Gate CI on known vulnerabilities in the shipped dependency graph

.github/workflows/ci.yml

@@ -79,6 +79,46 @@ jobs:
           flags: unittests
           fail_ci_if_error: true
 
+  # Known-vulnerability gate over the dependency graph Storm ships (compile and runtime scope): OWASP
+  # Dependency-Check against the NVD, failing on a High or Critical advisory. Test and provided scope are the
+  # application's own dependencies and stay out of it. The NVD API key is a repository secret; Dependabot runs and
+  # forks receive no secrets, so the scan is skipped there and reported as such.
+  dependency-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up JDK 21
+        if: env.NVD_API_KEY != ''
+        uses: actions/setup-java@v6
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+          # The Maven cache holds the NVD data the plugin keeps under ~/.m2 as well, so a run only pulls the
+          # advisories published since the last one.
+          cache: 'maven'
+
+      - name: Scan the shipped dependency graph
+        if: env.NVD_API_KEY != ''
+        run: mvn -B -DskipTests -Dmaven.javadoc.skip=true -Dspotless.check.skip=true install org.owasp:dependency-check-maven:aggregate
+
+      - name: Upload the Dependency-Check report
+        if: env.NVD_API_KEY != '' && always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: dependency-check-report
+          path: target/dependency-check-report.*
+          if-no-files-found: ignore
+          retention-days: 30
+
+      - name: Report a skipped scan
+        if: env.NVD_API_KEY == ''
+        run: echo "::notice::Dependency-Check skipped - no NVD_API_KEY available to this run."
+
   # The CLI ships to users via npx but is plain JavaScript with no compile step,
   # so at minimum its syntax must be checked before merge.
   cli-check:

pom.xml

@@ -264,6 +264,29 @@
                         </execution>
                     </executions>
                 </plugin>
+                <plugin>
+                    <!-- The known-vulnerability gate CI runs over the dependency graph Storm ships: compile and
+                         runtime scope. Test and provided scope (Spring Boot, Jackson, the drivers) are the
+                         application's own dependencies and stay out of the gate. Invoked explicitly, never bound
+                         to a phase: mvn org.owasp:dependency-check-maven:aggregate, with the NVD API key in
+                         NVD_API_KEY. -->
+                    <groupId>org.owasp</groupId>
+                    <artifactId>dependency-check-maven</artifactId>
+                    <version>13.0.0</version>
+                    <configuration>
+                        <!-- CVSS 7 is the floor of High. -->
+                        <failBuildOnCVSS>7</failBuildOnCVSS>
+                        <skipTestScope>true</skipTestScope>
+                        <skipProvidedScope>true</skipProvidedScope>
+                        <nvdApiKeyEnvironmentVariable>NVD_API_KEY</nvdApiKeyEnvironmentVariable>
+                        <formats>
+                            <format>HTML</format>
+                            <format>JSON</format>
+                        </formats>
+                        <!-- The .NET analyzer needs the dotnet tool and only warns without it. -->
+                        <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+                    </configuration>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>

storm-jackson2/pom.xml

@@ -146,7 +146,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.17.0</version>
+            <version>2.17.3</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -163,7 +163,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>2.17.0</version>
+            <version>2.17.3</version>
             <scope>test</scope>
         </dependency>
         <dependency>

storm-jackson3/pom.xml

@@ -134,13 +134,13 @@
         <dependency>
             <groupId>tools.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>3.0.0</version>
+            <version>3.0.4</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>tools.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>3.0.0</version>
+            <version>3.0.4</version>
             <scope>provided</scope>
         </dependency>
         <dependency>

storm-mysql/pom.xml

@@ -126,7 +126,7 @@
         <dependency>
             <groupId>com.mysql</groupId>
             <artifactId>mysql-connector-j</artifactId>
-            <version>8.0.33</version>
+            <version>9.7.0</version>
             <scope>test</scope>
         </dependency>
         <!-- A database this module's dialect does not claim, so the tests can assert that it is not applied to

storm-postgresql/pom.xml

@@ -159,7 +159,7 @@
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
-            <version>42.7.4</version>
+            <version>42.7.11</version>
             <scope>test</scope>
         </dependency>
         <dependency>