Fix CVE

[Pankraz76]

No description provided.

[Pankraz76]

• [trivy] add trivy-maven-plugin keycloak/keycloak#44178 (comment)

@ahus1

Having five critical issues is already significant, but matching your scope to medium still represents quite a lot of security leaks for a security tool. Please consider addressing these, as we don’t want vulnerabilities in our security layer — this seems important.

Failing the build in favor of a simple version bump, instead of allowing leaks into production, would be a better and more responsible approach, especially in a security-sensitive context. Losing reputation could put the entire project at risk. If this information were to reach a malicious group, it would provide strong motivation to patch and take the topic top prior.

[Pankraz76]

Maybe checkin on every commit is a little to much. The current trivy config checking the image-ref: quay.io/keycloak/${{ matrix.container }}:nightly seems fine.

Never the less I kind of can confirm there are a lot of issues, fixed by a simple patch lvl version bump.