fix: remediate server and plugin jar CVEs from docker scout scan by subrata71 · Pull Request #42074 · appsmithorg/appsmith

subrata71 · 2026-07-31T18:02:57Z

/ok-to-test tags="@tag.All"

Linear: https://linear.app/appsmith/issue/APP-15743

Why

docker scout cves --only-fixed on the shipped release image reports 176 fixable vulnerabilities across 70 packages. 52 of them live in server.jar and the plugin jars, and are controlled from app/server/pom.xml. This clears 40 of those (9 high, 26 medium, 5 low).

This is the direct successor to #41928 (bump Spring Boot to 3.5.14 and Netty to 4.1.135) and #41947 (batch security update — 17 CVEs from release image scan).

What changed

Property	From	To
`spring-boot-starter-parent`	`3.5.14`	`3.5.16`
`netty.version`	`4.1.135.Final`	`4.1.136.Final`
`jackson-bom.version`	`2.18.8`	`2.18.9`
`commons-lang3.version`	(BOM default 3.17.0)	`3.18.0`
`httpclient` (dependencyManagement)	(transitive 4.5.9)	`4.5.14`

Two worth explaining:

jackson stays on the 2.18.x line. Spring Boot 3.5.x manages jackson at 2.21.x; the existing 2.18.8 entry is a deliberate pin downward for CVE-2026-54512 / CVE-2026-54513. Moving to 2.18.9 respects that intent while picking up CVE-2026-59889, CVE-2026-54515 and GHSA-mhm7-754m-9p8w. It also drags the plugin jars up from 2.16.0.
commons-lang3 needed a property, not a dependency. appsmith-interfaces already declares 3.18.0 directly, but the Spring Boot BOM manages it to 3.17.0 and that is what was landing in server.jar.

The unreferenced jackson.version property is removed — Spring Boot imports jackson-bom.version only, and ${jackson.version} is not expanded anywhere in the repo. Removing it moves no resolved version.

Verification

mvn dependency:tree across appsmith-server and the plugin modules confirms every pin resolves as intended:

com.fasterxml.jackson.core:jackson-databind    2.18.9
io.netty:netty-codec-http                      4.1.136.Final
io.netty:netty-common                          4.1.136.Final
org.apache.commons:commons-lang3               3.18.0
org.apache.httpcomponents:httpclient           4.5.14
ch.qos.logback:logback-core                    1.5.34
org.springframework:spring-webflux             6.2.19
org.springframework.security:spring-security-web  6.5.11
com.google.guava:guava                         32.0.1-jre

Full reactor compiles clean; mvn spotless:check passes. Validated on the EE side first in appsmith-ee#9405, where the full Cypress suite is green.

What is deliberately NOT here

Finding	Why not
`vertx-core` 4.5.21 (2 medium)	Part of a 4.5.21 family; pinning one artifact risks version skew. Needs the family moved together.
`log4j-core` 2.20.0 (3 medium), `nimbus-jose-jwt` 9.37.2 (1 medium)	Shaded inside a vendor uber-jar — absent from the resolved tree, so no `dependencyManagement` pin reaches them. Needs a `databricks-sdk-java` upgrade.
`bcpkix-jdk15on` 1.70 (2 medium)	Transitive from `sshj 0.35.0`; the `jdk15on` line ended at 1.70 and sshj 0.37+ moves to `bcpkix-jdk18on`. That is the SSH library behind git deploy keys — deserves its own PR.
`logback`	Boot 3.5.16 brings 1.5.34, which is already outside the affected range (`<1.5.34`) for both logback advisories. No pin needed.

Known false positives

com.appsmith/server and com.appsmith/interfaces (3 high) — the jars are versioned 1.0-SNAPSHOT, which sorts below the advisories' 1.99/2.0 fixed versions, so they are flagged permanently. GHSA-j9gf-vw2f-9hrw is already fixed (fix(security): fail closed when APPSMITH_BASE_URL unset for token-bearing emails (GHSA-j9gf-vw2f-9hrw) #41766).
mssql-jdbc CVE-2025-59250 (1 high) — affected range is >=11.2.0.jre11, <11.2.4.jre11 and mssqlPlugin declares exactly 11.2.4.jre11. Scout normalises the classifier away and compares 11.2.4 < 11.2.4.jre11.

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/30653707840
Commit: 68f0af9
Cypress dashboard.
Tags: @tag.All
Spec:

Fri, 31 Jul 2026 21:13:48 UTC

Summary by CodeRabbit

Maintenance
- Updated underlying application components and libraries to newer versions.
- Added dependency management improvements for improved compatibility and security.
- No user-facing features or behavior changes were introduced.

… scan CE share of a docker scout sweep of the shipped image, covering the findings that live in server.jar and the plugin jars. - netty 4.1.135 -> 4.1.136.Final - jackson 2.18.8 -> 2.18.9, staying on the 2.18.x line the existing pin deliberately holds; this also drags the plugin jars up from 2.16.0 - Spring Boot 3.5.14 -> 3.5.16, which brings spring-framework 6.2.19 and spring-security-web 6.5.11 - commons-lang3 and logback pinned above the Spring Boot BOM defaults. appsmith-interfaces already asked for commons-lang3 3.18.0, but the BOM-managed 3.17.0 is what was landing in server.jar - httpclient pinned to 4.5.14; awssdk apache-client 2.15.3 pulls 4.5.9 Verified with mvn dependency:tree that every pin resolves as intended in both appsmith-server and the plugin modules, and that the full reactor compiles against the new versions.

