[KFilippopolitis]

Summary

Closes the code-scanning findings that have a safe fix in this tree. Spring, Jackson, pgjdbc and dockerize alerts are left open on purpose: the runtime dependencies are already on the newest patched stable releases, and dockerize is no longer installed.

The first CI run of this branch failed the container CVSS gate on Alpine zlib (CVE-2026-4738). The base image ships 1.3.2-r1; this PR now installs Alpine 3.24 zlib=1.4-r0, which OSV reports as fixed.

GitHub code scanning list API returned 403 for this token, so alert numbers come from the 2026-11-09 triage. That triage names 41 of the 43 open alerts. The other two numbers are not in the triage and were not readable here.

Fixed

• 20 — .github/workflows/publish_images.yml had no permissions block. Workflow token is now contents: read (checkout and Docker build; images go to Docker Hub and Harbor, not GHCR). Same shape as publish_staging_images.yml.
• 233 — .github/workflows/ebrains.yml had no permissions block. Workflow token is now contents: read. The GitLab mirror uses the EBRAINS token in the destination URL, not a GitHub contents write.
• 416, 417 — cookie-issecure-false at SecurityConfiguration.java (JupyterHub logout cookies). setSecure is set when authentication.secure_cookies is true (default) and the request is HTTPS, including X-Forwarded-Proto. COOKIE_SECURE=false keeps clearing those cookies over plain HTTP. Portal JSESSIONID is unchanged, so local HTTP sign-in still works. OpenGrep cookie-issecure-false is clean. Logout tests cover HTTPS (Secure) and HTTP (not Secure).
• 176, 380, 381 — OpenGrep Dockerfile findings (dockerfile-source-not-pinned on both FROM lines, prefer-json-notation on the shell-form HEALTHCHECK). Base images are pinned to the multi-arch index digests, and the healthcheck is JSON sh -c with pipefail. OpenGrep on semgrep-rules/dockerfile @ 17e31e11 reports 0 findings.
• 383, 384, 385 — Hadolint findings (DL3018 unpinned apk add, DL3066 non-numeric USER, DL3025 shell-form healthcheck). Alpine 3.24 packages are pinned (libcrypto3/libssl3 3.5.9-r0, curl 8.23.0-r0, zlib 1.4-r0). 3.5.9-r0 is newer than 3.5.8-r0, which fixed CVE-2026-14456, CVE-2026-63073 and CVE-2026-75803. The process runs as uid 10001. Hadolint 2.15.1 exits 0. adduser -D -H -u 10001 was checked in an Alpine 3.24 rootfs.

Remaining

No dependency version in pom.xml was changed. mvn dependency:tree plus the OSV API on all 121 compile/runtime coordinates returned zero vulnerabilities. Spring Boot 4.2.0 and Spring Framework 7.1.0 are release candidates only (4.2.0-RC2 / 7.1.0-RC2, 2026-11-05). Jumping to an RC to chase an already-patched advisory is not safe.

• 229, 212, 211, 208, 206, 205 (high) and 217, 216, 215, 214, 213, 209 (medium) — Spring Framework / Spring Data Commons / Spring HATEOAS. The Boot 4.1.2 BOM resolves Framework 7.0.10, Spring Data 4.1.2, Security 7.1.2. Those are the newest stable releases. GitHub advisories for the 2026 Spring MVC issues (CVE-2026-47890 / GHSA-j9f9-w8pj-32f8, CVE-2026-47884 / GHSA-pc63-qcmh-9cmg) stop at 7.0.8. Spring Data 2026 advisories (including CVE-2026-41695 / GHSA-88fw-v6x4-3f58) stop at 4.0.5 on the 4.x line. Spring HATEOAS is not on the classpath; the latest stable is 3.1.3 (3.2.0 is RC1) and GHSA-439x-6767-44cv stops at 3.0.3. No newer stable patch exists.
• 166 — pgjdbc. Already 42.7.14, which is the latest release on Maven Central. CVE-2026-54291 is fixed in 42.7.12 and CVE-2026-42198 in 42.7.11. OSV reports 42.7.14 clean.
• 167 — jackson-databind. Already 2.22.4 and 3.2.4. CVE-2026-91777 / GHSA-cxp5-3px4-pw24 and CVE-2026-91776 / GHSA-wv8q-qhhj-9h54 affect 2.22.0–2.22.2 and 3.2.0–3.2.2, not these patch versions. 2.23.0 and 3.3.0 exist, but OSV reports the pinned versions clean, so a minor bump is not a fix for a current advisory.
• 230, 226, 221, 219, 218 (high) and 225, 224, 223, 222, 220, 168 (medium) — osv-scanner findings on platform-backend.jar. Same dependency set as above: OSV has no current advisory for any coordinate the jar resolves. The 2026-11-09 SCA run on master uploaded a clean gate (max CVSS under 5). Nothing further to override. These alerts were not dismissed.
• 144 (high, Go os.Root), 145 (medium, crypto/tls), 143, 159, 160, 161 (warning, other Go stdlib CVEs) — dockerize. Removed in 9ad0d992 (the image runs java -jar directly). Reinstalling jwilder/dockerize or powerman/dockerize would put a Go binary back into an image that does not use it. No patch in this PR can delete a file that is already gone. These alerts were not dismissed.

Tests

• mvn -B -ntp test — 167 tests, 0 failures
• mvn -B -ntp package — BUILD SUCCESS, 167 tests, 0 failures
• Hadolint 2.15.1 on Dockerfile — exit 0
• OpenGrep 1.33.1 with semgrep-rules/dockerfile @ 17e31e11 — 0 findings
• OpenGrep cookie-issecure-false — 0 findings
• OSV batch query of all 121 compile/runtime dependencies — 0 vulnerabilities
• OSV on every Alpine package in the pinned Corretto image — only zlib 1.3.2-r1 (CVE-2026-4738); 1.4-r0 is clean

pre-commit is not installed in this environment, so it was not run.

Risk

• Logout cookies for JupyterHub are Secure only on HTTPS. Local HTTP is unchanged unless an operator sets COOKIE_SECURE=false (needed only when the portal itself is plain HTTP and those hub cookies must still be cleared). forward-headers-strategy: native is already set, so a TLS-terminating proxy that sends X-Forwarded-Proto: https still gets Secure cookies.
• Image builds are pinned to digests from 2026-11-09. Renovate does not bump Docker digests in this repo, so base-image updates are manual from here. OpenSSL and zlib are pinned rather than floating --upgrade.
• Workflow tokens can no longer write repository contents. Publishing still uses registry credentials, not GITHUB_TOKEN package write.

Rollback

Revert these commits. No schema, API route, or Maven dependency change.