chore(supply-chain): osv-scanner suppressions, bump publishing plugin, track Maven in Dependabot (#272)

Follow-up to the Dependabot action-bump merges and the cargo-deny ignore (#271).
Three low-risk supply-chain housekeeping changes — config/docs only, no library
code, no runtime change.

## 1. `osv-scanner.toml` (new)

The OpenSSF Scorecard *Vulnerabilities* check runs OSV-Scanner over the repo and
was flagging five advisory IDs (`score is 5`). These reduce to three findings,
all assessed as not affecting Wickra:

| Advisory | Assessment |
|----------|------------|
| RUSTSEC-2026-0176 / GHSA-36hh-v3qg-5jq4 (pyo3) | Vulnerable API unused; fix is pyo3 0.29 but rust-numpy 0.28 pins pyo3 `^0.28` → upstream-blocked. Already in `deny.toml`. |
| RUSTSEC-2026-0177 / GHSA-chgr-c6px-7xpp (pyo3) | Same — `PyCFunction::new_closure` not called. Already in `deny.toml`. |
| GHSA-72hv-8253-57qq (jackson-core 3.x) | **Not a dependency of this project.** No manifest, Maven plugin, or the GitHub dependency-graph SBOM references `tools.jackson` 3.x; the only jackson present is `com.fasterxml.jackson.core:jackson-databind` 2.17.1. |

`osv-scanner.toml` records these as ignored-with-reason at the OSV layer,
mirroring `deny.toml` and the SECURITY.md VEX section. The Scorecard finding
also flip-flopped (fixed → reappeared) across unrelated release-bump commits,
confirming it is not a stable real exposure.

## 2. Bump `central-publishing-maven-plugin` 0.5.0 → 0.10.0

The Java binding pinned a publishing plugin five versions behind. Validated
locally with the JDK 22 toolchain (`mvn -Prelease validate`): the extension
loads, the existing `publishingServerId`/`autoPublish` config is compatible, and
all 14 binding tests pass. The actual `mvn deploy` upload path is only exercised
at release time (needs the Central token + GPG key), so it will be confirmed at
the next release.

## 3. Add a Maven ecosystem to Dependabot

The Java binding had no Dependabot coverage, which is why the stale 0.5.0 plugin
went unnoticed. Adds `package-ecosystem: maven` over `/bindings/java`,
`/bindings/java/benchmarks`, and `/examples/java` so plugin and dependency
updates (incl. the examples' jackson) are tracked going forward.

This commit is contained in:

kingchenc

2026-06-12 23:15:56 +02:00

committed by

GitHub

parent 452f270b4d

commit 8ccfd638b2

3 changed files with 53 additions and 1 deletions

									
										.github/dependabot.yml
									
		+17
		
												View File
												
				@@ -59,3 +59,20 @@ updates:

				      default-days: 7

				    commit-message:

				      prefix: "deps(actions)"

				  # Java binding + examples (Maven). Tracks the C-ABI binding's build plugins

				  # (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,

				  # which had no Dependabot coverage before — a stale publishing plugin slipped

				  # through unnoticed until an OSV scan flagged it.

				  - package-ecosystem: maven

				    directories:

				      - "/bindings/java"

				      - "/bindings/java/benchmarks"

				      - "/examples/java"

				    schedule:

				      interval: weekly

				    open-pull-requests-limit: 10

				    cooldown:

				      default-days: 7

				    commit-message:

				      prefix: "deps(maven)"