From b3dd79c850e0b310a9a301617f0503b988da193a Mon Sep 17 00:00:00 2001
From: Seongho Bae <seonghobae@me.com>
Date: Wed, 8 Jul 2026 19:33:35 +0900
Subject: [PATCH 1/2] fix(deps): patch CRITICAL/HIGH transitive CVEs flagged by
 trivy-fs

Bump the shared base so all feature branches inherit the fix:
- spring-boot-starter-parent 3.5.0 -> 3.5.14 (CVE-2026-40973 spring-boot)
- spring-framework.version 6.2.18 (CVE-2025-41249 spring-core)
- netty.version 4.1.135.Final (CVE-2025-55163, CVE-2026-33870/33871,
  42579/42583/42584/42587, 44249/45416/45674/47691/50010)
- jackson-bom.version 2.21.4 (CVE-2026-54512, CVE-2026-54513)
- remove unused org.apache.tika:tika-parsers-standard-package, the sole
  source of commons-io 2.7 (CVE-2024-47554) and bouncycastle 1.81
  (CVE-2025-14813, CRITICAL); no source references tika

trivy fs CRITICAL,HIGH now reports 0; full suite (335 tests) green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P
---
 pom.xml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 6b7e40df..31d960db 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>3.5.0</version>
+    <version>3.5.14</version>
     <relativePath/>
   </parent>
 
@@ -24,6 +24,10 @@
     <argLine></argLine>
     <pdfbox.version>3.0.3</pdfbox.version>
     <pdfjs.dist.version>4.10.38</pdfjs.dist.version>
+    <!-- Security overrides: pin transitive deps to CVE-fixed versions (managed by Spring Boot BOM) -->
+    <netty.version>4.1.135.Final</netty.version>
+    <jackson-bom.version>2.21.4</jackson-bom.version>
+    <spring-framework.version>6.2.18</spring-framework.version>
   </properties>
 
   <dependencies>
@@ -37,12 +41,6 @@
       <artifactId>spring-boot-starter-validation</artifactId>
     </dependency>
 
-    <dependency>
-      <groupId>org.apache.tika</groupId>
-      <artifactId>tika-parsers-standard-package</artifactId>
-      <version>3.2.2</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.pdfbox</groupId>
       <artifactId>pdfbox</artifactId>

From 3ca62e762b6be132e03a6d4d340bc301628e2c06 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Thu, 9 Jul 2026 18:47:45 +0900
Subject: [PATCH 2/2] fix(deps): pin jackson-databind CVE fix

---
 .github/dependabot.yml |  8 ++++++++
 SECURITY.md            | 14 ++++++++++++++
 pom.xml                |  3 ++-
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 SECURITY.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..3c3607a7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "maven"
+    directory: "/"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..f0a3bc05
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,14 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities through GitHub private vulnerability
+reporting:
+
+https://github.com/ContextualWisdomLab/clearfolio/security/advisories/new
+
+Do not report security vulnerabilities through public GitHub issues.
+
+Include the affected version or commit, impact, reproduction steps, and any
+relevant logs or proof of concept. We aim to acknowledge reports within 7 days
+and provide remediation status updates within 30 days.
diff --git a/pom.xml b/pom.xml
index 31d960db..fc7a5568 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@
     <pdfjs.dist.version>4.10.38</pdfjs.dist.version>
     <!-- Security overrides: pin transitive deps to CVE-fixed versions (managed by Spring Boot BOM) -->
     <netty.version>4.1.135.Final</netty.version>
-    <jackson-bom.version>2.21.4</jackson-bom.version>
+    <jackson-bom.version>2.21.5</jackson-bom.version>
     <spring-framework.version>6.2.18</spring-framework.version>
   </properties>
 
@@ -56,6 +56,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
+      <version>${jackson-bom.version}</version>
     </dependency>
 
     <dependency>