…erty Mirrors the EE correction so the shared pom blocks stay byte-identical. The logback pin was unnecessary: Scout reports "Fixed version: 1.5.35" for CVE-2026-10532, but its own affected range is <1.5.34 and OSV agrees the fix landed in 1.5.34, which Spring Boot 3.5.16 already brings. jackson.version is unreferenced — Spring Boot imports jackson-bom.version only, and nothing expands ${jackson.version}. Jackson still resolves to 2.18.9.

linear-code · 2026-07-31T18:03:01Z

APP-15743

coderabbitai · 2026-07-31T18:03:06Z

Walkthrough

The server POM updates Spring Boot, Jackson, Netty, and Commons Lang versions. It removes the explicit Jackson version property and adds dependency management for Apache HttpClient 4.5.14.

Changes

Server dependency updates

Layer / File(s)	Summary
Dependency version management `app/server/pom.xml`	Spring Boot, Jackson BOM, Netty, and Commons Lang versions are updated. The explicit `jackson.version` property is removed. Apache HttpClient 4.5.14 is added to dependency management.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

appsmithorg/appsmith-ee#9403 — Both changes update dependency versions and properties in app/server/pom.xml.
appsmithorg/appsmith-ee#9402 — Both changes update server dependencies for vulnerability remediation.

Possibly related PRs

appsmithorg/appsmith#41928 — Both PRs update Spring Boot and Netty versions in app/server/pom.xml.
appsmithorg/appsmith#41947 — Both PRs update Spring Boot, Jackson, and Netty dependency versions.
appsmithorg/appsmith#41999 — Both PRs update centrally managed Netty dependencies.

Suggested reviewers: sondermanish, sebastianiv21

Poem

Spring rises, Jackson flows,
Netty gets a newer glow.
Commons Lang joins the train,
HttpClient takes its place again.
One server POM, versions aligned.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: remediating server and plugin JAR CVEs identified by Docker Scout.
Description check	✅ Passed	The description provides motivation, issue context, dependency changes, verification results, exclusions, and test results, but omits the required Communication section.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/app-15743

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

🧹 Nitpick comments (1)

app/server/pom.xml (1)
10-10: 🔒 Security & Privacy | 🔵 Trivial

Confirm support coverage for Spring Boot 3.5.16.

Spring Boot 3.5.16, released June 25, 2026, is the last OSS release of the 3.5.x generation. If this project does not have commercial support, plan migration to Spring Boot 4.0.x or 4.1.x. (spring.io)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/server/pom.xml` at line 10, Review the Spring Boot version configured in
the pom and confirm whether the project has coverage for Spring Boot 3.5.16. If
commercial support is unavailable, plan and apply migration to a supported
Spring Boot 4.0.x or 4.1.x version, updating related dependency configuration as
needed.
Source: MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@app/server/pom.xml`:
- Line 10: Review the Spring Boot version configured in the pom and confirm
whether the project has coverage for Spring Boot 3.5.16. If commercial support
is unavailable, plan and apply migration to a supported Spring Boot 4.0.x or
4.1.x version, updating related dependency configuration as needed.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6d3cff38-aaf8-48f3-918c-4ab6808a4191

📥 Commits

Reviewing files that changed from the base of the PR and between da2e280 and 68f0af9.

📒 Files selected for processing (1)

app/server/pom.xml

salevine

Approved

subrata71 · 2026-08-01T18:45:49Z

/build-deploy-preview skip-tests=true

github-actions · 2026-08-01T18:46:20Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/30713275048.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 42074.
recreate: .
base-image-tag: .

github-actions · 2026-08-01T18:51:26Z

Deploy-Preview-URL: https://ce-42074.dp.appsmith.com

subrata71 added 2 commits July 31, 2026 14:44

subrata71 added the ok-to-test Required label for CI label Jul 31, 2026

subrata71 marked this pull request as ready for review July 31, 2026 18:16

subrata71 requested a review from a team as a code owner July 31, 2026 18:16

subrata71 self-assigned this Jul 31, 2026

coderabbitai Bot reviewed Jul 31, 2026

View reviewed changes

salevine approved these changes Jul 31, 2026

View reviewed changes

subrata71 changed the title ~~fix(security): remediate server and plugin jar CVEs from docker scout scan~~ fix: remediate server and plugin jar CVEs from docker scout scan Aug 1, 2026

github-actions Bot added the Bug Something isn't working label Aug 1, 2026

subrata71 merged commit 5994e9a into release Aug 1, 2026
157 of 161 checks passed

subrata71 deleted the fix/app-15743 branch August 1, 2026 19:09

appsmith-smithes Bot mentioned this pull request Aug 7, 2026

chore(release): promote release to master #42101

Merged

2 tasks

Navigation Menu

Uh oh!

fix: remediate server and plugin jar CVEs from docker scout scan - #42074

fix: remediate server and plugin jar CVEs from docker scout scan#42074
subrata71 merged 2 commits into
releasefrom
fix/app-15743

subrata71 commented Jul 31, 2026 •

edited by github-actions Bot

Loading

Uh oh!

linear-code Bot commented Jul 31, 2026

Uh oh!

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

salevine left a comment

Uh oh!

subrata71 commented Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

subrata71 commented Jul 31, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Verification

What is deliberately NOT here

Known false positives

Summary by CodeRabbit

Uh oh!

linear-code Bot commented Jul 31, 2026

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

salevine left a comment

Choose a reason for hiding this comment

Uh oh!

subrata71 commented Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

subrata71 commented Jul 31, 2026 •

edited by github-actions Bot

Loading

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading