Correct Apollo Portal package scope for GHSA-jxpj-9j24-w337

[nobodyiam]

Summary

Corrects the affected Maven package for GHSA-jxpj-9j24-w337 from the Apollo root parent POM to the Apollo server component that contains the vulnerable runtime code.

Rationale

• The current advisory maps the vulnerability to com.ctrip.framework.apollo:apollo, which is Apollo's root parent POM rather than the vulnerable runtime component.
• The vulnerable code path is in Apollo Portal server deployments; Maven client libraries such as apollo-core, apollo-client, and apollo-openapi are not affected when used only as client-side dependencies.
• This PR uses com.ctrip.framework.apollo:apollo-portal to reflect the actual server module. If GitHub curation prefers not to map unpublished server distributions to Maven coordinates, removing the Maven parent POM mapping would still be preferable to alerting on the client SDK dependency surface.
• The upstream repository advisory already scopes the affected component as Apollo Portal; this PR mirrors that server-component scope in the global advisory record.

Public references

• Repository advisory: GHSA-jxpj-9j24-w337
• Upstream issue confirming the metadata scope: 关于 CVE-2026-59954 / GHSA-4w3q-qpfq-v992 受影响 Maven 包范围的疑问与修正建议 apolloconfig/apollo#5661
• Apollo root POM is packaging pom: https://github.com/apolloconfig/apollo/blob/v2.5.2/pom.xml#L22-L26
• Apollo ConfigService module coordinates: https://github.com/apolloconfig/apollo/blob/v2.5.2/apollo-configservice/pom.xml#L20-L28
• Apollo Portal module coordinates: https://github.com/apolloconfig/apollo/blob/v2.5.2/apollo-portal/pom.xml#L20-L28
• Maven Central parent POM metadata: https://repo1.maven.org/maven2/com/ctrip/framework/apollo/apollo/maven-metadata.xml

[Copilot]

Pull request overview

Corrects GHSA-jxpj-9j24-w337 to target the vulnerable Apollo Portal server component instead of the root parent POM.

Changes:

• Maps the advisory to com.ctrip.framework.apollo:apollo-portal.
• Clarifies that Apollo client libraries are unaffected.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.