chore(deps): update non-major dependencies by renovate-wenisch-tech[bot] · Pull Request #47 · wenisch-tech/proxera

renovate-wenisch-tech · 2026-07-20T16:04:36Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout (changelog)	action	digest	`df4cb1c` → `d23441a`
docker/login-action (changelog)	action	digest	`af1e73f` → `dbcb813`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

github-actions · 2026-07-20T16:07:28Z

Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.275

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18080/actuator/health	200	195ms
✅ Admin Health	http://localhost:18080/actuator/health	200	16ms
✅ Admin Login	http://localhost:18080/login	200	301ms
✅ Admin Dashboard	http://localhost:18080/admin/	302	22ms

Container logs (last 50 lines):

2026-07-20T16:07:01.281Z  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
2026-07-20T16:07:01.297Z  INFO 1 --- [           main] org.flywaydb.core.FlywayExecutor         : Database: jdbc:h2:file:./data/proxera (H2 2.4)
2026-07-20T16:07:01.367Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-20T16:07:01.409Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-20T16:07:01.412Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.022s)
2026-07-20T16:07:01.423Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-20T16:07:01.425Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-20T16:07:01.466Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-20T16:07:01.482Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-20T16:07:01.516Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-20T16:07:01.526Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-20T16:07:01.536Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-20T16:07:01.563Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-20T16:07:01.570Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-20T16:07:01.580Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-20T16:07:01.589Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-20T16:07:01.593Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-20T16:07:01.604Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.071s)
2026-07-20T16:07:01.753Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-20T16:07:01.825Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-20T16:07:02.410Z  INFO 1 --- [           main] o.s.o.j.p.SpringPersistenceUnitInfo      : No LoadTimeWeaver setup: ignoring JPA class transformer
2026-07-20T16:07:02.496Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-20T16:07:03.587Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-20T16:07:03.595Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-20T16:07:03.671Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-20T16:07:03.941Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-20T16:07:05.003Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-20T16:07:05.295Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-20T16:07:05.531Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-20T16:07:06.087Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-20T16:07:06.159Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-20T16:07:06.257Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-20T16:07:06.280Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 9.033 seconds (process running for 9.772)
2026-07-20T16:07:06.508Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-20T16:07:06.678Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-20T16:07:26.558Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-20T16:07:26.559Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-20T16:07:26.560Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-20T16:07:26.615Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3463,"ExitCode":0,"Error":"","StartedAt":"2026-07-20T16:06:56.234276654Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-20T16:07:58Z

Trivy vulnerability report

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.275


Report Summary

┌─────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
│                             Target                              │ Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.275 (wolfi 20230201) │ wolfi │        0        │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ app/app.jar                                                     │  jar  │        1        │
└─────────────────────────────────────────────────────────────────┴───────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


Java (jar)
==========
Total: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌───────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬────────────────────────────────────────────────────────────┐
│                        Library                        │ Vulnerability  │ Severity │ Status │ Installed Version │         Fixed Version         │                           Title                            │
├───────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (app.jar) │ CVE-2026-54515 │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can │
│                                                       │                │          │        │                   │                               │ be unexpectedly modified                                   │
│                                                       │                │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                 │
└───────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴────────────────────────────────────────────────────────────┘

github-actions · 2026-07-20T16:16:26Z

Trivy vulnerability report (native-distroless)

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.275


Report Summary

┌─────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
│                                     Target                                      │  Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.275 (debian 12.15) │ debian │        4        │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ app/proxera.jar                                                                 │  jar   │        1        │
└─────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.275 (debian 12.15)
===============================================================================
Total: 4 (MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435 │ MEDIUM   │ affected │ 2.36-9+deb12u14   │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450 │          │          │                   │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │               │          │          │                   │               │ format specifier and...                                      │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928 │          │          │                   │               │ glibc: glibc: Information disclosure or denial of service    │
│         │               │          │          │                   │               │ via ungetwc function with...                                 │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238 │          │          │                   │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │               │          │          │                   │               │ via crafted DNS response...                                  │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
└─────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Java (jar)
==========
Total: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌───────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬────────────────────────────────────────────────────────────┐
│                          Library                          │ Vulnerability  │ Severity │ Status │ Installed Version │         Fixed Version         │                           Title                            │
├───────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (proxera.jar) │ CVE-2026-54515 │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can │
│                                                           │                │          │        │                   │                               │ be unexpectedly modified                                   │
│                                                           │                │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                 │
└───────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴────────────────────────────────────────────────────────────┘

github-actions · 2026-07-20T16:16:26Z

Native Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.275

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18081/actuator/health	200	32ms
✅ Admin Health	http://localhost:18081/actuator/health	200	8ms
✅ Admin Login	http://localhost:18081/login	200	39ms
✅ Admin Dashboard	http://localhost:18081/admin/	302	9ms

Container logs (last 50 lines):

