security: remediate dependency CVEs, image packages, SQLi, CI token scope

[lekhrocks]

Summary

Remediation of every reported security finding: dependency CVEs, container-image packages, npm advisories, SQL injection, and CI token scoping.

Dependency CVEs (Gradle)

• plexus-utils 3.5.1 → 3.6.1 — CVE-2025-67030 (directory traversal in extractFile), via Debezium → maven-artifact.
• lz4-java 1.10.1 → 1.11.1 — CVE-2026-59949 (native XXHash can crash the JVM), via Kafka clients.
• jackson-databind → 2.21.5 — GHSA-mhm7-754m-9p8w (@JsonView bypass). Fixed by re-importing jackson-bom:2.21.5 after Spring Boot's BOM (which pins vulnerable 2.21.4); the BOM constraint beats resolutionStrategy.
• commons-lang3 → 3.18.0 — CVE-2025-48924 (uncontrolled recursion). Added as a direct dependency because Spring Boot 3.5.16's BOM pins vulnerable 3.17.0 and overrides force/eachDependency.

Docker image

• apk --no-cache upgrade in the runtime stage — fixes p11-kit-trust CVE-2026-2100 and libexpat CVE-2026-56408/CVE-2026-56412, and future-proofs against the same class of Alpine-package CVE.

npm

• website: js-yaml → 4.3.1, uuid → 11.1.1, postcss → 8.5.23 overrides. npm audit → 0 vulnerabilities.
• ui: dompurify → 3.4.13 (CVE-2026-65914 + two newer DOMPurify advisories).

SQL injection

• Identifier guards ([A-Za-z_][A-Za-z0-9_$]*) on schema/table reaching JDBC metadata — at the MetadataDiscoveryService service boundary (all API/controller/AI/pipeline callers) and again at the AbstractJdbcMetadataConnector SPI boundary (any direct connector user). Rejects quotes, separators, whitespace, empty, leading digits.

CI security

• Least-privilege GITHUB_TOKEN: workflow-level contents: read default + explicit permissions on all 13 jobs. docker-build escalates to packages: write (ghcr push); security-scan to security-events: write (SARIF). No job inherits write-all.

Verification

• gradlew :syncflow-api:dependencies confirms the forced versions resolve.
• compileJava for api/connectors/common clean (only pre-existing MapStruct tenantId warning).
• npm audit 0 vulns (website); UI build + tsc -b pass.
• Image runtime layer verified: p11-kit-trust 0.26.2-r0, libexpat 2.8.2-r0.
• Workflow YAML parses; every job has an explicit permissions block.

Follow-up

• The hardened image must be rebuilt and re-pushed to clear the stale lekhrocks/syncflow:1 scan (Dockerfile fix is in but not yet deployed).