dependency>

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-verification</artifactId>
</dependency>
<dependency>

Check failure on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-web</artifactId>
</dependency>

<!-- nsecbunker-java integration -->
<dependency>

Check notice on line 42 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-websocket:6.2.1 * [CVE-2025-41254](https://www.mend.io/vulnerability-database/CVE-2025-41254?utm_source=Jetbrains) 4.3 Spring Framework STOMP CSRF Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 42 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-websocket:6.2.1 * [CVE-2025-41254](https://www.mend.io/vulnerability-database/CVE-2025-41254?utm_source=Jetbrains) 4.3 Spring Framework STOMP CSRF Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>nsecbunker-account</artifactId>
<version>${nsecbunker-java.version}</version>
Expand All @@ -52,7 +52,7 @@
</dependency>

<!-- Spring Boot -->
<dependency>

Check notice on line 55 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 55 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 55 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 55 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
</dependency>
Expand Down Expand Up @@ -86,7 +86,7 @@
</dependency>

<!-- Testing -->
<dependency>

Check warning on line 89 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 89 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 89 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 89 in bottin-spring-boot-starter/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
Expand Down
2 changes: 1 addition & 1 deletion bottin-tests/bottin-e2e/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-tests</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-e2e</artifactId>
Expand All @@ -17,23 +17,23 @@

<dependencies>
<!-- Bottin modules to test -->
<dependency>

Check notice on line 20 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 20 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>
<dependency>

Check notice on line 24 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-persistence</artifactId>
</dependency>
<dependency>

Check notice on line 28 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-service</artifactId>
</dependency>
<dependency>

Check notice on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-verification</artifactId>
</dependency>
<dependency>

Check warning on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-web</artifactId>
</dependency>
Expand All @@ -44,13 +44,13 @@
</dependency>

<!-- nsecbunker-java for integration testing -->
<dependency>

Check notice on line 47 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-websocket:6.2.1 * [CVE-2025-41254](https://www.mend.io/vulnerability-database/CVE-2025-41254?utm_source=Jetbrains) 4.3 Spring Framework STOMP CSRF Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 47 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-websocket:6.2.1 * [CVE-2025-41254](https://www.mend.io/vulnerability-database/CVE-2025-41254?utm_source=Jetbrains) 4.3 Spring Framework STOMP CSRF Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>nsecbunker-account</artifactId>
</dependency>

<!-- Spring Boot Test -->
<dependency>

Check warning on line 53 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 53 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
Expand All @@ -62,7 +62,7 @@
</dependency>

<!-- Testcontainers -->
<dependency>

Check warning on line 65 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-compress:1.24.0 * [CVE-2024-25710](https://www.mend.io/vulnerability-database/CVE-2024-25710?utm_source=JetBrains) 8.1 Loop with Unreachable Exit Condition ('Infinite Loop') * [CVE-2024-26308](https://www.mend.io/vulnerability-database/CVE-2024-26308?utm_source=JetBrains) 5.5 Allocation of Resources Without Limits or Throttling Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 65 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-compress:1.24.0 * [CVE-2024-25710](https://www.mend.io/vulnerability-database/CVE-2024-25710?utm_source=JetBrains) 8.1 Loop with Unreachable Exit Condition ('Infinite Loop') * [CVE-2024-26308](https://www.mend.io/vulnerability-database/CVE-2024-26308?utm_source=JetBrains) 5.5 Allocation of Resources Without Limits or Throttling Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers</artifactId>
<scope>test</scope>
Expand Down Expand Up @@ -91,7 +91,7 @@
<artifactId>junit-jupiter</artifactId>
<scope>test</scope>
</dependency>
<dependency>

Check warning on line 94 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Dependency maven:org.assertj:assertj-core:3.25.3 is vulnerable , safe version 3.27.7 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 94 in bottin-tests/bottin-e2e/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Dependency maven:org.assertj:assertj-core:3.25.3 is vulnerable , safe version 3.27.7 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<scope>test</scope>
Expand Down
2 changes: 1 addition & 1 deletion bottin-tests/bottin-it/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-tests</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-it</artifactId>
Expand All @@ -17,33 +17,33 @@

<dependencies>
<!-- Bottin modules to test -->
<dependency>

Check notice on line 20 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 20 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>
<dependency>

Check notice on line 24 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-persistence</artifactId>
</dependency>
<dependency>