2026-07-20T16:14:56.009Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-20T16:14:56.009Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-20T16:14:56.045Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-20T16:14:56.048Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-20T16:14:56.048Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.002s)
2026-07-20T16:14:56.048Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-20T16:14:56.048Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-20T16:14:56.050Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-20T16:14:56.052Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-20T16:14:56.053Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-20T16:14:56.054Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-20T16:14:56.055Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-20T16:14:56.058Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-20T16:14:56.058Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-20T16:14:56.059Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-20T16:14:56.060Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-20T16:14:56.061Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-20T16:14:56.062Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.002s)
2026-07-20T16:14:56.070Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-20T16:14:56.073Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-20T16:14:56.088Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-20T16:14:56.112Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-20T16:14:56.113Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-20T16:14:56.121Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-20T16:14:56.145Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-20T16:14:56.170Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-20T16:14:56.198Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-20T16:14:56.223Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-20T16:14:56.327Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-20T16:14:56.329Z  WARN 1 --- [           main] i.m.c.i.binder.jvm.JvmGcMetrics          : GC notifications will not be available because no GarbageCollectorMXBean of the JVM provides any. GCs=[young generation scavenger, complete scavenger]
2026-07-20T16:14:56.334Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-20T16:14:56.341Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-20T16:14:56.342Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 0.455 seconds (process running for 0.464)
2026-07-20T16:14:56.352Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-20T16:14:56.433Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-20T16:15:25.911Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-20T16:15:25.911Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-20T16:15:25.912Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-20T16:15:25.915Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3943,"ExitCode":0,"Error":"","StartedAt":"2026-07-20T16:14:55.642116191Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-23T16:05:43Z

Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.279

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18080/actuator/health	200	214ms
✅ Admin Health	http://localhost:18080/actuator/health	200	14ms
✅ Admin Login	http://localhost:18080/login	200	246ms
✅ Admin Dashboard	http://localhost:18080/admin/	302	18ms

Container logs (last 50 lines):

2026-07-23T16:05:15.293Z  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
2026-07-23T16:05:15.308Z  INFO 1 --- [           main] org.flywaydb.core.FlywayExecutor         : Database: jdbc:h2:file:./data/proxera (H2 2.4)
2026-07-23T16:05:15.370Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-23T16:05:15.409Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-23T16:05:15.413Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.021s)
2026-07-23T16:05:15.422Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-23T16:05:15.424Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-23T16:05:15.464Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-23T16:05:15.482Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-23T16:05:15.512Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-23T16:05:15.523Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-23T16:05:15.532Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-23T16:05:15.558Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-23T16:05:15.563Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-23T16:05:15.571Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-23T16:05:15.580Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-23T16:05:15.584Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-23T16:05:15.596Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.067s)
2026-07-23T16:05:15.738Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-23T16:05:15.818Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-23T16:05:16.304Z  INFO 1 --- [           main] o.s.o.j.p.SpringPersistenceUnitInfo      : No LoadTimeWeaver setup: ignoring JPA class transformer
2026-07-23T16:05:16.420Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-23T16:05:17.467Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-23T16:05:17.476Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-23T16:05:17.546Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-23T16:05:17.794Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-23T16:05:18.785Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-23T16:05:19.057Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-23T16:05:19.301Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-23T16:05:19.785Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-23T16:05:19.846Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-23T16:05:19.942Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-23T16:05:19.966Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 8.639 seconds (process running for 9.315)
2026-07-23T16:05:20.136Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-23T16:05:20.368Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-23T16:05:40.707Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-23T16:05:40.708Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-23T16:05:40.709Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-23T16:05:40.786Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3455,"ExitCode":0,"Error":"","StartedAt":"2026-07-23T16:05:10.381644528Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-23T16:06:18Z

Trivy vulnerability report

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.279


Report Summary

┌─────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
│                             Target                              │ Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.279 (wolfi 20230201) │ wolfi │        0        │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ app/app.jar                                                     │  jar  │        5        │
└─────────────────────────────────────────────────────────────────┴───────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


Java (jar)
==========
Total: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                        Library                        │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (app.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                       │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                       │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                       │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (app.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                       │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                       │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (app.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-23T16:13:36Z

Trivy vulnerability report (native-distroless)

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.279


Report Summary

┌─────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
│                                     Target                                      │  Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.279 (debian 12.15) │ debian │        4        │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ app/proxera.jar                                                                 │  jar   │        5        │
└─────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.279 (debian 12.15)
===============================================================================
Total: 4 (MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435 │ MEDIUM   │ affected │ 2.36-9+deb12u14   │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450 │          │          │                   │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │               │          │          │                   │               │ format specifier and...                                      │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928 │          │          │                   │               │ glibc: glibc: Information disclosure or denial of service    │
│         │               │          │          │                   │               │ via ungetwc function with...                                 │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238 │          │          │                   │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │               │          │          │                   │               │ via crafted DNS response...                                  │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
└─────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Java (jar)
==========
Total: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                          Library                          │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (proxera.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                           │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                           │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                           │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (proxera.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                           │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                           │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (proxera.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-23T16:13:37Z

