From 5f486c79cbfb02ff0052b1028f2acdb8555a1b59 Mon Sep 17 00:00:00 2001
From: Kostas Niktas <kniktas@twilio.com>
Date: Fri, 31 Jul 2026 14:02:49 -0700
Subject: [PATCH 1/6] Supply Chain: Pull from Artifactory

---
 .github/workflows/ci.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000000..818ecf6093
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+name: CI
+on:
+  push:
+    branches: [ 'supplychain-*' ]
+  pull_request:
+    branches: [ 'supplychain-*' ]
+
+jobs:
+  build:
+    name: Build
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout twilio-java
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
+
+      - name: Set up Java
+        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: 'maven'
+
+      - name: Artifactory OIDC
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: twilio/sdk-actions/artifactory-oidc@691c14fb56b196ac0bd2f97148f0ac618b883cbd
+
+      - run: mvn install -DskipTests=true -Dgpg.skip -Dmaven.javadoc.skip=true -B -V

From 39cf6a88452de867df6c325529b2f2a4aab9a05e Mon Sep 17 00:00:00 2001
From: Kostas Niktas <kniktas@twilio.com>
Date: Fri, 31 Jul 2026 14:04:22 -0700
Subject: [PATCH 2/6] Supply Chain: workflows need permission for jwt

---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 818ecf6093..6f0d4802bb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,9 @@ jobs:
   build:
     name: Build
     runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    permissions:
+      id-token: write
+      contents: read
     timeout-minutes: 20
     steps:
       - name: Checkout twilio-java

From ed7b1dddbfda975a4c9d6b57757aecb0d9b28faa Mon Sep 17 00:00:00 2001
From: Kostas Niktas <kniktas@twilio.com>
Date: Fri, 31 Jul 2026 14:06:18 -0700
Subject: [PATCH 3/6] Supply Chain: forgot to set maven

---
 .github/workflows/ci.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f0d4802bb..dd60cb7a00 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,9 +1,9 @@
 name: CI
 on:
   push:
-    branches: [ 'supplychain-*' ]
+    branches: ["supplychain-*"]
   pull_request:
-    branches: [ 'supplychain-*' ]
+    branches: ["supplychain-*"]
 
 jobs:
   build:
@@ -20,12 +20,14 @@ jobs:
       - name: Set up Java
         uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
         with:
-          distribution: 'temurin'
-          java-version: '11'
-          cache: 'maven'
+          distribution: "temurin"
+          java-version: "11"
+          cache: "maven"
 
       - name: Artifactory OIDC
         if: ${{ !github.event.pull_request.head.repo.fork }}
         uses: twilio/sdk-actions/artifactory-oidc@691c14fb56b196ac0bd2f97148f0ac618b883cbd
+        with:
+          ecosystem: "maven"
 
       - run: mvn install -DskipTests=true -Dgpg.skip -Dmaven.javadoc.skip=true -B -V

From a958918ad4ca7874d3569062ad9447a552554183 Mon Sep 17 00:00:00 2001
From: Kostas Niktas <kniktas@twilio.com>
Date: Fri, 31 Jul 2026 14:14:27 -0700
Subject: [PATCH 4/6] Supply Chain: action bump

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd60cb7a00..855b74550b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
 
       - name: Artifactory OIDC
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: twilio/sdk-actions/artifactory-oidc@691c14fb56b196ac0bd2f97148f0ac618b883cbd
+        uses: twilio/sdk-actions/artifactory-oidc@ce419e4f97200b0c85af0791b0b5665aab43b334 # java_maven
         with:
           ecosystem: "maven"
 

From 02dc169431afbade56bdfe7fc2c75fec4f3bb6fa Mon Sep 17 00:00:00 2001
From: Kostas Niktas <kniktas@twilio.com>
Date: Fri, 31 Jul 2026 14:50:15 -0700
Subject: [PATCH 5/6] Supply Chain: upgrade Maven plugins to resolve
 CVE-blocked transitive dependencies

Several plugins had transitive dependencies on maven-core versions blocked
because of vulnerabilities. Bumped affected plugins to latest stable versions.
---
 pom.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pom.xml b/pom.xml
index b9be5c8152..5b586a4d35 100644
--- a/pom.xml
+++ b/pom.xml
@@ -200,7 +200,7 @@
   </profiles>
   <properties>
     <jackson.version>2.18.6</jackson.version>
-    <javadoc.plugin.version>3.3.1</javadoc.plugin.version>
+    <javadoc.plugin.version>3.12.0</javadoc.plugin.version>
     <jjwt.version>0.12.6</jjwt.version>
     <lombok.version>1.18.34</lombok.version>
     <mockito.version>5.14.2</mockito.version>
@@ -424,7 +424,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-assembly-plugin</artifactId>
-        <version>3.3.0</version>
+        <version>3.8.0</version>
         <configuration>
           <descriptorRefs>
             <descriptorRef>jar-with-dependencies</descriptorRef>
@@ -443,7 +443,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
-        <version>3.1.1</version>
+        <version>3.6.0</version>
         <configuration>
           <configLocation>checkstyle.xml</configLocation>
         </configuration>
@@ -451,7 +451,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-source-plugin</artifactId>
-        <version>3.2.1</version>
+        <version>3.4.0</version>
         <executions>
           <execution>
             <id>attach-sources</id>
@@ -490,7 +490,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-release-plugin</artifactId>
-        <version>2.5.3</version>
+        <version>3.3.1</version>
         <configuration>
           <tagNameFormat>@{project.version}</tagNameFormat>
           <arguments>-DskipTests=${skip.tests}</arguments>
@@ -534,7 +534,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-enforcer-plugin</artifactId>
-        <version>3.0.0</version>
+        <version>3.4.1</version>
         <executions>
           <execution>
             <id>enforce-versions</id>

From ccc0a921262fd99b7f462130babc96101b250d25 Mon Sep 17 00:00:00 2001
From: Kostas Niktas <kniktas@twilio.com>
Date: Fri, 31 Jul 2026 16:01:47 -0700
Subject: [PATCH 6/6] Supply Chain: Try Docker Hub

---
 .github/workflows/ci.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 855b74550b..fa69b23c71 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,8 +26,17 @@ jobs:
 
       - name: Artifactory OIDC
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: twilio/sdk-actions/artifactory-oidc@ce419e4f97200b0c85af0791b0b5665aab43b334 # java_maven
+        uses: twilio/sdk-actions/artifactory-oidc@7977f77a2d49f76559dbe07916f4952986b33181 # java_maven
         with:
           ecosystem: "maven"
 
+      - name: Docker Hub OIDC
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: twilio/sdk-actions/dockerhub-oidc@7977f77a2d49f76559dbe07916f4952986b33181 # java_maven
+
+      - name: Pull Docker image
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        # Placeholder for docker build and push — validates Docker Hub OIDC login
+        run: docker pull twilio/twilio-java:latest
+
       - run: mvn install -DskipTests=true -Dgpg.skip -Dmaven.javadoc.skip=true -B -V