Play Framework

build: scan the jars the release ships for known vulnerabilities (PF-195)

Nothing scanned framework/lib for known vulnerabilities, and since PF-192
the applications' own dependency-check scans no longer see those
libraries either, because Gradle no longer resolves them.

`ant dependency-check` runs OWASP dependency-check 12.2.2 over every jar
the release zip carries: framework/lib, play-<version>.jar, the bundled
modules' lib/ and firephoque, the Gradle wrapper, and the gradle-plugin
jar `ant package` publishes, which the target builds first. It fails at
CVSS 7.0. The plugin runs in a Gradle build of its own,
framework/dependency-check/, because on the root build every `play new`
from a distribution would resolve it. It shares
~/.gradle/dependency-check-data with the applications' scans (the
nightly Jenkins job keeps that current there), refreshes it once a day
old, and -Dnvd.update=false scans what is there. The analyze task is
never up to date: its check sees neither the scanned directories nor the
NVD data, and it passed without scanning after a jar was added. Not part
of `ant test`, since CI has no NVD data; /deploy runs it before
publishing and /renovate after a resolve.

framework/dependency-check-suppressions.xml ships in the zip for
applications that scan framework/lib. It suppresses, each by file path
and with its reason: Micrometer's Prometheus registry matched to the
Prometheus server, a Python-only protobuf CVE, five OpenTelemetry CVEs
filed against its Go, .NET, C++ and JavaScript implementations, the
fork's own gradle-plugin jar matched to Gradle, and three Jetty CVEs in
server code that HtmlUnit's shaded websocket client does not contain.
CVE-2026-2332, in that client's HTTP/1.1 parser, is risk-accepted until
2027-01-31; PF-196 moves FirePhoque to HtmlUnit 5 and Jetty 12.

The scan also found what the ticket's list missed:
- firephoque carried eleven jars HtmlUnit 4.14.0 does not use, leftovers
  of HtmlUnit 2.23: six standalone Jetty 9.4.57 jars, Xalan, serializer,
  xml-apis, commons-collections and xercesImpl. They are removed; `play
  autotest` passes on an application from `play new`.
- lib-test held Ant 1.10.17 (CVE-2026-78254), now 1.10.18. lib-test
  shipped in the zip by accident, of no use without test-src, and now
  stays out of it.

documentation/manual/dependency.textile says how an application adds
framework/lib and the shipped file to its own dependency-check, with the
two traps: only setScanSet(...) configures the scan set, and a jar from a
directory has a package URL only when it embeds Maven metadata, so match
it by filePath.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>