Native Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.279

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18081/actuator/health	200	17ms
✅ Admin Health	http://localhost:18081/actuator/health	200	7ms
✅ Admin Login	http://localhost:18081/login	200	31ms
✅ Admin Dashboard	http://localhost:18081/admin/	302	8ms

Container logs (last 50 lines):

2026-07-23T16:12:04.109Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-23T16:12:04.109Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-23T16:12:04.141Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-23T16:12:04.143Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-23T16:12:04.143Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.001s)
2026-07-23T16:12:04.143Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-23T16:12:04.143Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-23T16:12:04.144Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-23T16:12:04.145Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-23T16:12:04.146Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-23T16:12:04.147Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-23T16:12:04.147Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-23T16:12:04.149Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-23T16:12:04.150Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-23T16:12:04.150Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-23T16:12:04.151Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-23T16:12:04.151Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-23T16:12:04.152Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.001s)
2026-07-23T16:12:04.159Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-23T16:12:04.161Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-23T16:12:04.173Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-23T16:12:04.192Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-23T16:12:04.194Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-23T16:12:04.202Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-23T16:12:04.246Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-23T16:12:04.266Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-23T16:12:04.288Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-23T16:12:04.305Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-23T16:12:04.369Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-23T16:12:04.371Z  WARN 1 --- [           main] i.m.c.i.binder.jvm.JvmGcMetrics          : GC notifications will not be available because no GarbageCollectorMXBean of the JVM provides any. GCs=[young generation scavenger, complete scavenger]
2026-07-23T16:12:04.374Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-23T16:12:04.380Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-23T16:12:04.381Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 0.428 seconds (process running for 0.436)
2026-07-23T16:12:04.389Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-23T16:12:04.459Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-23T16:12:33.961Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-23T16:12:33.962Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-23T16:12:33.962Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 0 ms
2026-07-23T16:12:33.965Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3677,"ExitCode":0,"Error":"","StartedAt":"2026-07-23T16:12:03.853178026Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-24T13:05:58Z

Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.281

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18080/actuator/health	200	198ms
✅ Admin Health	http://localhost:18080/actuator/health	200	17ms
✅ Admin Login	http://localhost:18080/login	200	264ms
✅ Admin Dashboard	http://localhost:18080/admin/	302	19ms

Container logs (last 50 lines):

2026-07-24T13:05:31.147Z  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
2026-07-24T13:05:31.162Z  INFO 1 --- [           main] org.flywaydb.core.FlywayExecutor         : Database: jdbc:h2:file:./data/proxera (H2 2.4)
2026-07-24T13:05:31.226Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-24T13:05:31.265Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-24T13:05:31.268Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.021s)
2026-07-24T13:05:31.278Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-24T13:05:31.279Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-24T13:05:31.321Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-24T13:05:31.339Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-24T13:05:31.371Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-24T13:05:31.382Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-24T13:05:31.392Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-24T13:05:31.418Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-24T13:05:31.423Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-24T13:05:31.432Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-24T13:05:31.440Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-24T13:05:31.445Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-24T13:05:31.457Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.072s)
2026-07-24T13:05:31.598Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-24T13:05:31.670Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-24T13:05:32.292Z  INFO 1 --- [           main] o.s.o.j.p.SpringPersistenceUnitInfo      : No LoadTimeWeaver setup: ignoring JPA class transformer
2026-07-24T13:05:32.384Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-24T13:05:33.480Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-24T13:05:33.490Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-24T13:05:33.570Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-24T13:05:33.825Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-24T13:05:34.838Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-24T13:05:35.135Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-24T13:05:35.378Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-24T13:05:35.896Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-24T13:05:35.964Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-24T13:05:36.066Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-24T13:05:36.092Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 9.041 seconds (process running for 9.754)
2026-07-24T13:05:36.322Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-24T13:05:36.477Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-24T13:05:56.387Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-24T13:05:56.387Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-24T13:05:56.389Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 2 ms
2026-07-24T13:05:56.451Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3441,"ExitCode":0,"Error":"","StartedAt":"2026-07-24T13:05:26.212618575Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-24T13:06:25Z

Trivy vulnerability report

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.281


Report Summary

┌─────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
│                             Target                              │ Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.281 (wolfi 20230201) │ wolfi │        0        │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ app/app.jar                                                     │  jar  │        5        │
└─────────────────────────────────────────────────────────────────┴───────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


Java (jar)
==========
Total: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                        Library                        │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (app.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                       │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                       │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                       │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (app.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                       │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                       │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (app.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-24T13:15:24Z

Trivy vulnerability report (native-distroless)

