platform-ci/runtime/TOOL-SECURITY.md

Toolchain image security patches

Scope: toolchain.Dockerfile only. Patches target the HIGH/CRITICAL findings observed in the tool-only scans of the maven and node targets. No application source, dependencies, gates or scan suppressions were changed, and nothing is installed or downloaded when a pipeline runs. Node 22.20.0, Maven 3.9.11 and JDK 21 are unchanged.

Status: fresh qualification is pending. The edits have not been built, rescanned or run against native fixtures; the root owner does that next.

Mechanism

A non-shipped patched-tools stage (based on the digest-pinned control image) downloads each artifact with Python's standard library (urllib, hashlib; no curl or build suite is added to any runtime), fails the build on a checksum mismatch, and assembles the patched trees under /out. The maven and node targets copy only /out/maven and /out/npm, so the vulnerable files are not present in any shipped layer.

Changes

Target	Component	From	To
maven	lib/guava-33.4.8-jre.jar	com.google.guava:guava 33.4.8-jre	33.7.2-jre
maven	lib/plexus-utils-3.6.0.jar	org.codehaus.plexus:plexus-utils 3.6.0	3.6.1
node	/usr/local/lib/node_modules/npm (whole bundle)	npm bundled with Node 22.20.0	npm 11.21.1
node	npm/node_modules/undici	6.29.0 (from npm 11.21.1)	6.29.1

The build verifies the original Maven jar paths exist before removal, that exactly one guava and one plexus-utils jar remain under the Maven tree, that npm's bundled undici is 6.29.0 before replacement, that exactly one undici directory exists in the npm tree afterwards, and that npm --version is 11.21.1. The Node binary and the JDK are copied untouched. The old npm bundle is never copied, which removes its vulnerable brace-expansion, glob, ip-address, minimatch, pacote, picomatch, sigstore and tar copies.

Provenance

Artifact	URL	Checksum
guava-33.7.2-jre.jar	https://repo.maven.apache.org/maven2/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar	SHA-256 b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c (same fix as the prior Foundation tool image)
plexus-utils-3.6.1.jar	https://repo.maven.apache.org/maven2/org/codehaus/plexus/plexus-utils/3.6.1/plexus-utils-3.6.1.jar	SHA-256 05a63effd67e2d6b9d610cc82e2bd7473289d34802e57a529b28110f28af5679 (authoritative artifact checksum read by root)
npm-11.21.1.tgz	https://registry.npmjs.org/npm/-/npm-11.21.1.tgz	SHA-512 (base64) YTzL6QBEJXyHcTu0JiUc7RKMp+mzlJtl7rGLmERaXUQeFHIMc9atdr6G9M9C8vDWbv40epoTQAzNL2/PtZVDhQ== (registry metadata verified by root)
undici-6.29.1.tgz	https://registry.npmjs.org/undici/-/undici-6.29.1.tgz	SHA-512 (base64) EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA== (from the prior qualified tool image; validated before extraction)

npm major version change

The npm bundled with Node 22.20.0 is a 10.x release. This image now ships npm 11.21.1, a major-version change from the old source bundle. npm 11.21.1 supports Node >=22.9.0, so Node 22.20.0 stays compatible. Behavior differences in npm 11 (for example, changes to lifecycle and config handling) must be confirmed by the native Node fixtures.

Remaining caveats

• The Maven patch is specific to the Maven 3.9.11 layout; a different MAVEN_IMAGE fails the build at the original-path check rather than being silently patched. The npm patch likewise expects undici 6.29.0 in npm 11.21.1.
• Qualification (build, rescan with 0 HIGH/CRITICAL, native fixture runs) is pending.
• tests/test_toolchain_recipes.py checks only the checksums, source of the shipped trees and version smoke checks.