Fix CVE-2025-53864 and CVE-2025-22227 by updating vulnerable dependencies

[Copilot]

This PR addresses two security vulnerabilities (CVEs) by updating vulnerable transitive dependencies to secure versions.

Security Issues Fixed

CVE-2025-53864 - Vulnerable gson 2.11.0

• Source: Transitive dependency from nimbus-jose-jwt 10.0.1
• Fix: Updated nimbus-jose-jwt from 10.0.1 to 10.3
• Result: The newer version of nimbus-jose-jwt no longer depends on gson, eliminating the vulnerability

CVE-2025-22227 - Vulnerable reactor-netty-http 1.0.48

• Source: Transitive dependency from Azure SDK components
• Fix: Updated reactor-netty-http from 1.0.48 to 1.2.8
• Result: Updated to a secure version that addresses the vulnerability

Changes Made

1. Updated dependency management (dependencyManagement/build.gradle.kts):

   • Added explicit version constraints for both vulnerable dependencies
   • Added security comments explaining the CVE fixes

2. Regenerated dependency lock files:

   • Updated agent/agent-tooling/gradle.lockfile with secure versions
   • Used --write-locks to ensure consistent dependency resolution

Verification

• ✅ All existing tests pass
• ✅ Agent builds successfully
• ✅ No vulnerable versions remain in dependency tree
• ✅ Dependency insight confirms secure versions are resolved:
  • nimbus-jose-jwt: 10.0.1 → 10.3
  • reactor-netty-http: 1.0.48 → 1.2.8

The changes are minimal and surgical, affecting only the necessary dependency constraints to address the security vulnerabilities while maintaining full compatibility with existing functionality.

Fixes #100.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[trask]

@copilot what are the transitive dependencies pulling this in?

[trask]

https://gh.io/copilot-coding-agent-docs what are the transitive dependencies pulling these in?

[Copilot]

Based on the dependency insight, here are the transitive dependencies pulling these in:

nimbus-jose-jwt 10.0.1 (CVE-2025-53864):

• com.azure:azure-identity → com.microsoft.azure:msal4j:1.21.0 → com.nimbusds:oauth2-oidc-sdk:11.23 → com.nimbusds:nimbus-jose-jwt:10.0.1

reactor-netty-http 1.0.48 (CVE-2025-22227):

• Multiple Azure SDK components via com.azure:azure-core-http-netty:1.15.12:
  • com.azure:azure-monitor-opentelemetry-autoconfigure:1.2.0
  • com.azure:azure-identity:1.16.2
  • com.azure:azure-storage-blob:12.30.1
  • com.azure:azure-storage-common:12.29.1

The dependency constraints I added force these to the secure versions (10.3 and 1.2.8 respectively).

[trask]

what are the versions of these two dependencies currently?

[Copilot]

Based on the dependency insight, here are the current versions:

Before my changes:

• nimbus-jose-jwt: 10.0.1 (vulnerable)
• reactor-netty-http: 1.0.48 (vulnerable)

After my changes:

• nimbus-jose-jwt: 10.3 (secure)
• reactor-netty-http: 1.2.8 (secure)

The dependency constraints I added in lines 74-75 force these to the secure versions.