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.281


Report Summary

┌─────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
│                                     Target                                      │  Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.281 (debian 12.15) │ debian │        4        │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ app/proxera.jar                                                                 │  jar   │        5        │
└─────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.281 (debian 12.15)
===============================================================================
Total: 4 (MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435 │ MEDIUM   │ affected │ 2.36-9+deb12u14   │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450 │          │          │                   │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │               │          │          │                   │               │ format specifier and...                                      │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928 │          │          │                   │               │ glibc: glibc: Information disclosure or denial of service    │
│         │               │          │          │                   │               │ via ungetwc function with...                                 │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238 │          │          │                   │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │               │          │          │                   │               │ via crafted DNS response...                                  │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
└─────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Java (jar)
==========
Total: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                          Library                          │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (proxera.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                           │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                           │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                           │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (proxera.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                           │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                           │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (proxera.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-24T13:15:25Z

Native Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.281

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18081/actuator/health	200	18ms
✅ Admin Health	http://localhost:18081/actuator/health	200	7ms
✅ Admin Login	http://localhost:18081/login	200	38ms
✅ Admin Dashboard	http://localhost:18081/admin/	302	9ms

Container logs (last 50 lines):

2026-07-24T13:13:50.081Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-24T13:13:50.081Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-24T13:13:50.120Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-24T13:13:50.122Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-24T13:13:50.122Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.001s)
2026-07-24T13:13:50.122Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-24T13:13:50.122Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-24T13:13:50.123Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-24T13:13:50.125Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-24T13:13:50.126Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-24T13:13:50.127Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-24T13:13:50.128Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-24T13:13:50.131Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-24T13:13:50.131Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-24T13:13:50.132Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-24T13:13:50.133Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-24T13:13:50.134Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-24T13:13:50.135Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.003s)
2026-07-24T13:13:50.144Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-24T13:13:50.147Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-24T13:13:50.163Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-24T13:13:50.187Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-24T13:13:50.189Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-24T13:13:50.197Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-24T13:13:50.223Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-24T13:13:50.252Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-24T13:13:50.283Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-24T13:13:50.309Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-24T13:13:50.420Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-24T13:13:50.423Z  WARN 1 --- [           main] i.m.c.i.binder.jvm.JvmGcMetrics          : GC notifications will not be available because no GarbageCollectorMXBean of the JVM provides any. GCs=[young generation scavenger, complete scavenger]
2026-07-24T13:13:50.428Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-24T13:13:50.436Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-24T13:13:50.437Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 0.514 seconds (process running for 0.526)
2026-07-24T13:13:50.448Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-24T13:13:50.529Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-24T13:14:19.945Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-24T13:14:19.945Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-24T13:14:19.946Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-24T13:14:19.949Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3881,"ExitCode":0,"Error":"","StartedAt":"2026-07-24T13:13:49.769531404Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-28T08:05:57Z

Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.283

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18080/actuator/health	200	185ms
✅ Admin Health	http://localhost:18080/actuator/health	200	14ms
✅ Admin Login	http://localhost:18080/login	200	260ms
✅ Admin Dashboard	http://localhost:18080/admin/	302	19ms

Container logs (last 50 lines):

2026-07-28T08:05:29.936Z  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
2026-07-28T08:05:29.949Z  INFO 1 --- [           main] org.flywaydb.core.FlywayExecutor         : Database: jdbc:h2:file:./data/proxera (H2 2.4)
2026-07-28T08:05:30.007Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-28T08:05:30.045Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-28T08:05:30.048Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.020s)
2026-07-28T08:05:30.058Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-28T08:05:30.059Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-28T08:05:30.097Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-28T08:05:30.113Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-28T08:05:30.144Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-28T08:05:30.154Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-28T08:05:30.165Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-28T08:05:30.192Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-28T08:05:30.196Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-28T08:05:30.205Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-28T08:05:30.213Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-28T08:05:30.217Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-28T08:05:30.226Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.066s)
2026-07-28T08:05:30.371Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-28T08:05:30.445Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-28T08:05:31.060Z  INFO 1 --- [           main] o.s.o.j.p.SpringPersistenceUnitInfo      : No LoadTimeWeaver setup: ignoring JPA class transformer
2026-07-28T08:05:31.130Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-28T08:05:32.186Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-28T08:05:32.194Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-28T08:05:32.263Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-28T08:05:32.519Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-28T08:05:33.568Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-28T08:05:33.859Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-28T08:05:34.140Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-28T08:05:34.621Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-28T08:05:34.684Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-28T08:05:34.778Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-28T08:05:34.807Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 8.791 seconds (process running for 9.5)
2026-07-28T08:05:35.001Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-28T08:05:35.148Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-28T08:05:55.353Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-28T08:05:55.354Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-28T08:05:55.355Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-28T08:05:55.410Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3359,"ExitCode":0,"Error":"","StartedAt":"2026-07-28T08:05:25.176224499Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-28T08:06:23Z

Trivy vulnerability report

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.283


Report Summary

┌─────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
│                             Target                              │ Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.283 (wolfi 20230201) │ wolfi │        0        │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ app/app.jar                                                     │  jar  │        6        │
└─────────────────────────────────────────────────────────────────┴───────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


