Fix jackson & netty CVEs via api-scoped dependency constraints

Overrides the vulnerable transitive jackson and netty versions pulled by the
Azure/Google/Seqera SDKs using api-scoped dependency constraints, which take
effect on ALL configurations — including testFixtures*, which implementation/
runtimeOnly pins don't reach. GitHub's dependency submission resolves every
configuration, so those testFixtures selections were reported in the graph and
kept alerts open.

- nf-commons: constraint jackson-databind 2.21.5 (transitive via npr-api; `api`
  scope propagates to downstream modules and their testFixtures)
- nf-seqera: constraint jackson-databind 2.21.5 (transitive via tower-api).
  jackson-dataformat-yaml stays a direct `api` dependency at 2.21.5 because it
  is required at runtime and is NOT pulled transitively.
- nf-azure: constraints jackson databind/core/annotations 2.18.9 (2.18 line
  required by the Azure SDK) and azure-core-http-netty 1.16.5 (brings patched
  netty 4.1.135).
- nf-google: constraints jackson databind/core/annotations 2.18.9. The existing
  grpc-netty-shaded runtimeOnly pin is left unchanged (it has no open alert;
  converting it to a constraint is deferred to avoid perturbing the
  credential-gated GCP integration test).

Constraints bump a transitive version without adding a fake dependency, `api`
scope reaches testFixtures compile classpaths, and `require` (default) is a
security floor (>= patched). Modules that genuinely use a library
(jackson-dataformat-yaml in nf-seqera) keep a real dependency.

Verified by generating the real GitHub dependency-graph snapshot: the submitted
graph contains only patched versions in every configuration — jackson
2.18.9 / 2.21.5, jackson-dataformat-yaml 2.21.5, netty 4.1.135,
azure-core-http-netty 1.16.5. Compile succeeds and the changed-module test
suites pass.

Addresses GHSA-rmj7-2vxq-3g9f, GHSA-j3rv-43j4-c7qm, GHSA-72hv-8253-57qq,
GHSA-3qp7-7mw8-wx86 (CVE-2026-44249).

Signed-off-by: Jorge Ejarque <jorge.ejarque@seqera.io>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: jorgee <jorge.ejarque@seqera.io>

Author: jorgee

modules/nf-commons/build.gradle

@@ -39,6 +39,13 @@ dependencies {
     // patch gson dependency required by pf4j
     api 'com.google.code.gson:gson:2.13.1'
     api 'io.seqera:npr-api:0.22.0'
+    // jackson-databind is pulled transitively (npr-api). Bump it to the patched 2.21.5 via an
+    // api-scoped constraint — no direct dependency, and `api` scope propagates the fix to all
+    // downstream modules and their testFixtures classpaths. Addresses the high-severity
+    // PolymorphicTypeValidator bypasses (GHSA-rmj7-2vxq-3g9f, GHSA-j3rv-43j4-c7qm).
+    constraints {
+        api('com.fasterxml.jackson.core:jackson-databind:2.21.5') { because 'jackson-databind deserialization CVEs' }
+    }
 
     /* testImplementation inherited from top gradle build file */
     testImplementation(testFixtures(project(":nextflow")))

plugins/nf-azure/build.gradle

@@ -65,12 +65,19 @@ dependencies {
         exclude group: 'org.slf4j', module: 'slf4j-api'
     }
 
