Skip to content

chore: add SBOM notes for highcharts 9.2.2 (CP: 24.10) - #9767

Merged
ZheSun88 merged 1 commit into
update-flow-24.10.17-1793357076from
chore/sbom-notes-highcharts-24.10
Oct 30, 2026
Merged

chore: add SBOM notes for highcharts 9.2.2 (CP: 24.10)#9767
ZheSun88 merged 1 commit into
update-flow-24.10.17-1793357076from
chore/sbom-notes-highcharts-24.10

Conversation

@totally-not-ai

@totally-not-ai totally-not-ai Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review risk: two-way door — only changes the SBOM check's CVE notes for the 24.10 branch; no product code.

Summary

Ports the SBOM notes from #9742 to 24.10. Vaadin 24.10 ships Highcharts 9.2.2 (not 12.2.0), so the Highcharts note is adapted rather than cherry-picked.

What changed

Test summary

  • Script parses with Node; CVE lists match the scanner output for this branch exactly (the check requires an exact match).
  • SBOM workflow on this PR will confirm.

Working on behalf of @ZheSun88

@totally-not-ai
chore: add SBOM notes for highcharts 9.2.2 (CP: 24.10)
77f72df 
Port of the notes from #9742 to 24.10. Highcharts 9.2.2 is only flagged
for CVE-2026-118250 and CVE-2026-118251, both fixed in Vaadin Charts by
vaadin/web-components#12887 without bumping the bundled version
(announced as CVE-2026-107588).

Also carries the opentelemetry-api (CVE-2026-118259), picomatch 4.0.7
and lerc 3.0.0 notes, which this branch reports as well.
@totally-not-ai
totally-not-ai Bot requested a review from ZheSun88 October 30, 2026 10:14
@github-actions

github-actions Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependencies Report

  • 🚫 Vulnerabilities:

  • 🟠 Known Vulnerabilities:

    • Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-api@1.62.0 [CVE-2026-118259, CVE-2026-54285] (osv-bomber,osv-scan,owasp)
      👌 False positive: the advisory is for opentelemetry-js (@opentelemetry/core) and the CPE that matched targets node.js, not the Java artifact. CVE-2026-118259 (GHSA-ccrj-gw8r-854m, fixed in 1.67.0) is a ReDoS in W3CTraceContextPropagator.extract() parsing inbound tracestate headers. Not affected: the artifact reaches the sbom only through selenium-remote-driver under vaadin-testbench, a test only dependency acting as an http client, so untrusted inbound headers are never extracted. Upgrade once selenium ships 1.67.0+.
      ·
      · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
    • Vulnerabilities in: pkg:npm/%40opentelemetry/core@1.9.0 [CVE-2026-54285] (osv-bomber,oss-bomber,osv-scan)
      👌 Not affected: @opentelemetry/core is a transitive dep of the browser Web SDK and is used only to ORIGINATE spans. The vulnerable W3CBaggagePropagator.extract() (inbound untrusted baggage parsing) is never on the execution path. vulnerable_code_not_in_execute_path.
      ·
    • Vulnerabilities in: pkg:npm/highcharts@9.2.2 [CVE-2026-118251, CVE-2026-118250] (osv-bomber,oss-bomber,osv-scan)
      👌 Fixed in Vaadin Charts without bumping the bundled Highcharts (announced as CVE-2026-107588): fix: skip unsupported values in chart options web-components#12887 ignores reserved segments in series.keys and point option names (CVE-2026-118250) and credits links without a supported URL scheme (CVE-2026-118251). The other Highcharts CVEs of the same disclosure do not affect 9.2.2. Scanners keep flagging 9.2.2 by version only; Vaadin 24.10 keeps Highcharts 9.x, the upgrade to 12.x happened in Vaadin 25.
      ·
    • Vulnerabilities in: pkg:npm/picomatch@4.0.7 [CVE-2026-112366] (oss-bomber)
      👌 Build-time only: picomatch is pulled in by vite, rolldown and vite-plugin-checker and is not shipped in production bundles. The ReDoS requires an attacker supplied extglob pattern such as +(*), while the globs come from the developer's own build configuration. No fixed version is published on npm yet (4.0.7 is latest); upgrade once available.
      ·
    • Vulnerabilities in: pkg:npm/lerc@3.0.0 [CVE-2026-10758] (oss-bomber)
      👌 Not affected: lerc arrives through ol -> geotiff and is only used to decode LERC compressed GeoTIFF imagery. Vaadin Map does not expose a GeoTIFF source, so the decoder is never on the execution path; worst case impact would be a crashed browser tab. vulnerable_code_not_in_execute_path.
      ·
    • Vulnerabilities in: pkg:npm/%40opentelemetry/core@1.8.0 [CVE-2026-54285] (osv-scan)
      👌 Not affected: @opentelemetry/core is a transitive dep of the browser Web SDK and is used only to ORIGINATE spans. The vulnerable W3CBaggagePropagator.extract() (inbound untrusted baggage parsing) is never on the execution path. vulnerable_code_not_in_execute_path.
      ·
    • Vulnerabilities in: pkg:maven/me.friwi/jcef-api@jcef-ca49ada%2Bcef-135.0.20%2Bge7de5c3%2Bchromium-135.0.7049.85 [CVE-2024-21639, CVE-2024-21640, CVE-2024-9410] (owasp)
      👌 Wait for the update from the jcefmaven community. Meanwhile the swing-kit is supposed to be used with fixed websites and not to browse the internet, we have a check for that, so the only possible attacker would be the same person that created the swing application, aka our customer devs. so this vulnerability is not classified by us as critical issue
      · cpe:2.3:a:chromiumembedded:chromium_embedded_framework::::::::
      · cpe:2.3:a:ada:ada::::::::
    • Vulnerabilities in: pkg:maven/org.jetbrains.kotlin/kotlin-stdlib@2.3.0 [CVE-2026-53914] (owasp)
      👌 False positive: CVE-2026-53914 only affects org.jetbrains.kotlin:kotlin-gradle-plugin (unsafe deserialization in the Kotlin build cache); the CPE for the kotlin product matches every kotlin artifact.
      · cpe:2.3:a:jetbrains:kotlin::::::::
    • Vulnerabilities in: pkg:maven/org.jetbrains.kotlin/kotlin-stdlib-common@1.9.0 [CVE-2026-53914, CVE-2020-29582] (owasp)
      👌 The impact of this vulnerability is low, instead of taking the risk to break V24 with upgrading kotlin to 2.x, we focus on to not use deprecated API, to not use sensitive data in tests and to clean up the temp folders. CVE-2026-53914 only affects org.jetbrains.kotlin:kotlin-gradle-plugin (unsafe deserialization in the Kotlin build cache); the CPE for the kotlin product matches every kotlin artifact.
      · cpe:2.3:a:jetbrains:kotlin::::::::
      · cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:::::::*
      · cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*
      · cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:::::::*
    • Vulnerabilities in: pkg:maven/org.jetbrains.kotlin/kotlin-stdlib-jdk7@1.6.20 [CVE-2026-53914, CVE-2020-29582] (owasp)
      👌 The impact of this vulnerability is low, instead of taking the risk to break V24 with upgrading kotlin to 2.x, we focus on to not use deprecated API, to not use sensitive data in tests and to clean up the temp folders. CVE-2026-53914 only affects org.jetbrains.kotlin:kotlin-gradle-plugin (unsafe deserialization in the Kotlin build cache); the CPE for the kotlin product matches every kotlin artifact.
      · cpe:2.3:a:jetbrains:kotlin::::::::
      · cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:::::::*
      · cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*
      · cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:::::::*
    • Vulnerabilities in: pkg:maven/org.apache.logging.log4j/log4j-to-slf4j@2.24.3 [CVE-2026-34479, CVE-2026-34477, CVE-2026-49844] (owasp)
      👌 False positive: CVE-2026-34477 affects log4j-core (TLS verifyHostName), CVE-2026-34479 affects log4j-1.2-api (Log4j1XmlLayout) and CVE-2026-49844 affects log4j-api (MapMessage JSON serialization). log4j-to-slf4j is only the Log4j API to SLF4J bridge and contains none of that code; osv.dev reports no vulnerabilities for it.
      · cpe:2.3:a:apache:log4j::::::::
      · cpe:2.3:a:apache:log4j:3.0.0:alpha1::::::
      · cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1::::::
      · cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2::::::
      · cpe:2.3:a:apache:log4j:3.0.0:beta1::::::
      · cpe:2.3:a:apache:log4j:3.0.0:beta2::::::
      · cpe:2.3:a:apache:log4j:3.0.0:beta3::::::
      · cpe:2.3:a:apache:log4j:2.26.0:::::::*
    • Vulnerabilities in: pkg:javascript/quill@1.3.7 [CVE-2021-3163] (owasp)
      👌 Disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser
      · cpe:2.3:a:slab:quill:4.8.0:::::node.js::
    • Vulnerabilities in: pkg:maven/com.vaadin/vaadin-swing-kit-flow@2.4.2 [CVE-2021-33604] (owasp)
      👌 false report: this CVE is targeting Vaadin version prior 20, swing-kit-flow is using vaadin 24+ version, the related issue has been fixed.
      · cpe:2.3:a:vaadin:flow-server::::::::
      · cpe:2.3:a:vaadin:vaadin::::::::