Check notice on line 28 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 28 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 28 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-service</artifactId>
</dependency>
<dependency>

Check notice on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 32 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-verification</artifactId>
</dependency>
<dependency>

Check warning on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-crypto:6.4.2 * [CVE-2025-22228](https://www.mend.io/vulnerability-database/CVE-2025-22228?utm_source=JetBrains) 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-webmvc:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.security:spring-security-core:6.4.2 * [CVE-2025-41232](https://www.mend.io/vulnerability-database/CVE-2025-41232?utm_source=Jetbrains) 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods * [CVE-2025-41248](https://www.mend.io/vulnerability-database/CVE-2025-41248?utm_source=Jetbrains) 7.5 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types * [CVE-2025-22223](https://www.mend.io/vulnerability-database/CVE-2025-22223?utm_source=JetBrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check failure on line 36 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.tomcat.embed:tomcat-embed-core:10.1.34 * [CVE-2025-24813](https://www.mend.io/vulnerability-database/CVE-2025-24813?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-31651](https://www.mend.io/vulnerability-database/CVE-2025-31651?utm_source=Jetbrains) 9.8 Insufficient Information * [CVE-2025-55754](https://www.mend.io/vulnerability-database/CVE-2025-55754?utm_source=Jetbrains) 9.6 Insufficient Information * [CVE-2025-31650](https://www.mend.io/vulnerability-database/CVE-2025-31650?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-55752](https://www.mend.io/vulnerability-database/CVE-2025-55752?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48989](https://www.mend.io/vulnerability-database/CVE-2025-48989?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48976](https://www.mend.io/vulnerability-database/CVE-2025-48976?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-48988](https://www.mend.io/vulnerability-database/CVE-2025-48988?utm_source=Jetbrains) 7.5 Insufficient Information * [CVE-2025-49125](https://www.mend.io/vulnerability-database/CVE-2025-49125?utm_source=Jetbrains) 6.5 Insufficient Information * [CVE-2025-46701](https://www.mend.io/vulnerability-database/CVE-2025-46701?utm_source=Jetbrains) 6.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-web</artifactId>
</dependency>
<dependency>

Check notice on line 40 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-websocket:6.2.1 * [CVE-2025-41254](https://www.mend.io/vulnerability-database/CVE-2025-41254?utm_source=Jetbrains) 4.3 Spring Framework STOMP CSRF Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 40 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-websocket:6.2.1 * [CVE-2025-41254](https://www.mend.io/vulnerability-database/CVE-2025-41254?utm_source=Jetbrains) 4.3 Spring Framework STOMP CSRF Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-spring-boot-starter</artifactId>
</dependency>

<!-- Spring Boot Test -->
<dependency>

Check warning on line 46 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
Expand All @@ -55,7 +55,7 @@
</dependency>

<!-- Testcontainers -->
<dependency>

Check warning on line 58 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-compress:1.24.0 * [CVE-2024-25710](https://www.mend.io/vulnerability-database/CVE-2024-25710?utm_source=JetBrains) 8.1 Loop with Unreachable Exit Condition ('Infinite Loop') * [CVE-2024-26308](https://www.mend.io/vulnerability-database/CVE-2024-26308?utm_source=JetBrains) 5.5 Allocation of Resources Without Limits or Throttling Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 58 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-compress:1.24.0 * [CVE-2024-25710](https://www.mend.io/vulnerability-database/CVE-2024-25710?utm_source=JetBrains) 8.1 Loop with Unreachable Exit Condition ('Infinite Loop') * [CVE-2024-26308](https://www.mend.io/vulnerability-database/CVE-2024-26308?utm_source=JetBrains) 5.5 Allocation of Resources Without Limits or Throttling Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers</artifactId>
<scope>test</scope>
Expand Down Expand Up @@ -84,7 +84,7 @@
<artifactId>junit-jupiter</artifactId>
<scope>test</scope>
</dependency>
<dependency>

Check warning on line 87 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Dependency maven:org.assertj:assertj-core:3.25.3 is vulnerable , safe version 3.27.7 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 87 in bottin-tests/bottin-it/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Dependency maven:org.assertj:assertj-core:3.25.3 is vulnerable , safe version 3.27.7 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<scope>test</scope>
Expand Down
2 changes: 1 addition & 1 deletion bottin-tests/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-tests</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion bottin-verification/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin</artifactId>
<version>0.1.0</version>
<version>0.2.0</version>
</parent>

