Update dependency org.jboss.pnc:pnc-common to v3.5.4 by red-hat-konflux[bot] · Pull Request #1811 · project-ncl/bacon

red-hat-konflux · 2026-08-04T15:15:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
org.jboss.pnc:pnc-common (source)	`3.5.1` → `3.5.4`

Release Notes

project-ncl/pnc-common (org.jboss.pnc:pnc-common)

`v3.5.4`

Compare Source

What's Changed

🐛 Fixes / 🚀 Enhancements

[NCLSUP-1471] Add a support for picking non-suffixed version by @akridl in #359
[NCL-9598] Add HTTP client validating SSL certificates by @patrikk0123 in #358
[NCLSUP-1471] Apply unsuffixed filtering when no suffixes are configured by @akridl in #369

👒 Project Dependencies

Bump org.junit.jupiter:junit-jupiter-engine from 6.1.2 to 6.1.3 by @dependabot[bot] in #357

Full Changelog: project-ncl/pnc-common@3.5.3...3.5.4

`v3.5.3`

Compare Source

What's Changed

🐛 Fixes / 🚀 Enhancements

Add tests by @rnc in #336
Bump shared-github-actions to v0.0.22 by @patrikk0123 in #350
Update jboss-parent by @rnc in #349
Fix MD5 calculation by @rnc in #355
Add helper method to know if suffixes were configured by @thescouser89 in #356

👒 Project Dependencies

Bump com.diffplug.spotless:spotless-maven-plugin from 3.7.0 to 3.8.0 by @dependabot[bot] in #338
Bump org.jboss.pnc:pnc-api from 3.5.1 to 3.5.2 by @dependabot[bot] in #339
Bump org.junit.jupiter:junit-jupiter-engine from 6.1.0 to 6.1.1 by @dependabot[bot] in #340
Bump io.smallrye.config:smallrye-config-core from 3.17.2 to 3.18.0 by @dependabot[bot] in #342
Bump jackson.version from 2.22.0 to 2.22.1 by @dependabot[bot] in #341
Bump org.jboss.pnc.maven-manipulator:pom-manipulation-common-lite from 5.3 to 5.4 by @dependabot[bot] in #344
Bump org.junit.jupiter:junit-jupiter-engine from 6.1.1 to 6.1.2 by @dependabot[bot] in #345
Bump org.jboss.pnc.maven-manipulator:pom-manipulation-common-lite from 5.4 to 5.5 by @dependabot[bot] in #347
Bump io.smallrye.config:smallrye-config-core from 3.18.0 to 3.18.1 by @dependabot[bot] in #346
Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in #353
Bump org.jsoup:jsoup from 1.22.2 to 1.23.1 by @dependabot[bot] in #352
Bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @dependabot[bot] in #351

Full Changelog: project-ncl/pnc-common@3.5.2...3.5.3

`v3.5.2`

Compare Source

What's Changed

🐛 Fixes / 🚀 Enhancements

Fix formatting by @rnc in #332
Bump shared-github-actions to v0.0.21 by @patrikk0123 in #333
Add log sanitizer by @rnc in #334

👒 Project Dependencies

Bump com.diffplug.spotless:spotless-maven-plugin from 3.6.0 to 3.7.0 by @dependabot[bot] in #324
Bump org.jboss.pnc:pnc-api from 3.5.0 to 3.5.1 by @dependabot[bot] in #325
Bump org.sonatype.central:central-publishing-maven-plugin from 0.10.0 to 0.11.0 by @dependabot[bot] in #331

👒 CI Dependencies

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.18 to 0.0.19 by @dependabot[bot] in #326
Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.18 to 0.0.19 by @dependabot[bot] in #330
Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.18 to 0.0.19 by @dependabot[bot] in #328
Bump project-ncl/shared-github-actions/.github/workflows/validate-gh-action.yml from 0.0.18 to 0.0.19 by @dependabot[bot] in #329
Bump project-ncl/shared-github-actions/.github/workflows/maven-set-version.yml from 0.0.18 to 0.0.19 by @dependabot[bot] in #327

Full Changelog: project-ncl/pnc-common@3.5.1...3.5.2

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

github-actions · 2026-08-04T15:31:52Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 370 dependencies

Detected 164 vulnerabilities (9 Critical, 67 High, 84 Medium, 4 Low)

