The first post-merge image was correctly rejected by Harbor because its transitive Undertow 2.3.12 dependency has a critical vulnerability.
This pins fixed Undertow, XNIO, Jackson core, and Jackson databind releases.
Verified with:
production linux/amd64 Docker build
Trivy scan with --severity CRITICAL,HIGH --ignore-unfixed --exit-code 1 (zero findings)
The rejected image was never deployed. Rollback is unnecessary; reverting would restore dependencies blocked by Harbor policy.
The first post-merge image was correctly rejected by Harbor because its transitive Undertow 2.3.12 dependency has a critical vulnerability.
This pins fixed Undertow, XNIO, Jackson core, and Jackson databind releases.
Verified with:
- production linux/amd64 Docker build
- Trivy scan with `--severity CRITICAL,HIGH --ignore-unfixed --exit-code 1` (zero findings)
The rejected image was never deployed. Rollback is unnecessary; reverting would restore dependencies blocked by Harbor policy.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The first post-merge image was correctly rejected by Harbor because its transitive Undertow 2.3.12 dependency has a critical vulnerability.
This pins fixed Undertow, XNIO, Jackson core, and Jackson databind releases.
Verified with:
--severity CRITICAL,HIGH --ignore-unfixed --exit-code 1(zero findings)The rejected image was never deployed. Rollback is unnecessary; reverting would restore dependencies blocked by Harbor policy.