CVE fixes - 2026-06-18

[RafaelGuevaraCA]

Summary

Automated CVE remediation for blazemeter/taurus:unstable from Prisma Cloud scan build 150 (2026-06-17). Of 288 reported vulnerabilities, this PR applies the subset that can be cleanly fixed in-source/in-Dockerfile and bumps the JMeter/Gatling versions to refresh bundled jars. Remaining items require manual intervention or are infeasible in a standard build (see below).

⚠️ Unit tests validate the Python changes only — the Dockerfile changes (gem/npm/apt) are not exercised by the unit suite and are verified by the next Prisma scan after merge. Net CVE reduction must be confirmed by re-running /prisma-taurus after Jenkins builds a new unstable image.

Auto-fixed CVEs

Clean dependency fixes (~30 CVEs, incl. 2 critical)

CVE(s)	Package	Old → New	Severity	Where
CVE-2026-42257, CVE-2026-42258	net-imap (ruby)	0.5.8 → ≥0.5.15	critical	Dockerfile gem update
CVE-2026-42246, CVE-2026-42245	net-imap (ruby)	0.5.8 → ≥0.5.15	high	Dockerfile gem update
CVE-2026-42256, -47240, -47241, -47242	net-imap (ruby)	0.5.8 → ≥0.5.15	medium/low	Dockerfile gem update
CVE-2026-41316	erb (ruby)	4.0.4 → latest	high	Dockerfile gem update
CVE-2026-8723, CVE-2025-15284	qs (npm, newman)	6.14.2/6.5.5 → ^6.15.2	medium/low	Newman overrides
CVE-2024-28176	jose (npm, newman)	4.14.4 → ^4.15.9	medium	Newman overrides
CVE-2026-24001	diff (npm, mocha)	7.0.0 → ^5.2.2	low	Mocha overrides
CVE-2026-5260, -3832, -3833, -33845, -33846, -42009..42015, -5419 (×13)	gnutls28	→ 3.8.3-1.1ubuntu3.6	medium	apt --only-upgrade
CVE-2023-35789, CVE-2026-44235, CVE-2026-44236	librabbitmq	→ 0.11.0-1ubuntu0.1	medium/low	apt --only-upgrade
CVE-2026-41989	libgcrypt20	→ 1.10.3-2ubuntu0.1	medium	apt --only-upgrade

Version bumps (refresh bundled jars — partial; net effect confirmed by rescan)

Tool	Old → New	Notes
JMeter (default VERSION)	5.5 → 5.6.3	Refreshes bundled xstream, batik-bridge, jackson-databind, commons-io, etc. log4j/tika not cleared (5.6.3 still ships older).
Gatling VERSION	3.9.5 → 3.10.5	Last bundle-ZIP version before 3.11 maven-only switch. Refreshes logback/jackson; netty not cleared (needs ≥4.1.135).

Deliberately excluded

• file-type (newman): 3.9.0 → 16.5.4 is a breaking major-version API change; forcing it via override would break Newman's tree. Needs upstream fix.
• mesa (1 medium): uncertain binary package names; skipped to avoid breaking the build.

NOT fixed — manual intervention required (not in this PR)

• Ubuntu Pro ESM packages (~48 CVEs): ffmpeg, gnuplot, openexr, python-pip, qtbase, gst-plugins-bad, fonttools — fixed versions are +esmN/~esm1, only available with an Ubuntu Pro subscription. Plain apt-get cannot install them.
• k6 Go libs (9 CVEs): golang.org/x/net, crypto/x509, etc. compiled into /usr/bin/k6 — require a newer k6 build.
• Bundled JMeter/Gatling jars surviving the version bump: log4j (needs 2.25.4), tika-core/tika-parsers (critical CVE-2025-54988, CVE-2025-66516; need 3.2.2/2.0.0), netty (needs ≥4.1.135), batik-transcoder/script (1.17), jackson-core (2.18.6) — require manual jar replacement in the Dockerfile or a larger framework upgrade.

Next steps

1. Review and merge this PR.
2. Wait for Jenkins to build a new blazemeter/taurus:unstable from master.
3. Re-run /prisma-taurus to verify the auto-fixed CVEs are resolved.
4. Address the manual-intervention items separately (notably the tika critical jars and the ESM packages / k6).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.07%. Comparing base (6e439c3) to head (8245d16).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1995      +/-   ##
==========================================
- Coverage   88.08%   88.07%   -0.01%     
==========================================
  Files          73       73              
  Lines       20935    20935              
==========================================
- Hits        18439    18436       -3     
- Misses       2496     2499       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.