-
[OPIK-6623] fix(security): bump Corretto + netty + jetty + httpclient5 for HIGH CVEs (#6796)
frostbyte_neo 发布于
2026-05-20 15:44:20 +00:00 Closes the HIGH-severity findings on opik-backend:2.0.39 identified by
the trivy scan of self-hosted v4.17.1. All bumps are patch-level within
their existing major versions — no framework migration needed.Dockerfile:
FROM amazoncorretto:21.0.10-al2023 -> 21.0.11-al2023 (Java 21 + AL2023
patch from 2026-05-09). Clears ~304 raw OS-package HIGH findings.pom.xml (apps/opik-backend):
netty-bom 4.2.6.Final -> 4.2.13.Final (closes 5 netty CVEs:
CVE-2026-33870, CVE-2026-33871,
CVE-2026-42579, CVE-2026-42583,
CVE-2026-42584, CVE-2026-42587)- jetty-bom 12.1.7 (closes CVE-2026-1605)
- jetty-ee10-bom 12.1.7 (closes CVE-2026-2332 -- same CVE
that requires Dropwizard 4->5
upgrade for comet-backend in
OPIK-6614; opik-backend already
on Dropwizard 5 so this is just
a Jetty patch override of the
transitive 12.1.1 from Dropwizard
5.0.0's BOM)
httpclient5 5.6 -> 5.6.1 (closes CVE-2026-40542)
The Jetty BOM imports explicitly override the version Dropwizard 5.0.0's
dropwizard-dependencies BOM pulls in (12.1.1). Maven BOM precedence:
versions declared in dependencyManagement win over BOM imports in the
same dependencyManagement block when the explicit version is closer to
the project.See OPIK-6623 for the full per-image CVE report.
Co-authored-by: Claude Opus 4.7 (1M context) noreply@anthropic.com
下载附件