-    // Force patched version to address GHSA-72hv-8253-57qq (jackson-core Number Length Constraint Bypass DoS)
-    runtimeOnly 'com.fasterxml.jackson.core:jackson-core:2.18.6'
-
-    // Pin azure-core-http-netty to a version that brings patched netty
-    // (4.1.135.Final) to address GHSA-3qp7-7mw8-wx86 / CVE-2026-44249
-    implementation 'com.azure:azure-core-http-netty:1.16.5'
+    // Bump vulnerable transitive dependencies of the Azure SDK across ALL classpaths —
+    // including testFixtures*, which implementation/runtimeOnly pins don't reach. Constraints
+    // raise the transitive version without adding a direct dependency; `api` scope is what
+    // reaches the consumer/testFixtures compile classpaths.
+    constraints {
+        // jackson kept on the 2.18 line required by the Azure SDK; addresses GHSA-72hv-8253-57qq
+        // (jackson-core DoS) and the jackson-databind deserialization advisories fixed in 2.18.9
+        api('com.fasterxml.jackson.core:jackson-databind:2.18.9') { because 'jackson-databind deserialization CVEs' }
+        api('com.fasterxml.jackson.core:jackson-core:2.18.9') { because 'GHSA-72hv-8253-57qq' }
+        api('com.fasterxml.jackson.core:jackson-annotations:2.18.9') { because 'keep jackson aligned' }
+        // azure-core-http-netty 1.16.5 brings patched netty 4.1.135 (GHSA-3qp7-7mw8-wx86 / CVE-2026-44249)
+        api('com.azure:azure-core-http-netty:1.16.5') { because 'brings patched netty 4.1.135' }
+    }
 
     testImplementation(testFixtures(project(":nextflow")))
     testImplementation project(':nextflow')

plugins/nf-google/build.gradle

@@ -65,8 +65,15 @@ dependencies {
     api 'io.seqera:lib-httpx:2.3.0'
     // Force patched version to address CVE-2025-55163 (MadeYouReset HTTP/2 DDoS vulnerability)
     runtimeOnly 'io.grpc:grpc-netty-shaded:1.75.0'
-    // Force patched version to address GHSA-72hv-8253-57qq (jackson-core Number Length Constraint Bypass DoS)
-    runtimeOnly 'com.fasterxml.jackson.core:jackson-core:2.18.6'
+    // Bump the jackson pulled transitively by the Google SDK to the patched 2.18 line across ALL
+    // configurations — including testFixtures*, which runtimeOnly/implementation pins don't reach.
+    // Addresses GHSA-72hv-8253-57qq (jackson-core DoS) and the jackson-databind deserialization
+    // advisories fixed in 2.18.9.
+    constraints {
+        api('com.fasterxml.jackson.core:jackson-databind:2.18.9') { because 'jackson-databind deserialization CVEs' }
+        api('com.fasterxml.jackson.core:jackson-core:2.18.9') { because 'GHSA-72hv-8253-57qq' }
+        api('com.fasterxml.jackson.core:jackson-annotations:2.18.9') { because 'keep jackson aligned' }
+    }
 
     testImplementation(testFixtures(project(":nextflow")))
     testImplementation "org.apache.groovy:groovy:4.0.31"

plugins/nf-seqera/build.gradle

@@ -73,10 +73,14 @@ dependencies {
     api('io.seqera:tower-api:1.158.0') {
         exclude group: 'io.micronaut.servlet'
     }
-    // jackson 2.21.4 addresses GHSA-rmj7-2vxq-3g9f and GHSA-j3rv-43j4-c7qm
-    // (PolymorphicTypeValidator bypasses)
-    api "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.4"
-    api "com.fasterxml.jackson.core:jackson-databind:2.21.4"
+    // jackson-dataformat-yaml is required at runtime but is NOT pulled transitively, so it
+    // stays a direct dependency. jackson-databind IS transitive (tower-api / npr), so a
+    // constraint bumps it without adding a redundant dependency. Both at the patched 2.21.5 —
+    // addresses GHSA-rmj7-2vxq-3g9f, GHSA-j3rv-43j4-c7qm (PolymorphicTypeValidator bypasses).
+    api "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.5"
+    constraints {
+        api('com.fasterxml.jackson.core:jackson-databind:2.21.5') { because 'jackson-databind deserialization CVEs' }
+    }
 
     testImplementation(testFixtures(project(":nextflow")))
     testImplementation "org.apache.groovy:groovy:4.0.31"