[odosk]

⚠️ This PR was created by an AI assistant (Claude). Please review all changes carefully before merging.

Once approved, please merge it — this is an automated dependency-update PR and merging is the final step that closes out the linked Mend/Jira findings.

Summary

Bumps vespa-feed-client from 8.738.17 to 8.763.13 in the two examples that pin it. The old version pulled jackson-core 2.22.1, which has two HIGH CVEs. Also bumps grpc in the Go cloud-functions example.

Changed Files

examples/clients/client-java/app/build.gradle.kts

• vespa-feed-client: 8.738.17 → 8.763.13 (brings jackson-core 2.22.3)
• Removed the Bouncy Castle 1.86 constraints block. 8.763.13 resolves bcprov/bcpkix/bcutil 1.86 without it, so the pin's own "until the platform ships 1.86" condition is met.

examples/clients/client-java/gradle/libs.versions.toml

• guava: 33.7.1-jre → 33.7.2-jre

examples/book-search/pom.xml

• vespa_version (vespa-feed-client): 8.738.17 → 8.763.13. Mend only flagged client-java, but this pom pinned the same version.
• logback-classic: 1.6.4 → 1.6.5
• Removed the Bouncy Castle dependencyManagement pins, for the same reason as above.

examples/google-cloud/cloud-functions/go/go.mod

• google.golang.org/grpc: 1.83.1 → 1.83.2 (CVE-2026-84445, Dependabot alert Add System Test section #425)

CVEs Addressed

Verified against the GitHub Advisory Database:

Package	CVE(s)	Severity	Fix version reached
com.fasterxml.jackson.core:jackson-core	CVE-2026-89407 (GHSA-p6pp-m3f8-5c89)	HIGH	2.22.3 (first patched 2.22.3)
com.fasterxml.jackson.core:jackson-core	CVE-2026-89425 (GHSA-7hhh-6rmp-j9qf)	HIGH	2.22.3 (first patched 2.22.3)
google.golang.org/grpc	CVE-2026-84445 (GHSA-2v4p-qf9q-27wj)	HIGH	1.83.2 (first patched 1.83.2)

⚠️ Cannot fix in this PR

These are still live on VESPANG-3395. None of them has a fixed release yet:

Project	Package	CVE	Reason
visual-retrieval-colpali	authlib @ 1.8.0	CVE-2026-96760	1.8.0 is the latest release and is still affected; the fix is in unreleased authlib/authlib#938
visual-retrieval-colpali	tokenizers @ 0.23.x	CVE-2026-85670	the latest release is still affected
agentic-streamlit-chatbot	langchain_community @ 0.4.2	CVE-2026-72848	0.4.2 is the latest release
(various)	peft / torchvision	CVE-2026-71281 / CVE-2026-65918	peft has no fixed release; torchvision 0.29.0 is blocked by colpali-engine's torch cap

Supersedes

• chore(deps): update module google.golang.org/grpc to v1.83.2 [security] - autoclosed #2009 (Renovate: grpc 1.83.2) — same change, included here

Implementation Notes

• junit-jupiter in book-search stays on 5.14.4. 6.x is a major bump, and the test scope can't be resolved outside Vespa: ai.vespa:vespa-testcontainers:1.0.0 isn't on Maven Central (see the book-search README). So a 6.x bump can't be checked here.
• slf4j-simple stays on 2.0.20. The only newer version is 2.1.0-alpha1.
• The Go example only gets the grpc bump, like Renovate. A full go get -u sweep raises the go directive to 1.26, and the README deploys with --runtime=go119, so it would also mean changing the documented runtime. Note that the example has no go.sum on master, so go build fails there with or without this change.

Verification

All builds ran in throwaway containers:

• client-java (gradle:jdk21): gradle :app:dependencies --configuration runtimeClasspath shows jackson-core:2.22.3 and Bouncy Castle 1.86, and gradle build passes.
• book-search (maven:3-eclipse-temurin-17): mvn dependency:tree shows jackson-core:2.22.3 and Bouncy Castle 1.86, and mvn compile passes. This used a copy without the unpublished vespa-testcontainers test dependency, so the tests were not compiled or run.
• Neither example is in the root mvn install CI build.
• After merge, re-run the Mend scan to confirm the listed CVEs clear.

PR authored by the auto security-workflow skill.

🤖 Generated with Claude Code

[radu-gheorghe]

LGTM