fix: repair v1.15.1 server image scan

Author: beyondwin

CHANGELOG.md

@@ -10,6 +10,25 @@ ReadMates는 Git tag와 GitHub Releases를 함께 사용합니다. 이 파일은
 
 - 다음 릴리즈 후보 변경을 이 섹션에 기록합니다.
 
+## v1.15.1 - 2026-06-29
+
+### Fixed
+
+- **server release image security:** `v1.15.0`의 `Deploy Front`는 통과했지만 `Deploy Server Image`가 GHCR release tag promotion 전에 Trivy HIGH gate에서 멈췄습니다. Runtime classpath를 Jackson fixed patch line으로 정렬해 `com.fasterxml.jackson.core:jackson-databind`를 `2.21.4`, `tools.jackson.core:jackson-databind`를 `3.1.4`로 올리고, `jackson-annotations`는 공개된 `2.21` artifact로 고정했습니다.
+
+### Deployment Notes
+
+- Patch release for server image scan repair. DB migration, public API contract, auth/BFF token handling, OAuth scope, frontend behavior, Pages Functions behavior, and deploy workflow triggers are unchanged from `v1.15.0`.
+- Do not force-update `v1.15.0`. Publish `v1.15.1`, confirm `Deploy Front` and `Deploy Server Image`, promote OCI Compose backend to `ghcr.io/<owner>/<repo>/readmates-server:v1.15.1`, create the GitHub Release, then run sanitized BFF/OAuth/admin/host smoke checks.
+
+### Verification
+
+- `v1.15.0` release operation (2026-06-29): `Deploy Front` passed for tag `v1.15.0`; `Deploy Server Image` built and pushed a scan candidate but failed before release-tag promotion because Trivy found four fixed HIGH Jackson databind findings: CVE-2026-54512 and CVE-2026-54513 in `com.fasterxml.jackson.core:jackson-databind 2.21.2`, and the same CVEs in `tools.jackson.core:jackson-databind 3.1.2`.
+- Local dependency verification (2026-06-29): `./server/gradlew -p server dependencyInsight --dependency jackson-databind --configuration runtimeClasspath` selected `com.fasterxml.jackson.core:jackson-databind 2.21.4` and `tools.jackson.core:jackson-databind 3.1.4`.
+- Local server/image verification (2026-06-29): `./server/gradlew -p server clean check bootJar` passed; `./server/gradlew -p server integrationTest` passed; `docker build -f server/Dockerfile.release server -t readmates-server:v1.15.1-local` passed.
+- Local vulnerability verification (2026-06-29): `docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.70.0 image --severity HIGH,CRITICAL --ignore-unfixed --scanners vuln readmates-server:v1.15.1-local` passed with 0 Ubuntu and Java HIGH/CRITICAL findings.
+- Public safety: `git diff --check -- server/build.gradle.kts CHANGELOG.md docs/development/release-readiness-review.md`, `./scripts/build-public-release-candidate.sh`, and `./scripts/public-release-check.sh .tmp/public-release-candidate` passed; gitleaks reported no leaks.
+
 ## v1.15.0 - 2026-06-29
 
 ### Highlights
@@ -53,6 +72,7 @@ ReadMates는 Git tag와 GitHub Releases를 함께 사용합니다. 이 파일은
 - Public safety: `./scripts/build-public-release-candidate.sh` and `./scripts/public-release-check.sh .tmp/public-release-candidate` passed; gitleaks reported no leaks in the candidate.
 - Local environment note: after Docker CT recreated host-mounted `node_modules` with Linux optional dependencies, the first preview Lighthouse attempt failed on a missing macOS Rolldown native binding. `CI=true npx --yes pnpm@10.33.0 install --frozen-lockfile` restored host dependencies, and the same preview Lighthouse command then passed.
 - Remote CI repair before tag: the first pushed `main` CI run failed only in `Frontend visual regression` because the new job ran host `pnpm test:ct` on `ubuntu-24.04` while the committed baselines are Docker-rendered. The workflow now runs `pnpm test:ct:docker`, matching the documented baseline renderer and the local passing gate.
+- Release operation: `Deploy Front` passed for tag `v1.15.0`; `Deploy Server Image` failed before release-tag promotion at Trivy scan on Jackson databind fixed HIGH findings. The release is rolled forward through `v1.15.1`; do not force-update `v1.15.0`.
 - Skipped before tag push: GitHub Actions status, `Deploy Front`, `Deploy Server Image`, OCI Compose backend promotion, GitHub Release publication, production OAuth, provider-console checks, and post-deploy smoke. These require pushed `main`/tag or production operator access and are release-operation steps after publication.
 
 ## v1.14.1 - 2026-06-21

docs/development/release-readiness-review.md

@@ -2,6 +2,24 @@
 
 남은 리스크, release readiness, merge 후 안전성, ship 가능 여부를 확인할 때 사용하는 체크리스트입니다. 구현 계획의 완료 여부와 테스트 통과 여부만으로 release risk가 닫혔다고 판단하지 않습니다.
 