<artifactId>bottin-verification</artifactId>
Expand All @@ -17,17 +17,17 @@

<dependencies>
<!-- Internal modules -->
<dependency>

Check notice on line 20 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 20 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.17.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-core</artifactId>
</dependency>
<dependency>

Check notice on line 24 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-beans:6.2.1 * [CVE-2025-41242](https://www.mend.io/vulnerability-database/CVE-2025-41242?utm_source=JetBrains) 5.9 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 24 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-core:6.2.1 * [CVE-2025-41249](https://www.mend.io/vulnerability-database/CVE-2025-41249?utm_source=Jetbrains) 7.5 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 24 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-context:6.2.1 * [CVE-2025-22233](https://www.mend.io/vulnerability-database/CVE-2025-22233?utm_source=Jetbrains) 3.1 Spring Framework DataBinder Case Sensitive Match Exception Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>xyz.tcheeric</groupId>
<artifactId>bottin-persistence</artifactId>
</dependency>

<!-- Spring Boot -->
<dependency>

Check notice on line 30 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 30 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 30 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 30 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-core:1.5.12 * [CVE-2025-11226](https://www.mend.io/vulnerability-database/CVE-2025-11226?utm_source=JetBrains) 6.9 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability * [CVE-2026-1225](https://www.mend.io/vulnerability-database/CVE-2026-1225?utm_source=Jetbrains) 5.0 Malicious logback.xml configuration file allows instantiation of arbitrary classes * [GHSA-qqpg-mvqg-649v](https://www.mend.io/vulnerability-database/GHSA-qqpg-mvqg-649v?utm_source=Jetbrains) 5.0 Insufficient Information * [CVE-2024-12801](https://www.mend.io/vulnerability-database/CVE-2024-12801?utm_source=JetBrains) 4.4 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 30 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework.boot:spring-boot:3.4.1 * [CVE-2025-22235](https://www.mend.io/vulnerability-database/CVE-2025-22235?utm_source=Jetbrains) 7.3 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 30 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:ch.qos.logback:logback-classic:1.4.14 * [CVE-2024-12798](https://www.mend.io/vulnerability-database/CVE-2024-12798?utm_source=JetBrains) 6.6 JaninoEventEvaluator vulnerability Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
</dependency>
Expand All @@ -43,7 +43,7 @@
</dependency>

<!-- HTTP client for well-known verification -->
<dependency>

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http2:4.1.116.Final * [CVE-2025-55163](https://www.mend.io/vulnerability-database/CVE-2025-55163?utm_source=Jetbrains) 7.5 Netty MadeYouReset HTTP/2 DDoS Vulnerability * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec-http:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack * [CVE-2025-58056](https://www.mend.io/vulnerability-database/CVE-2025-58056?utm_source=Jetbrains) 7.5 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions * [CVE-2025-67735](https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains) 6.5 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-common:4.1.116.Final * [CVE-2025-25193](https://www.mend.io/vulnerability-database/CVE-2025-25193?utm_source=JetBrains) 5.5 Denial of Service attack on windows app using Netty Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.116.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.116.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.springframework:spring-web:6.2.1 * [CVE-2025-41234](https://www.mend.io/vulnerability-database/CVE-2025-41234?utm_source=Jetbrains) 6.5 RFD Attack via "Content-Disposition" Header Sourced from Request Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check notice on line 46 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:io.projectreactor.netty:reactor-netty-http:1.2.1 * [CVE-2025-22227](https://www.mend.io/vulnerability-database/CVE-2025-22227?utm_source=Jetbrains) 6.1 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
</dependency>
Expand Down Expand Up @@ -78,7 +78,7 @@
</dependency>

<!-- Testing -->
<dependency>

Check warning on line 81 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 81 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 81 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:net.minidev:json-smart:2.5.1 * [CVE-2024-57699](https://www.mend.io/vulnerability-database/CVE-2024-57699?utm_source=JetBrains) 7.5 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Check warning on line 81 in bottin-verification/pom.xml

View workflow job for this annotation

GitHub Actions / Qodana for JVM

Vulnerable declared dependency

Provides transitive vulnerable dependency maven:org.assertj:assertj-core:3.25.3 * [CVE-2026-24400](https://www.mend.io/vulnerability-database/CVE-2026-24400?utm_source=Jetbrains) 7.3 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
Expand Down
Loading
Loading