Displaying top 50 vulnerabilities. View the full list on the application.
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                      LIBRARY                      |       ID       |                                               TOP FIX                                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2025-14813 | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-5598  | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-58062 | Upgrade to version org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,                                 |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-59650 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-8763  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-jdk15to18:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,                               |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.5.1.jar                             | CVE-2026-71290 | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                                   |                | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | lz4-1.3.0.jar                                     | CVE-2025-12183 | Upgrade to version org.lz4:lz4-java:1.8.1, https://github.com/yawkat/lz4-java.git - v1.8.1           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.84.Final.jar                    | CVE-2026-75595 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.17.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | undertow-core-2.2.24.Final.jar                    | CVE-2025-12543 | Upgrade to version io.undertow:undertow-core:2.2.39.Final,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.3.21.Final,                                          |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.2.39.Final                                           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-12802 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-fips:1.0.12,                            |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59639 | Upgrade to version org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.1.12,org.bouncycastle:bcpkix-fips:2.0.12,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59642 | Upgrade to version org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-fips:2.0.12,          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                         |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-29857 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78,     |
|          |                                                   |                | BouncyCastle.Cryptography - 2.3.1                                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-30172 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-34447 | Upgrade to version org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78,        |
|          |                                                   |                | org.bouncycastle:bctls-fips:1.0.19                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12803 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12816 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12860 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-13506 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-jdk18on:1.85 |
|          |                                                   |                | ,org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-14682 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.0.2,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk15to18:1.85,                       |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58059 | Upgrade to version org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,          |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:2.0.2,  |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58060 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.0.2 |
|          |                                                   |                | , https://github.com/bcgit/bc-java.git - r1rv85                                                      |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58061 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,                               |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:1.0.2.7,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcutil-jdk18on-1.74.jar                           | CVE-2026-59645 | Upgrade to version org.bouncycastle:bcutil-lts8on:2.73.12,org.bouncycastle:bcutil-fips:2.1.7,        |
|          |                                                   |                | org.bouncycastle:bcutil-jdk18on:1.85,org.bouncycastle:bcutil-jdk15to18:1.85,                         |
|          |                                                   |                | org.bouncycastle:bcutil-fips:2.0.7, https://github.com/bcgit/bc-java.git - r1rv85                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | hibernate-validator-6.0.23.Final-redhat-00001.jar | CVE-2025-35036 | Upgrade to version  https://github.com/hibernate/hibernate-validator.git - 7.0.0.Final,              |
|          |                                                   |                | https://github.com/hibernate/hibernate-validator.git - 6.2.0.Final                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.2.jar                                 | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.3.6.jar                               | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.2.jar                              | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.3.6.jar                            | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                                  | CVE-2026-75140 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar            | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                                   |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | lz4-1.3.0.jar                                     | CVE-2025-66566 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.10.1                                 |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-42583 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.133.Final,                        |
|          |                                                   |                | io.netty:netty-codec:4.1.133.Final,io.netty:netty-codec-compression:4.2.13.Final,                    |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.13.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-59901 | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-dns-4.1.84.Final.jar                  | CVE-2026-42579 | Upgrade to version io.netty:netty-codec-dns:4.1.133.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final,io.netty:netty-codec-dns:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.2.13.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-33870 | io.netty:netty-codec-http:4.1.132.Final,io.netty:netty-codec-http:4.2.10.Final                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42584 | Upgrade to version io.netty:netty-codec-http:4.1.133.Final, https://github.com/netty/netty.git -     |
|          |                                                   |                | netty-4.2.13.Final,io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55831 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55833 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-56745 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2023-44487 | Upgrade to version org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17,            |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-server:12.0.2,                                                   |
|          |                                                   |                | org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17,                               |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0,       |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3,                                     |
|          |                                                   |                | org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14,                                               |
|          |                                                   |                | org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,  |
|          |                                                   |                | 7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3,v1.57.1,v1.58.3,             |
|          |                                                   |                | kubernetes/kubernetes - v1.25.15,v1.26.10,v1.27.7,v1.28.3,v1.29.0, kubernetes/apimachinery -         |
|          |                                                   |                | v0.25.15,v0.26.10,v0.27.7,v0.28.3,v0.29.0, kubernetes/apiserver- v0.25.15,v0.26.10,v0.27.7,v0.28.3,  |
|          |                                                   |                | v0.29.0                                                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2025-55163 | Upgrade to version  https://github.com/netty/netty.git - 4.2.4.Final,                                |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.124.Final,io.netty:netty-codec-http2:4.1.124.Final,   |
|          |                                                   |                | io.netty:netty-codec-http2:4.2.4.Final                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-33871 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.132.Final,                        |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.11.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-56819 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final,io.netty:netty-codec-http2:4.2.16.Final, |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-59900 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final                                          |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.84.Final.jar                    | CVE-2026-44249 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.15.Final,                         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.135.Final                                             |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.84.Final.jar                    | CVE-2026-45416 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.15.Final,                         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.135.Final                                             |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.84.Final.jar                    | CVE-2026-50010 | Upgrade to version  https://github.com/netty/netty.git - 4.1.135.Final                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

