Fix run trivy vulnerability scanner

.github/workflows/trivy-analysis.yml

@@ -33,8 +33,8 @@ jobs:
           format: sarif
           output: trivy-results.sarif
           severity: MEDIUM,CRITICAL,HIGH
+          vulnType: os,library
           ignore-unfixed: true
-          version: v0.57.1
           timeout: 15m
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db

.trivyignore

@@ -0,0 +1,35 @@
+CVE-2015-6420  # commons-collections:commons-collections
+CVE-2015-7501  # commons-collections:commons-collections
+CVE-2019-17571 # log4j:log4j
+CVE-2020-11022 # jquery
+CVE-2020-11023 # jquery
+CVE-2020-15522 # org.bouncycastle:bcprov-jdk15on
+CVE-2020-35510 # org.jboss.remoting:jboss-remoting
+CVE-2021-4104  # log4j:log4j
+CVE-2021-41973 # org.apache.mina:mina-core
+CVE-2022-23302 # log4j:log4j
+CVE-2022-23305 # log4j:log4j
+CVE-2022-23307 # log4j:log4j
+CVE-2022-4065  # org.testng:testng
+CVE-2023-1973  # io.undertow:undertow-core
+CVE-2023-26464 # log4j:log4j
+CVE-2023-33201 # org.bouncycastle:bcprov-jdk15on
+CVE-2023-33202 # org.bouncycastle:bcprov-jdk15on
+CVE-2023-4639  # io.undertow:undertow-core
+CVE-2023-5685  # org.jboss.xnio:xnio-api
+CVE-2024-1459  # io.undertow:undertow-core
+CVE-2024-1635  # io.undertow:undertow-core
+CVE-2024-29857 # org.bouncycastle:bcprov-jdk15on
+CVE-2024-30171 # org.bouncycastle:bcprov-jdk15on
+CVE-2024-3653  # io.undertow:undertow-core
+CVE-2024-52046 # org.apache.mina:mina-core
+CVE-2024-5971  # io.undertow:undertow-core
+CVE-2024-6162  # io.undertow:undertow-core
+CVE-2024-6485  # bootstrap
+CVE-2024-7885  # io.undertow:undertow-core
+CVE-2025-11965 # io.vertx:vertx-web
+CVE-2025-1647  # bootstrap
+CVE-2025-48924 # commons-lang:commons-lang
+CVE-2025-5731  # org.infinispan:infinispan-cli-client
+CVE-2025-59250 # com.microsoft.sqlserver:mssql-jdbc
+CVE-2025-9784  # io.undertow:undertow-core

pom.xml

@@ -107,7 +107,6 @@
         <jboss-servlet-api_4.0_spec>2.0.0.Final</jboss-servlet-api_4.0_spec>
         <jboss.spec.javax.xml.bind.jboss-jaxb-api_2.3_spec.version>2.0.1.Final</jboss.spec.javax.xml.bind.jboss-jaxb-api_2.3_spec.version>
         <jboss.spec.javax.servlet.jsp.jboss-jsp-api_2.3_spec.version>2.0.0.Final</jboss.spec.javax.servlet.jsp.jboss-jsp-api_2.3_spec.version>
-        <log4j.version>1.2.17</log4j.version>
         <log4j2-api.version>2.25.1</log4j2-api.version> <!-- Odd name needs to align with Quarkus -->
         <resteasy.version>6.2.12.Final</resteasy.version>
         <resteasy.undertow.version>${resteasy.version}</resteasy.undertow.version>
@@ -121,7 +120,7 @@
         <org.glassfish.jaxb.xsom.version>2.3.3-b02</org.glassfish.jaxb.xsom.version>
         <undertow.version>${undertow-legacy.version}</undertow.version>
         <undertow-legacy.version>2.2.24.Final</undertow-legacy.version>
-        <undertow-jakarta.version>2.3.2.Final</undertow-jakarta.version>
+        <undertow-jakarta.version>2.3.5.Final</undertow-jakarta.version>
         <wildfly-elytron.version>2.6.5.Final</wildfly-elytron.version>
         <elytron.undertow-server.version>1.9.0.Final</elytron.undertow-server.version>
         <woodstox.version>6.0.3</woodstox.version>
@@ -475,8 +474,8 @@
                 <version>${resteasy.version}</version>
                 <exclusions>
                     <exclusion>
-                        <groupId>log4j</groupId>
-                        <artifactId>log4j</artifactId>
+                        <groupId>org.apache.logging.log4j</groupId>
+                        <artifactId>log4j-core</artifactId>
                     </exclusion>
                     <exclusion>
                         <groupId>org.slf4j</groupId>
@@ -558,11 +557,6 @@
                 <version>${picketlink.version}</version>
                 <scope>test</scope>
             </dependency>
-            <dependency>
-                <groupId>log4j</groupId>
-                <artifactId>log4j</artifactId>
-                <version>${log4j.version}</version>
-            </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-core</artifactId>

testsuite/integration-arquillian/tests/pom.xml

@@ -1562,15 +1562,9 @@
                     <version>${project.version}</version>
                 </dependency>
 
-                <!--                <dependency>
-                    <groupId>org.arquillian.extension</groupId>
-                    <artifactId>arquillian-recorder-reporter-impl</artifactId>
-                    <version>1.1.0.Final</version>
-                </dependency>-->
-
                 <dependency>
-                    <groupId>log4j</groupId>
-                    <artifactId>log4j</artifactId>
+                    <groupId>org.apache.logging.log4j</groupId>
+                    <artifactId>log4j-core</artifactId>
                 </dependency>
                 <dependency>
                     <groupId>org.slf4j</groupId>

testsuite/integration-arquillian/util/pom.xml

@@ -85,7 +85,7 @@
         <dependency>
             <groupId>org.apache.sshd</groupId>
             <artifactId>sshd-core</artifactId>
-            <version>2.7.0</version>
+            <version>2.9.2</version>
         </dependency>
         <dependency>
             <groupId>jakarta.servlet</groupId>

testsuite/model/pom.xml

@@ -45,8 +45,8 @@
             <scope>test</scope>
         </dependency>
         <dependency>
-            <groupId>log4j</groupId>
-            <artifactId>log4j</artifactId>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>

testsuite/utils/pom.xml

@@ -78,8 +78,8 @@
             <artifactId>keycloak-account-ui</artifactId>
         </dependency>
         <dependency>
-            <groupId>log4j</groupId>
-            <artifactId>log4j</artifactId>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
             <scope>compile</scope>
         </dependency>
         <dependency>
@@ -105,8 +105,8 @@
             <artifactId>resteasy-core</artifactId>
             <exclusions>
                 <exclusion>
-                    <groupId>log4j</groupId>
-                    <artifactId>log4j</artifactId>
+                    <groupId>org.apache.logging.log4j</groupId>
+                    <artifactId>log4j-core</artifactId>
                 </exclusion>
                 <exclusion>
                     <groupId>org.slf4j</groupId>

util/embedded-ldap/pom.xml

@@ -48,8 +48,8 @@
             <artifactId>jboss-logging</artifactId>
         </dependency>
         <dependency>
-            <groupId>log4j</groupId>
-            <artifactId>log4j</artifactId>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
             <scope>compile</scope>
         </dependency>
         <dependency>