Java (jar)
==========
Total: 6 (MEDIUM: 5, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                        Library                        │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (app.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                       │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                       │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                       │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-dns (app.jar)                    │ GHSA-mfg7-5gfp-c4w3 │          │        │ 4.2.15.Final      │ 4.2.16.Final, 4.1.136.Final   │ Netty: Memory Leak in DNS Record Decoder via Malformed      │
│                                                       │                     │          │        │                   │                               │ Domain Names                                                │
│                                                       │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mfg7-5gfp-c4w3           │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (app.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                       │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                       │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (app.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-28T08:14:43Z

Trivy vulnerability report (native-distroless)

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.283


Report Summary

┌─────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
│                                     Target                                      │  Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.283 (debian 12.15) │ debian │        4        │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ app/proxera.jar                                                                 │  jar   │        6        │
└─────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.283 (debian 12.15)
===============================================================================
Total: 4 (MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435 │ MEDIUM   │ affected │ 2.36-9+deb12u14   │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450 │          │          │                   │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │               │          │          │                   │               │ format specifier and...                                      │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928 │          │          │                   │               │ glibc: glibc: Information disclosure or denial of service    │
│         │               │          │          │                   │               │ via ungetwc function with...                                 │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238 │          │          │                   │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │               │          │          │                   │               │ via crafted DNS response...                                  │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
└─────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Java (jar)
==========
Total: 6 (MEDIUM: 5, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                          Library                          │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (proxera.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                           │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                           │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                           │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-dns (proxera.jar)                    │ GHSA-mfg7-5gfp-c4w3 │          │        │ 4.2.15.Final      │ 4.2.16.Final, 4.1.136.Final   │ Netty: Memory Leak in DNS Record Decoder via Malformed      │
│                                                           │                     │          │        │                   │                               │ Domain Names                                                │
│                                                           │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mfg7-5gfp-c4w3           │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (proxera.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                           │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                           │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (proxera.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-28T08:14:44Z

Native Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.283

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18081/actuator/health	200	18ms
✅ Admin Health	http://localhost:18081/actuator/health	200	8ms
✅ Admin Login	http://localhost:18081/login	200	38ms
✅ Admin Dashboard	http://localhost:18081/admin/	302	8ms

Container logs (last 50 lines):

2026-07-28T08:13:17.157Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-28T08:13:17.157Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-28T08:13:17.193Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-28T08:13:17.196Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-28T08:13:17.196Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.001s)
2026-07-28T08:13:17.196Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-28T08:13:17.196Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-28T08:13:17.197Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-28T08:13:17.198Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-28T08:13:17.200Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-28T08:13:17.201Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-28T08:13:17.202Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-28T08:13:17.204Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-28T08:13:17.205Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-28T08:13:17.205Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-28T08:13:17.206Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-28T08:13:17.207Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-28T08:13:17.208Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.002s)
2026-07-28T08:13:17.216Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-28T08:13:17.219Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-28T08:13:17.234Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-28T08:13:17.258Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-28T08:13:17.260Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-28T08:13:17.267Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-28T08:13:17.291Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-28T08:13:17.316Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-28T08:13:17.343Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-28T08:13:17.369Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-28T08:13:17.471Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-28T08:13:17.473Z  WARN 1 --- [           main] i.m.c.i.binder.jvm.JvmGcMetrics          : GC notifications will not be available because no GarbageCollectorMXBean of the JVM provides any. GCs=[young generation scavenger, complete scavenger]
2026-07-28T08:13:17.478Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-28T08:13:17.485Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-28T08:13:17.486Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 0.503 seconds (process running for 0.521)
2026-07-28T08:13:17.497Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-28T08:13:17.581Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-28T08:13:46.985Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-28T08:13:46.985Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-28T08:13:46.986Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-28T08:13:46.989Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3900,"ExitCode":0,"Error":"","StartedAt":"2026-07-28T08:13:16.836271062Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-29T13:05:53Z

Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.285

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18080/actuator/health	200	156ms
✅ Admin Health	http://localhost:18080/actuator/health	200	11ms
✅ Admin Login	http://localhost:18080/login	200	185ms
✅ Admin Dashboard	http://localhost:18080/admin/	302	15ms

Container logs (last 50 lines):

