[ehl-jf]

Bump version to 2.86.0

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 1 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	1 Issues Found 1 High
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Fixed Versions
High	CVE-2025-66564	Not Covered	github.com/jfrog/jfrog-cli-evidence:v0.8.3-0.20251204144808-73fa744851c0 github.com/sigstore/sigstore-go:v1.1.3 github.com/sigstore/timestamp-authority:v1.2.9	github.com/sigstore/timestamp-authority v1.2.9	[2.0.3]

🔖 Details

Vulnerability Details

Contextual Analysis:	Not Covered
Direct Dependencies:	github.com/jfrog/jfrog-cli-evidence:v0.8.3-0.20251204144808-73fa744851c0, github.com/sigstore/sigstore-go:v1.1.3, github.com/sigstore/timestamp-authority:v1.2.9
Impacted Dependency:	github.com/sigstore/timestamp-authority:v1.2.9
Fixed Versions:	[2.0.3]
CVSS V3:	7.5

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.

---

🐸 JFrog Frogbot

[ehl-jf]

Transfer tests are failing because an infra issues Cannot create project, Max number of projects is reached.

[ehl-jf]

The others tests need to be re-aligned.