Know what is inside every image

Pick a service and a version in Jira, or let it run by itself at sprint start and at code freeze. Every package, its license and every known vulnerability land in Confluence. Critical and High findings become one Jira ticket and one e-mail.

From “someone please run Trivy” to one page in Jira

Before by hand, per request

  1. Pull the image and run a scanner locally
  2. Numbers differ by scanner and by day
  3. Paste the results into a spreadsheet for the customer
  4. Open Jira tickets for the findings by hand

Now one button, in Jira or Confluence

GENERATE REPORT

You pick the service and a tag that Harbor has.

SPRINT · CODE FREEZE

Jira scans every service by itself when a sprint starts and when a Release check is created.

Then, with no clicks:

  • Report in Confluence
  • Excel, PDF and SBOM
  • Changes since last scan
  • DEV ticket and e-mail

How it works

  1. 1

    Request

    Pick a service and a tag in Apps → Dependency reports. Or a sprint starts, or a Release check is created.

    Requester
  2. 2

    Check

    The tag is checked against Harbor three times. A missing tag is never scanned.

    Automatic
  3. 3

    Scan

    syft lists every package, Trivy finds known vulnerabilities. 2–5 minutes.

    Automatic
  4. 4

    Publish

    A new dated page in Confluence with Excel, PDF and SBOM attached.

    Automatic
  5. 5

    Ticket

    With Critical or High findings: one DEV ticket and one e-mail.

    Ticket owner

It also runs by itself

Twice per release, every service is scanned at its newest version tag in Harbor. Nobody presses anything. The reports go to Confluence like any other run.

Sprint start

A sprint is started in Jira

DEV Sprint 42· Start sprintStarted

The app gets the Jira “sprint started” event. No Automation rule needed.

Code freeze

A Release check ticket is created

DEV-2685Release check 7.1.1Created

Any new issue of type Release check starts the same scan, so the reports are fresh at the release point.

UI BackendPortalsFT Device NetworkACSNorthbound APIService APIProvision APIProvision PortalFT System MetricsFT Configs ServiceFT Configs UI
11 new scan pages in Confluence A DEV ticket per image with Critical or High One e-mail: Sprint start — DEV Sprint 42

IllustrationBranch tags like dev or main_0.0.51 are skipped. Each service is scanned at its highest version tag.

Requester: pick a service and a version

Jira or Confluence → Apps → Dependency reports. The page is not tied to an issue. Anyone with Jira access can open it.

Apps › Dependency reports

One service

Every package, its license and known vulnerabilities, published to Confluence.

Choose a serviceUI Backend (ui/backend)
Choose a tagv7.1.1-b0.0.3 · 2026-09-24 14:02
v7.1.1-b0.0.3 2026-09-24
v7.1.1-b0.0.2 2026-09-19
v7.1.0-b0.0.9 2026-09-02
v7.1.0-b0.0.8 2026-08-28
high
Generate report Choose a tag, or type one and press Check.ui/backend:v7.1.1-b0.0.3
Dependencies — ui/backend v7.1.1-b0.0.3 ✓Started, waiting for GitHub to list the run… GitHub run
IllustrationPick the service and a tag, then Generate report. The page follows the run.
  • Tags come from HarborNewest first, with the push date. Or type a tag or a sha256: digest and press Check. The button unlocks only if Harbor has it.
  • Severity filters the page and the PDFThe default is high. The Excel file always has every finding.
  • Optional Jira issueEnter DEV-1234 and the link to the report is added there as a comment.
  • Prefer GitHub?Service repository → Actions → Dependency report → Run workflow. The same report.
Apps › Dependency reports

All services at once

Newest version of every service (Harbor)
ServiceTagResult
UI Backendv7.1.1-b0.0.3queued
Portalsv7.1.1-b0.0.4queued
FT Device Networkv1.0.3-b0.0.1queued
ACSv7.1.1-b0.0.2queued
… 7 more
Start for allOne summary e-mail follows.
IllustrationEvery service in one go.