2026-07-29T13:05:24.164Z  INFO 1 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
2026-07-29T13:05:24.177Z  INFO 1 --- [           main] org.flywaydb.core.FlywayExecutor         : Database: jdbc:h2:file:./data/proxera (H2 2.4)
2026-07-29T13:05:24.236Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-29T13:05:24.270Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-29T13:05:24.273Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.018s)
2026-07-29T13:05:24.281Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-29T13:05:24.283Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-29T13:05:24.316Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-29T13:05:24.329Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-29T13:05:24.355Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-29T13:05:24.364Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-29T13:05:24.371Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-29T13:05:24.391Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-29T13:05:24.395Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-29T13:05:24.402Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-29T13:05:24.409Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-29T13:05:24.413Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-29T13:05:24.422Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.055s)
2026-07-29T13:05:24.542Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-29T13:05:24.601Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-29T13:05:25.083Z  INFO 1 --- [           main] o.s.o.j.p.SpringPersistenceUnitInfo      : No LoadTimeWeaver setup: ignoring JPA class transformer
2026-07-29T13:05:25.147Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-29T13:05:25.970Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-29T13:05:25.976Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-29T13:05:26.022Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-29T13:05:26.181Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-29T13:05:26.881Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-29T13:05:27.072Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-29T13:05:27.240Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-29T13:05:27.575Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-29T13:05:27.621Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-29T13:05:27.683Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-29T13:05:27.699Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 6.659 seconds (process running for 7.198)
2026-07-29T13:05:27.857Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-29T13:05:28.003Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-29T13:05:50.552Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-29T13:05:50.553Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-29T13:05:50.555Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 2 ms
2026-07-29T13:05:50.598Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3205,"ExitCode":0,"Error":"","StartedAt":"2026-07-29T13:05:20.39680518Z","FinishedAt":"0001-01-01T00:00:00Z"}

github-actions · 2026-07-29T13:06:22Z

Trivy vulnerability report

Image: ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.285


Report Summary

┌─────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
│                             Target                              │ Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:0.12.21-pr.47.285 (wolfi 20230201) │ wolfi │        0        │
├─────────────────────────────────────────────────────────────────┼───────┼─────────────────┤
│ app/app.jar                                                     │  jar  │        6        │
└─────────────────────────────────────────────────────────────────┴───────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


Java (jar)
==========
Total: 6 (MEDIUM: 5, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                        Library                        │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (app.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                       │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                       ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                       │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                       │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                       │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-dns (app.jar)                    │ GHSA-mfg7-5gfp-c4w3 │          │        │ 4.2.15.Final      │ 4.2.16.Final, 4.1.136.Final   │ Netty: Memory Leak in DNS Record Decoder via Malformed      │
│                                                       │                     │          │        │                   │                               │ Domain Names                                                │
│                                                       │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mfg7-5gfp-c4w3           │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (app.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                       │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                       │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (app.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                       │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                       │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-29T13:14:00Z

Trivy vulnerability report (native-distroless)

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.285


Report Summary

┌─────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
│                                     Target                                      │  Type  │ Vulnerabilities │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.285 (debian 12.15) │ debian │        4        │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┤
│ app/proxera.jar                                                                 │  jar   │        6        │
└─────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.285 (debian 12.15)
===============================================================================
Total: 4 (MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                             │
├─────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435 │ MEDIUM   │ affected │ 2.36-9+deb12u14   │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450 │          │          │                   │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │               │          │          │                   │               │ format specifier and...                                      │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928 │          │          │                   │               │ glibc: glibc: Information disclosure or denial of service    │
│         │               │          │          │                   │               │ via ungetwc function with...                                 │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├───────────────┤          │          │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238 │          │          │                   │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │               │          │          │                   │               │ via crafted DNS response...                                  │
│         │               │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
└─────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Java (jar)
==========
Total: 6 (MEDIUM: 5, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────┐
│                          Library                          │    Vulnerability    │ Severity │ Status │ Installed Version │         Fixed Version         │                            Title                            │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind (proxera.jar) │ CVE-2026-54515      │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can  │
│                                                           │                     │          │        │                   │                               │ be unexpectedly modified                                    │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ CVE-2026-59889      │          │        │                   │ 2.21.5, 2.18.9, 2.22.1        │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
│                                                           ├─────────────────────┤          │        │                   ├───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                                                           │ GHSA-mhm7-754m-9p8w │          │        │                   │ 2.18.9, 2.21.5                │ jackson-databind: `@JsonView` bypass for creator properties │
│                                                           │                     │          │        │                   │                               │ with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`          │
│                                                           │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mhm7-754m-9p8w           │
├───────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-dns (proxera.jar)                    │ GHSA-mfg7-5gfp-c4w3 │          │        │ 4.2.15.Final      │ 4.2.16.Final, 4.1.136.Final   │ Netty: Memory Leak in DNS Record Decoder via Malformed      │
│                                                           │                     │          │        │                   │                               │ Domain Names                                                │
│                                                           │                     │          │        │                   │                               │ https://github.com/advisories/GHSA-mfg7-5gfp-c4w3           │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.postgresql:postgresql (proxera.jar)                   │ CVE-2026-54291      │ HIGH     │        │ 42.7.11           │ 42.7.12                       │ org.postgresql/postgresql: com.ongres.scram/scram-client:   │
│                                                           │                     │          │        │                   │                               │ pgjdbc: Man-in-the-middle protection bypass via             │
│                                                           │                     │          │        │                   │                               │ SCRAM-SHA-256-PLUS downgrade                                │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54291                  │
├───────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tools.jackson.core:jackson-databind (proxera.jar)         │ CVE-2026-59889      │ MEDIUM   │        │ 3.1.4             │ 3.1.5, 3.2.1                  │ jackson-databind: @JsonView ypassed for @JsonUnwrapped      │
│                                                           │                     │          │        │                   │                               │ container properties on deserialization                     │
│                                                           │                     │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-59889                  │
└───────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-29T13:14:00Z

