Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vaadin/platform

              main @ 7a3ee5f
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Dependency Vulnerability Remediation: 4 prior fixes. Scrutinize any change in this area.

vaadin-testbench/pom.xml: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Dependency Vulnerability Remediation: Spring Boot 4.1.0 and associated spring-context, micrometer, and tomcat versions carried known vulnerabilities; upgrade to 4.1.1 and pinned versions in the BOM was required.

Dependency Vulnerability Remediation: Netty 4.1.114 was vulnerable (GHSA-xq3w-v528-46rv); the fix excluded it from copilot and pinned 4.1.115.Final across multiple netty modules.

Dependency Vulnerability Remediation: Netty transport 4.1.87.Final was vulnerable; upgraded to 4.1.94.Final, affecting transport, codec, and handler modules. a second testbench fix upgraded Guava from 31.1-jre to 32.0.1-jre and removed a CVE whlist.