Or all services at once

  • The same run as at sprint start and code freezeNewest version of every service, one GitHub run, one summary e-mail. Here you start it by hand.
  • Or a past releasePick a release or a sprint to scan exactly what was shipped then.
  • One e-mail for the batchEvery service, its counts and its ticket. A failed service is listed as failed; the others go on.

Reading a report

One page per scan: status, counts, what changed since the previous scan of the same tag, the findings and the files.

Confluence › PSEC › ui/backend v7.1.1-b0.0.3

Dependencies — ui/backend v7.1.1-b0.0.3 · 2026-09-26 10:15 UTC

Red1 214 components · digest sha256:4f1c…a92e.xlsx.pdf.spdx.json
Critical0(+1)
High0(+2)
Medium0(0)
Low0(−1)
Changes since the previous scan (2026-09-20) Image unchanged (same digest). Only the vulnerability database changed. New: CVE-2026-41293 · CVE-2026-22732 · CVE-2026-31055
IDSeverityPackageInstalledFixed inCVSS
CVE-2026-41293Criticaltomcat-embed-core10.1.4610.1.559.8
CVE-2025-14813Criticalbcprov-jdk18on1.721.80.29.1
CVE-2026-22732Highspring-security-web6.5.56.5.98.1
CVE-2026-31055Highnetty-codec-http4.1.1184.1.1247.5
CVE-2025-0913Highlibssl33.0.15—7.4
ExampleA number like 14 (+2) is the change from the previous scan of the same tag.

Status and fixes

Red
At least one Critical finding.
Yellow
High findings, no Critical.
Green
No Critical and no High.
Fixed in
A version that fixes the finding. Empty means no fix is published yet.
Changes since the previous scanCounts before and after, Critical and High that are new or gone, and whether the image changed or only the advisories.
ExcelFour sheets: Summary, Vulnerabilities, Components, Licenses.
PDF and SBOMThe page, printable. SPDX JSON for customers and their tools.
LevelCVSS v3Meaning
Critical9.0–10.0Usually remotely exploitable with severe impact.
High7.0–8.9Serious; exploitation may need specific conditions.
Medium4.0–6.9Limited impact or hard to exploit.
Low0.1–3.9Minor.

Ticket owner: one ticket per image version

Not one per CVE. The ticket lists every package with Critical or High findings, its CVEs and the version that fixes all of them.

friendly-tech.atlassian.net › DEV-3214
Spaces / Development / DEV-3214

Angular Project > Backend > Vulnerabilities > v7.1.1-b0.0.3 > 10 critical, 14 high in 6 packages

+ AddLink issueApps
Description
What

The dependency report of ui/backend:v7.1.1-b0.0.3 (2026-09-26 10:15 UTC) found 10 critical and 14 high vulnerabilities in 6 packages. 5 of them can be fixed by upgrading to the version in the last column.

Findings by package
PackageInstalledCriticalHighVulnerabilities (C = critical)Upgrade to
tomcat-embed-core10.1.4634CVE-2026-41293 (C), CVE-2026-24734 (C), CVE-2025-55752 (C), CVE-2025-48988, …10.1.55
bcprov-jdk18on1.7221CVE-2025-14813 (C), CVE-2024-30172 (C), CVE-2024-298571.80.2
netty-codec-http4.1.11823CVE-2026-31055 (C), CVE-2025-58056 (C), CVE-2025-55163, …4.1.124
spring-security-web6.5.512CVE-2026-22732 (C), CVE-2025-41248, CVE-2025-412496.5.9
jackson-databind2.15.212CVE-2025-52999 (C), CVE-2025-49128, CVE-2025-491242.18.4
libssl33.0.1512CVE-2025-9230 (C), CVE-2025-9231, CVE-2025-9232no fix yet
What to do
  1. Upgrade each package to the Upgrade to version or later (directly, or through the dependency that brings it in). One upgrade fixes every vulnerability in its row.
  2. Where there is no fix yet: assess whether the vulnerable code is reachable in this service; mitigate or accept, and note the decision here.
  3. Rebuild the image and run the dependency report on the new tag. Done when these rows are gone.
Links

Created by the dependency report (ft-internal-tools). A rescan of the same tag comments here with the current table instead of opening a new ticket.