auth-4.0.0-SNAPSHOT.jar
|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- jackson-datatype-jsr310-2.22.1.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- unirest-java-3.14.5.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- unirest-objectmapper-jackson-3.14.5.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- common-4.0.0-SNAPSHOT.jar
	|-- pom-manipulation-common-lite-5.3.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- pnc-common-3.5.4-jakarta.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- opentelemetry-ext-cli-java-2.0.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-exporter-otlp-1.51.0.jar
				|-- opentelemetry-exporter-otlp-common-1.51.0.jar
					|-- opentelemetry-exporter-common-1.51.0.jar
						|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-logs-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-metrics-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-1.51.0.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-common-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-trace-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- jsoup-1.23.1.jar [1 HIGH]
	|-- rest-api-3.6.0-SNAPSHOT-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- hibernate-validator-6.2.5.Final.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- dto-3.6.0-SNAPSHOT.jar
			|-- jsoup-1.23.1.jar [1 HIGH]
		|-- pnc-api-3.5.2-jakarta.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- config-4.0.0-SNAPSHOT.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- jackson-dataformat-yaml-2.22.1.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- xnio-api-3.8.7.Final.jar [2 HIGH]
		|-- xnio-nio-3.8.7.Final.jar
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
	|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
		|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- bcpkix-jdk18on-1.74.jar [3 HIGH, 5 MEDIUM]
				|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
				|-- bcutil-jdk18on-1.74.jar [1 HIGH]
					|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
	|-- keycloak-adapter-spi-25.0.3.jar
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- keycloak-common-25.0.3.jar [2 MEDIUM]
cli-4.0.0-SNAPSHOT.jar
|-- logback-classic-1.6.3.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- jansi-2.4.3.jar [1 LOW]
|-- common-4.0.0-SNAPSHOT.jar
	|-- jackson-dataformat-yaml-2.22.1.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- pom-manipulation-common-lite-5.3.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- rest-api-3.6.0-SNAPSHOT-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
			|-- xnio-nio-3.8.7.Final.jar
				|-- xnio-api-3.8.7.Final.jar [2 HIGH]
		|-- hibernate-validator-6.2.5.Final.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- dto-3.6.0-SNAPSHOT.jar
			|-- json-patch-1.13.jar [3 MEDIUM]
			|-- jsoup-1.23.1.jar [1 HIGH]
... *truncated, see full logs below*

SAST scan output

*no findings*

Full logs and artifacts

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/pnc-common.version branch from 6a824a7 to eef2627 Compare August 18, 2026 01:57

red-hat-konflux Bot changed the title ~~Update dependency org.jboss.pnc:pnc-common to v3.5.2~~ Update dependency org.jboss.pnc:pnc-common to v3.5.3 Aug 18, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/pnc-common.version branch from eef2627 to 59f7f72 Compare August 22, 2026 01:27

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/pnc-common.version branch from 59f7f72 to eedd543 Compare September 1, 2026 02:17

red-hat-konflux Bot changed the title ~~Update dependency org.jboss.pnc:pnc-common to v3.5.3~~ Update dependency org.jboss.pnc:pnc-common to v3.5.4 Sep 1, 2026

Update dependency org.jboss.pnc:pnc-common to v3.5.4

09af4b1

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/pnc-common.version branch from eedd543 to 09af4b1 Compare September 13, 2026 00:41

Navigation Menu

Uh oh!

Update dependency org.jboss.pnc:pnc-common to v3.5.4 - #1811

Update dependency org.jboss.pnc:pnc-common to v3.5.4#1811
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/pnc-common.version

red-hat-konflux Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.5.4

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 Project Dependencies

v3.5.3

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 Project Dependencies

v3.5.2

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 Project Dependencies

👒 CI Dependencies

Configuration

Documentation

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented Aug 4, 2026 •

edited

Loading

`v3.5.4`

`v3.5.3`

`v3.5.2`

github-actions Bot commented Aug 4, 2026 •

edited

Loading