  • 📔 Found Core License Issues:

    • Invalid license 'https://vaadin.com/commercial-license-and-service-terms' in: pkg:maven/com.vaadin/flow-lit-template@24.10.16 and pkg:maven/com.vaadin/flow-react@24.10.16 and pkg:maven/com.vaadin/flow-push@24.10.16 and pkg:maven/com.vaadin/flow-client@24.10.16 and pkg:maven/com.vaadin/flow-html-components@24.10.16 and pkg:maven/com.vaadin/flow-data@24.10.16 and pkg:maven/com.vaadin/flow-dnd@24.10.16 and pkg:maven/com.vaadin/vaadin-dev-server@24.10.16 and pkg:maven/com.vaadin/vaadin-spring@24.10.16 and pkg:maven/com.vaadin/flow-webpush@24.10.16 and pkg:maven/com.vaadin/flow-server@24.10.16 and pkg:maven/com.vaadin/signals@24.10.16

  • 📔 No License Issues

  • 🟠 Changes in 24.10-SNAPSHOT since V24.10.13

    • 87 packages modified (14 external, 73 vaadin)
    • 638 packages same (475 external, 163 vaadin)

[Click for more Details]

@ZheSun88
ZheSun88 changed the base branch from 24.10 to update-flow-24.10.17-1793357076 October 30, 2026 11:04
@ZheSun88
ZheSun88 marked this pull request as ready for review October 30, 2026 11:04
@ZheSun88
ZheSun88 merged commit 7bddce3 into update-flow-24.10.17-1793357076 Oct 30, 2026
3 of 6 checks passed
@ZheSun88
ZheSun88 deleted the chore/sbom-notes-highcharts-24.10 branch October 30, 2026 11:04
ZheSun88 added a commit that referenced this pull request Oct 30, 2026
@vaadin-bot @github-actions
@totally-not-ai @ZheSun88
Update flow to 24.10.17 (#9773)
af83d51 
* Update flow to 24.10.17

* chore: maintenance version bumps [24.10] (2026-10-30) (#9765)

Automated maintenance-version updates against `24.10`, discovered by `scripts/check-versions`.

## Updates

- `vaadin/vaadin-testbench`: javaVersion `9.6.4` → `9.6.5`

_Generated by `scripts/check-versions/src/index.ts`._

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore: add SBOM notes for highcharts 9.2.2 (CP: 24.10) (#9767)

Port of the notes from #9742 to 24.10. Highcharts 9.2.2 is only flagged
for CVE-2026-118250 and CVE-2026-118251, both fixed in Vaadin Charts by
vaadin/web-components#12887 without bumping the bundled version
(announced as CVE-2026-107588).

Also carries the opentelemetry-api (CVE-2026-118259), picomatch 4.0.7
and lerc 3.0.0 notes, which this branch reports as well.

Co-authored-by: totally-not-ai[bot] <290682512+totally-not-ai[bot]@users.noreply.github.com>

* Update copilot javaVersion to 24.10-SNAPSHOT

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: totally-not-ai[bot] <290682512+totally-not-ai[bot]@users.noreply.github.com>
Co-authored-by: Zhe Sun <31067185+ZheSun88@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ZheSun88 ZheSun88 Awaiting requested review from ZheSun88

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ZheSun88