Native Container Endpoint Check

Image: ghcr.io/wenisch-tech/proxera:native-distroless-0.12.21-pr.47.285

Endpoint	URL	Status	Latency
✅ Proxy Health	http://localhost:18081/actuator/health	200	18ms
✅ Admin Health	http://localhost:18081/actuator/health	200	8ms
✅ Admin Login	http://localhost:18081/login	200	38ms
✅ Admin Dashboard	http://localhost:18081/admin/	302	8ms

Container logs (last 50 lines):

2026-07-29T13:12:26.571Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-29T13:12:26.571Z  WARN 1 --- [           main] o.f.c.i.s.classpath.ClassPathScanner     : Unable to scan location: /db/migration (unsupported protocol: resource)
2026-07-29T13:12:26.608Z  WARN 1 --- [           main] o.f.c.internal.database.base.Database    : Using H2 2.4.240 which is newer than the version Flyway has been verified with. The latest verified version of H2 is 2.3.232.
2026-07-29T13:12:26.610Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Schema history table "PUBLIC"."flyway_schema_history" does not exist yet
2026-07-29T13:12:26.610Z  INFO 1 --- [           main] o.f.core.internal.command.DbValidate     : Successfully validated 9 migrations (execution time 00:00.001s)
2026-07-29T13:12:26.611Z  INFO 1 --- [           main] org.flywaydb.core.Flyway                 : All configured schemas are empty; a baseline marker will not be added to Flyway's schema history table. A baseline or migration script with a lower version than the baseline version may execute if available. Check the Schemas parameter if this is not intended. See https://help.red-gate.com/help/flyway-cli12/help_4.aspx?topic=baseline-on-migrate for more info
2026-07-29T13:12:26.611Z  INFO 1 --- [           main] o.f.c.i.s.JdbcTableSchemaHistory         : Creating Schema History table "PUBLIC"."flyway_schema_history" ...
2026-07-29T13:12:26.612Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Current version of schema "PUBLIC": << Empty Schema >>
2026-07-29T13:12:26.613Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "1 - init"
2026-07-29T13:12:26.614Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "2 - add api key revoked"
2026-07-29T13:12:26.615Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "3 - rename client to agent"
2026-07-29T13:12:26.616Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "4 - move prefix to domains"
2026-07-29T13:12:26.618Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "5 - add settings"
2026-07-29T13:12:26.619Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "6 - add agent remote ip"
2026-07-29T13:12:26.620Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "7 - add route forward client ip headers"
2026-07-29T13:12:26.620Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "8 - allow unmatched access log entries"
2026-07-29T13:12:26.621Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Migrating schema "PUBLIC" to version "9 - add route preserve host header"
2026-07-29T13:12:26.622Z  INFO 1 --- [           main] o.f.core.internal.command.DbMigrate      : Successfully applied 9 migrations to schema "PUBLIC", now at version v9 (execution time 00:00.002s)
2026-07-29T13:12:26.630Z  INFO 1 --- [           main] org.hibernate.orm.jpa                    : HHH008540: Processing PersistenceUnitInfo [name: default]
2026-07-29T13:12:26.633Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000001: Hibernate ORM core version 7.4.1.Final
2026-07-29T13:12:26.648Z  INFO 1 --- [           main] org.hibernate.orm.connections.pooling    : HHH10001005: Database info:
	Database JDBC URL [jdbc:h2:file:./data/proxera]
	Database driver: H2 JDBC Driver
	Database dialect: H2Dialect
	Database version: 2.4.240
	Default catalog/schema: proxera/PUBLIC
	Autocommit mode: undefined/unknown
	Isolation level: READ_COMMITTED [default READ_COMMITTED]
	JDBC fetch size: 100
	Pool: DataSourceConnectionProvider
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2026-07-29T13:12:26.672Z  INFO 1 --- [           main] org.hibernate.orm.core                   : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2026-07-29T13:12:26.674Z  INFO 1 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2026-07-29T13:12:26.681Z  INFO 1 --- [           main] o.s.d.j.r.query.QueryEnhancerFactories   : Hibernate is in classpath; If applicable, HQL parser will be used.
2026-07-29T13:12:26.705Z DEBUG 1 --- [           main] t.w.proxera.security.ApiKeyAuthFilter    : Filter 'apiKeyAuthFilter' configured for use
2026-07-29T13:12:26.730Z DEBUG 1 --- [           main] t.w.proxera.service.IngressService       : Not running in Kubernetes - ingress management unavailable
2026-07-29T13:12:26.756Z  INFO 1 --- [           main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name proxeraUserDetailsService
2026-07-29T13:12:26.778Z DEBUG 1 --- [           main] o.s.w.s.s.s.WebSocketHandlerMapping      : Patterns [/tunnel] in 'webSocketHandlerMapping'
2026-07-29T13:12:26.877Z  INFO 1 --- [           main] o.s.b.h.a.H2ConsoleAutoConfiguration     : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:./data/proxera'
2026-07-29T13:12:26.879Z  WARN 1 --- [           main] i.m.c.i.binder.jvm.JvmGcMetrics          : GC notifications will not be available because no GarbageCollectorMXBean of the JVM provides any. GCs=[young generation scavenger, complete scavenger]
2026-07-29T13:12:26.883Z  INFO 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 4 endpoints beneath base path '/actuator'
2026-07-29T13:12:26.890Z  INFO 1 --- [           main] o.s.boot.tomcat.TomcatWebServer          : Tomcat started on port 8080 (http) with context path '/'
2026-07-29T13:12:26.891Z  INFO 1 --- [           main] t.wenisch.proxera.ProxeraApplication     : Started ProxeraApplication in 0.462 seconds (process running for 0.475)
2026-07-29T13:12:26.901Z  WARN 1 --- [           main] t.wenisch.proxera.service.UserService    : No users found — creating default admin/admin. CHANGE THE PASSWORD!
2026-07-29T13:12:26.990Z  WARN 1 --- [           main] o.s.core.events.SpringDocAppInitializer  : SpringDoc /v3/api-docs endpoint is enabled by default. To disable it in production, set the property 'springdoc.api-docs.enabled=false'
2026-07-29T13:12:56.453Z  INFO 1 --- [omcat-handler-0] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2026-07-29T13:12:56.453Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2026-07-29T13:12:56.454Z  INFO 1 --- [omcat-handler-0] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2026-07-29T13:12:56.457Z DEBUG 1 --- [omcat-handler-0] t.w.proxera.service.RoutingService       : Route cache built with 0 domain entries

