fix(deps): patch CRITICAL/HIGH transitive CVEs on shared base (trivy-fs)

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "maven"
+    directory: "/"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities through GitHub private vulnerability
+reporting:
+
+https://github.com/ContextualWisdomLab/clearfolio/security/advisories/new
+
+Do not report security vulnerabilities through public GitHub issues.
+
+Include the affected version or commit, impact, reproduction steps, and any
+relevant logs or proof of concept. We aim to acknowledge reports within 7 days
+and provide remediation status updates within 30 days.

pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>3.5.0</version>
+    <version>3.5.14</version>
     <relativePath/>
   </parent>
 
@@ -24,6 +24,10 @@
     <argLine></argLine>
     <pdfbox.version>3.0.3</pdfbox.version>
     <pdfjs.dist.version>4.10.38</pdfjs.dist.version>
+    <!-- Security overrides: pin transitive deps to CVE-fixed versions (managed by Spring Boot BOM) -->
+    <netty.version>4.1.135.Final</netty.version>
+    <jackson-bom.version>2.21.5</jackson-bom.version>
+    <spring-framework.version>6.2.18</spring-framework.version>
   </properties>
 
   <dependencies>
@@ -37,12 +41,6 @@
       <artifactId>spring-boot-starter-validation</artifactId>
     </dependency>
 
-    <dependency>
-      <groupId>org.apache.tika</groupId>
-      <artifactId>tika-parsers-standard-package</artifactId>
-      <version>3.2.2</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.pdfbox</groupId>
       <artifactId>pdfbox</artifactId>
@@ -58,6 +56,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
+      <version>${jackson-bom.version}</version>
     </dependency>
 
     <dependency>