+## 2026-06-29 v1.15.1 server image repair readiness
+
+- Scope reviewed: `v1.15.0` tag operation, failed `Deploy Server Image` run `28338469979`, and local server runtime dependency graph before publishing `v1.15.1`.
+- Release classification: patch release to unblock server release-image Trivy gate. No Flyway migration, public API contract, auth/BFF token handling, OAuth scope, Pages Functions behavior, frontend behavior, secret/session handling, or deploy workflow trigger change is included.
+- `v1.15.0` release operation status: `Deploy Front` passed for tag `v1.15.0`; `Deploy Server Image` built and pushed a scan candidate but failed before release-tag promotion. Therefore `ghcr.io/<owner>/<repo>/readmates-server:v1.15.0` was not promoted by the deploy workflow.
+- Root cause: Trivy found four fixed HIGH Jackson databind findings in the scan candidate: CVE-2026-54512 and CVE-2026-54513 in `com.fasterxml.jackson.core:jackson-databind 2.21.2`, plus the same CVEs in `tools.jackson.core:jackson-databind 3.1.2`.
+- Server impact: runtime dependency resolution now forces `com.fasterxml.jackson.core:jackson-databind` to `2.21.4` and `tools.jackson.core` modules to `3.1.4`; `jackson-annotations` is constrained to published `2.21` because `2.21.4` is not available.
+- Local dependency verification before publication: `./server/gradlew -p server dependencyInsight --dependency jackson-databind --configuration runtimeClasspath` selected `com.fasterxml.jackson.core:jackson-databind 2.21.4` and `tools.jackson.core:jackson-databind 3.1.4`.
+- Local server/image verification before publication:
+  - `./server/gradlew -p server clean check bootJar` - pass.
+  - `./server/gradlew -p server integrationTest` - pass.
+  - `docker build -f server/Dockerfile.release server -t readmates-server:v1.15.1-local` - pass.
+  - `docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.70.0 image --severity HIGH,CRITICAL --ignore-unfixed --scanners vuln readmates-server:v1.15.1-local` - pass, 0 Ubuntu and Java HIGH/CRITICAL findings.
+  - `git diff --check -- server/build.gradle.kts CHANGELOG.md docs/development/release-readiness-review.md` - pass.
+  - `./scripts/build-public-release-candidate.sh` and `./scripts/public-release-check.sh .tmp/public-release-candidate` - pass; gitleaks reported no leaks.
+- Release plan: do not force-update `v1.15.0`; publish `v1.15.1`, confirm tag-triggered `Deploy Front` and `Deploy Server Image`, promote OCI Compose backend to `ghcr.io/<owner>/<repo>/readmates-server:v1.15.1`, create the GitHub Release, then run sanitized BFF/OAuth/admin/host smoke checks.
+- Residual risk: remote server image Trivy pass, GHCR release-tag promotion, OCI backend promotion, GitHub Release publication, and post-deploy smoke remain pending until the pushed `v1.15.1` tag workflows and production promotion complete.
+
 ## 2026-06-29 v1.15.0 pre-release readiness
 
 - Scope reviewed: local `v1.14.1..HEAD` and `main...origin/main` before publishing `v1.15.0`.

server/build.gradle.kts

@@ -26,6 +26,23 @@ repositories {
     mavenCentral()
 }
 
+configurations.configureEach {
+    resolutionStrategy.eachDependency {
+        if (requested.group == "com.fasterxml.jackson.core" && requested.name == "jackson-databind") {
+            useVersion("2.21.4")
+            because("Trivy flags CVE-2026-54512 and CVE-2026-54513 in jackson-databind 2.21.2.")
+        }
+        if (requested.group == "com.fasterxml.jackson.core" && requested.name == "jackson-annotations") {
+            useVersion("2.21")
+            because("jackson-databind 2.21.4 requests a non-published annotations 2.21.4 artifact.")
+        }
+        if (requested.group == "tools.jackson.core") {
+            useVersion("3.1.4")
+            because("Trivy flags CVE-2026-54512 and CVE-2026-54513 in tools.jackson databind 3.1.2.")
+        }
+    }
+}
+
 dependencies {
     constraints {
         implementation("org.lz4:lz4-java:1.8.1") {
@@ -40,6 +57,12 @@ dependencies {
         implementation("tools.jackson.core:jackson-core:3.1.2") {
             because("Trivy flags jackson-core 3.0.2 for high severity parser issues.")
         }
+        implementation("com.fasterxml.jackson.core:jackson-databind:2.21.4") {
+            because("Trivy flags CVE-2026-54512 and CVE-2026-54513 in jackson-databind 2.21.2.")
+        }
+        implementation("tools.jackson.core:jackson-databind:3.1.4") {
+            because("Trivy flags CVE-2026-54512 and CVE-2026-54513 in tools.jackson databind 3.1.2.")
+        }
         implementation("io.netty:netty-codec-dns:4.2.15.Final") {
             because("Trivy flags Netty DNS/handler CVEs before 4.2.15.Final.")
         }