Container state:

{"Status":"running","Running":true,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":3909,"ExitCode":0,"Error":"","StartedAt":"2026-07-29T13:12:26.279865459Z","FinishedAt":"0001-01-01T00:00:00Z"}

renovate-wenisch-tech Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

renovate-wenisch-tech Bot force-pushed the renovate/non-major-dependencies branch from 789a952 to 9359b4a Compare July 23, 2026 16:03

renovate-wenisch-tech Bot changed the title ~~chore(deps): update actions/checkout digest to d23441a~~ chore(deps): update non-major dependencies Jul 23, 2026

renovate-wenisch-tech Bot force-pushed the renovate/non-major-dependencies branch from 9359b4a to 3a76ba7 Compare July 24, 2026 13:03

renovate-wenisch-tech Bot force-pushed the renovate/non-major-dependencies branch from 3a76ba7 to f2c8c44 Compare July 28, 2026 08:03

chore(deps): update non-major dependencies

b119f60

renovate-wenisch-tech Bot force-pushed the renovate/non-major-dependencies branch from f2c8c44 to b119f60 Compare July 29, 2026 13:03

Uh oh!

Conversation

renovate-wenisch-tech Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Uh oh!

github-actions Bot commented Jul 20, 2026

Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 20, 2026

Trivy vulnerability report

Uh oh!

github-actions Bot commented Jul 20, 2026

Trivy vulnerability report (native-distroless)

Uh oh!

github-actions Bot commented Jul 20, 2026

Native Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 23, 2026

Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 23, 2026

Trivy vulnerability report

Uh oh!

github-actions Bot commented Jul 23, 2026

Trivy vulnerability report (native-distroless)

Uh oh!

github-actions Bot commented Jul 23, 2026

Native Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 24, 2026

Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 24, 2026

Trivy vulnerability report

Uh oh!

github-actions Bot commented Jul 24, 2026

Trivy vulnerability report (native-distroless)

Uh oh!

github-actions Bot commented Jul 24, 2026

Native Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 28, 2026

Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 28, 2026

Trivy vulnerability report

Uh oh!

github-actions Bot commented Jul 28, 2026

Trivy vulnerability report (native-distroless)

Uh oh!

github-actions Bot commented Jul 28, 2026

Native Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 29, 2026

Container Endpoint Check

Uh oh!

github-actions Bot commented Jul 29, 2026

Trivy vulnerability report

Uh oh!

github-actions Bot commented Jul 29, 2026

Trivy vulnerability report (native-distroless)

Uh oh!

github-actions Bot commented Jul 29, 2026

Native Container Endpoint Check

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate-wenisch-tech Bot commented Jul 20, 2026 •

edited

Loading