Activity
AllCommentsHistory
CI
CI account · 7 days later
Rescan of ui/backend:v7.1.1-b0.0.3 (2026-10-03 08:12 UTC): 9 critical, 12 high. Report
+ the current findings table
[Dependency report] ui/backend v7.1.1-b0.0.3: 10 critical, 14 high — DEV-3214To Vadim Kasperovich, Vadym Komar, Vladimir Litman
VKVKVL
ExampleThe ticket is filled in the way DEV bugs are. The numbers are sample data. The next scan of the same tag only adds a comment.
  • Priority from the findingsHighest with any Critical, otherwise High. Assigned to Vadym Komar. Sprint and Fix version stay with the PM.
  • One e-mailTo Vadim Kasperovich, Vadym Komar and Vladimir Litman: the counts, the report link and the ticket.
  • Done when the rows are goneUpgrade each package to its Upgrade to version, rebuild, and run the report on the new tag.
Same tag again
The open ticket gets a comment with the current table. No new ticket.
Back after close
A new ticket, linked “relates to” the closed one.
Nothing to fix
No Critical or High: no ticket and no e-mail. The report is still published.

Where the reports are

Confluence space PSEC. A rescan of the same tag adds a new dated page. Earlier scans are never overwritten.

Dependency and Vulnerability Reportsone row per service
Dependencies — ui/backendversions, last 3 scans
… ui/backend v7.1.1-b0.0.3every scan of this tag
… v7.1.1-b0.0.3 · 2026-09-20report + files
… v7.1.1-b0.0.3 · 2026-09-26New
IllustrationOpen the reports in Confluence
  • IndexEvery service: status, latest version and counts.
  • Service, version, scanGo down to any scan of any tag. Each scan has its own Excel, PDF and SBOM.
  • Do not edit the upper pagesIndex, service and version pages are rebuilt after every scan. Scan pages can be edited.

Services covered

UI Backendui/backendoneiot_web_backend → Run workflow Portalsui/portalsoneiot_angular → Run workflow FT Device Networkftacs/ft-device-network-serviceft-device-network → Run workflow ACSftacs/ftacsoneiot_backend → Run workflow Northbound APIapi/northbound-apinorthbound-api → Run workflow Service APIapi/service-apiservice-api → Run workflow Provision APIapi/provision-portalprovision-portal → Run workflow Provision Portalui/provision-portalprovision-portal_angular → Run workflow FT System Metricsmonitoring/ft-system-metricsft-system-metrics → Run workflow FT Configs Serviceconfigs/ft-configs-serviceft-configs-service → Run workflow FT Configs UIconfigs/ft-configs-uift-configs-ui → Run workflow

When something goes wrong

It stops early and says why. Nothing half-done is left behind.

FailedThe tag is not in Harbor

  • The page's Check does not unlock the button
  • The app checks again before it starts anything
  • The workflow stops in seconds and lists the newest tags

Partly doneConfluence or Jira answered with an error

  • The run fails with the method, path and status
  • Run it again: a half-done publish is repaired
  • Two runs for one image wait in a queue, never cancel each other

Questions we get

Why do the numbers differ from Harbor?

Both use Trivy. The report downloads the newest vulnerability database on every run; Harbor shows its last scan. Press Scan vulnerability in Harbor first to compare.

Why does the same tag change from day to day?

New advisories come out every day. The Changes block says whether the image changed or only the advisories.

Can a report fail a build?

No. Reports run on request or at sprint start. Image builds do not wait for them.

A Critical has no Fixed in. What now?

No fixed version exists yet. Check whether the vulnerable code is reachable, mitigate or accept, and write the decision on the ticket.

Can I edit the pages in Confluence?

Scan pages can be edited. The index, service and version pages are rebuilt after every scan, so manual edits on them are lost.

How do I add a service?

One line in the Jira app and one workflow file in the repository. See Adding a service in the SDD.

Questions?

Run a report on the service you work on. Tell us what was unclear, missing or wrong.

How it is builtWorkflows, Confluence pages and decisions in the SDD.
All reportsIndex, history and files in Confluence PSEC.
Add a serviceOne line in the app and one workflow file in the repository.
Open the reports in Confluence