fix(security): bump Jackson from 2.22.1 to 2.22.3

CHANGELOG.md

@@ -24,6 +24,7 @@
 
 ### Security
 
+- Jackson BOM을 `2.22.3`으로 올려 `jackson-databind`의 무제한 type-id 캐시 성장(CVE-2026-91776)과 이차 시간 forward-reference 해석(CVE-2026-91777)을 수정했습니다. 만료된 GHSA-5jmj-h7xm-6q6v OSV 예외를 제거하고 SBOM·제3자 고지문을 새 의존성 그래프와 함께 갱신했습니다.
 - `GET /api/v1/convert/jobs/{jobId}/download`가 리소스 조회 전에 전용 `artifact:read` 권한을 검증하고, PDF 저장소 접근 전에 작업의 tenant 소유권을 확인하도록 강화했습니다. `job:read`만으로는 문서 바이트를 읽을 수 없으며, 인증 누락·권한 누락·교차 tenant UUID 접근은 각각 fail closed 처리되고 교차 tenant 요청은 리소스 존재를 숨기는 `404`를 반환합니다.
 - Maven XML 테스트 보고서 검증기는 각 `testsuite`의 `tests`, `skipped`, `failures`, `errors` 속성을 모두 필수 증거로 요구합니다. 누락된 결과 수를 암묵적으로 0으로 간주하지 않고 fail closed 처리하며, 각 속성 누락 회귀 테스트를 추가했습니다.
 - Maven XML 테스트 보고서 검증기는 UTF-8만 허용하고 UTF-8 BOM은 수용하며, NUL 바이트·DTD·엔터티 선언을 파싱 전에 거부합니다. UTF-16 같은 대체 인코딩으로 위험 선언을 바이트 검사에서 숨기는 우회와 외부 엔터티 읽기·엔터티 확장형 서비스 거부를 회귀 테스트로 차단했습니다.

docs/legal/2026-07-03-third-party-attribution.md

@@ -14,11 +14,11 @@ CycloneDX SBOM. It is engineering evidence, not legal advice.
 | Component | Version | License metadata | Package URL |
 | --- | --- | --- | --- |
 | com.fasterxml.jackson.core:jackson-annotations | 2.22 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.22?type=jar` |
-| com.fasterxml.jackson.core:jackson-core | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.1?type=jar` |
-| com.fasterxml.jackson.core:jackson-databind | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1?type=jar` |
-| com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.22.1?type=jar` |
-| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310@2.22.1?type=jar` |
-| com.fasterxml.jackson.module:jackson-module-parameter-names | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.module/jackson-module-parameter-names@2.22.1?type=jar` |
+| com.fasterxml.jackson.core:jackson-core | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.3?type=jar` |
+| com.fasterxml.jackson.core:jackson-databind | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.3?type=jar` |
+| com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.22.3?type=jar` |
+| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310@2.22.3?type=jar` |
+| com.fasterxml.jackson.module:jackson-module-parameter-names | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.module/jackson-module-parameter-names@2.22.3?type=jar` |
 | com.fasterxml:classmate | 1.7.3 | Apache-2.0 | `pkg:maven/com.fasterxml/classmate@1.7.3?type=jar` |
 | commons-logging:commons-logging | 1.4.0 | Apache-2.0 | `pkg:maven/commons-logging/commons-logging@1.4.0?type=jar` |
 | io.micrometer:micrometer-commons | 1.15.12 | Apache-2.0 | `pkg:maven/io.micrometer/micrometer-commons@1.15.12?type=jar` |

docs/product-technical-gap-baseline.md

@@ -0,0 +1,48 @@
+# Clearfolio Product and Technical Gap Baseline
+
+## Goal and loop
+
+Clearfolio is the ContextualWisdomLab document-viewer bounded context. Its buyer
+quality loop is review → root-cause repair → exact-head validation → ordinary
+merge. A queued, skipped, stale-head, or fail-closed Check is not passing.
+
+## Current product and technical boundary
+
+- **Product responsibility:** submit documents asynchronously, expose conversion
+  status, render same-origin PDF artifacts, and enforce tenant-scoped access.
+- **Runtime boundary:** Spring WebFlux controllers delegate validation,
+  conversion, state, artifact, authorization, and audit work to their owning
+  services and repositories; no cross-service database access is authorized.
+- **Supply-chain boundary:** Maven dependency policy, CycloneDX SBOM, license
+  policy, third-party attribution, Trivy, OSV, Semgrep, and CodeQL provide
+  fail-closed release evidence.
+
+## PRD and TRD acceptance baseline
+
+| Evidence | Acceptance rule | Status |
+| --- | --- | --- |
+| Product behavior | `mvn -B --no-transfer-progress verify`; zero test failures, errors, or skips; production line and branch coverage 100% | Required on exact repair head |
+| Public contract | Java 21 compilation and public Javadocs complete with warning and deprecation budget 0 | Required on exact repair head |
+| Supply chain | Trivy/OSV/SAST report no actionable finding; committed SBOM and attribution match the resolved dependency graph | #503 Security `36824043955` and SAST `36824043968` GREEN |
+| Review admission | Independent approval and all required terminal Checks bind to the current head | Not yet satisfied |
+
+## Gap and action ledger
+
+| Gap | Exact evidence and RCA | Action | Status |
+| --- | --- | --- | --- |
+| Jackson denial-of-service exposure | clearfolio#660 head `2a6b0b621e075da224210c0ca78db344af5dea52`, Security run `36778995059`, Trivy job `110104143035`: CVE-2026-91776 and CVE-2026-91777 in `jackson-databind` 2.22.2 | Repair canonical dependency owner #503 with Jackson 2.22.3, a downgrade regression test, refreshed SBOM/attribution, and removal of the expired OSV exception | Resolved at source commit `3e9ba61e1aa2a903e920cf832f9daa5467f2e166`; CI `36824043863`, Security `36824043955`, SAST `36824043968`, and fuzz `36824043977` GREEN |
+| Historical evidence drift | #503 review found its original one-file 2.22.2 bump left SBOM, attribution, POM rationale, and expired ignore stale | Keep dependency version and buyer evidence in one PR; run attribution/license drift checks | Resolved; both review threads closed and local evidence contracts GREEN |
+| Merge admission | #503 is Ready after product/security/fuzz validation; its Draft CodeQL run `36824043888` was skipped. #660 is Draft on the vulnerable predecessor head. | Obtain a non-skipped CodeQL verdict and independent approval on the current #503 head, then ordinarily integrate it into consumers and revalidate their new heads | Hold |
+
+## Decision traceability
+
+The selected repair is the upstream Jackson 2.22.3 patch line, released
+2026-09-21 with fixes for both CVEs. Ignoring the findings, weakening Trivy, or
+retaining the expired OSV exception was rejected because each would preserve a
+buyer-visible denial-of-service risk or conceal stale evidence. A new duplicate
+dependency PR was rejected because #503 already owns the Jackson version delta.
+
+## References
+
+FasterXML. (2026, September 21). *Jackson release 2.22.3*.
+https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.22.3