Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23 by dependabot[bot] · Pull Request #1827 · project-ncl/bacon

dependabot · 2026-09-02T13:23:36Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-ci.yml's releases.

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

Update from main to v0.0.22 by @rnc in project-ncl/shared-github-actions#103

Ignore commonjava libraries for cooldown by @rnc in project-ncl/shared-github-actions#104

Add gradle-release workflow by @rnc in project-ncl/shared-github-actions#111

Fix gh release. Remove release_type. by @rnc in project-ncl/shared-github-actions#112

Update README by @rnc in project-ncl/shared-github-actions#113

👒 CI Dependencies

Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in project-ncl/shared-github-actions#105

Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 by @dependabot[bot] in project-ncl/shared-github-actions#106

Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in project-ncl/shared-github-actions#107

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#108

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#109

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#110

Full Changelog: project-ncl/shared-github-actions@v0.0.22...v0.0.23

Commits

646d9b6 Merge pull request #113 from rnc/BR1
c3d39a7 Update README
72c18d4 Merge pull request #112 from rnc/BR1
8f83747 Fix gh release. Remove release_type.
1184278 Merge pull request #111 from rnc/GRADLERELEASE
83338f8 Merge pull request #110 from project-ncl/dependabot/github_actions/project-nc...
4768239 Merge pull request #109 from project-ncl/dependabot/github_actions/project-nc...
1f0a576 Merge pull request #108 from project-ncl/dependabot/github_actions/project-nc...
3f6ac23 Merge pull request #107 from project-ncl/dependabot/github_actions/zizmorcore...
1f44af1 Merge pull request #106 from project-ncl/dependabot/github_actions/gradle/act...
Additional commits viewable in compare view

rnc · 2026-09-07T10:05:55Z

@dependabot rebase

Bumps [project-ncl/shared-github-actions/.github/workflows/maven-ci.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.22 to 0.0.23. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@a27e6fb...646d9b6) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-07T10:24:24Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 376 dependencies

Detected 155 vulnerabilities (9 Critical, 66 High, 75 Medium, 5 Low)

Displaying top 50 vulnerabilities. View the full list on the application.
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                      LIBRARY                      |       ID       |                                               TOP FIX                                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2025-14813 | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-5598  | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-58062 | Upgrade to version org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,                                 |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-59650 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-8763  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-jdk15to18:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,                               |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.5.1.jar                             | CVE-2026-71290 | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                                   |                | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | lz4-1.3.0.jar                                     | CVE-2025-12183 | Upgrade to version org.lz4:lz4-java:1.8.1, https://github.com/yawkat/lz4-java.git - v1.8.1           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.84.Final.jar                    | CVE-2026-75595 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.17.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | undertow-core-2.2.24.Final.jar                    | CVE-2025-12543 | Upgrade to version io.undertow:undertow-core:2.2.39.Final,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.3.21.Final,                                          |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.2.39.Final                                           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-12802 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-fips:1.0.12,                            |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59639 | Upgrade to version org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.1.12,org.bouncycastle:bcpkix-fips:2.0.12,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59642 | Upgrade to version org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-fips:2.0.12,          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                         |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-29857 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78,     |
|          |                                                   |                | BouncyCastle.Cryptography - 2.3.1                                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-30172 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-34447 | Upgrade to version org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78,        |
|          |                                                   |                | org.bouncycastle:bctls-fips:1.0.19                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12803 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12816 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12860 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-13506 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-jdk18on:1.85 |
|          |                                                   |                | ,org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-14682 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.0.2,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk15to18:1.85,                       |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58059 | Upgrade to version org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,          |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:2.0.2,  |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58060 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.0.2 |
|          |                                                   |                | , https://github.com/bcgit/bc-java.git - r1rv85                                                      |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58061 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,                               |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:1.0.2.7,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcutil-jdk18on-1.74.jar                           | CVE-2026-59645 | Upgrade to version org.bouncycastle:bcutil-lts8on:2.73.12,org.bouncycastle:bcutil-fips:2.1.7,        |
|          |                                                   |                | org.bouncycastle:bcutil-jdk18on:1.85,org.bouncycastle:bcutil-jdk15to18:1.85,                         |
|          |                                                   |                | org.bouncycastle:bcutil-fips:2.0.7, https://github.com/bcgit/bc-java.git - r1rv85                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | hibernate-validator-6.0.23.Final-redhat-00001.jar | CVE-2025-35036 | Upgrade to version  https://github.com/hibernate/hibernate-validator.git - 7.0.0.Final,              |
|          |                                                   |                | https://github.com/hibernate/hibernate-validator.git - 6.2.0.Final                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.2.jar                                 | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.3.6.jar                               | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.2.jar                              | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.3.6.jar                            | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.21.2.jar                                  | CVE-2026-75140 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.22.2.jar                                  | CVE-2026-75140 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-core-25.0.3.jar                          | CVE-2024-10039 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar            | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                                   |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | logback-classic-1.5.34.jar                        | CVE-2026-19880 | Upgrade to version ch.qos.logback:logback-classic:1.6.3                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | logback-core-1.5.34.jar                           | CVE-2026-13006 | Upgrade to version  https://github.com/qos-ch/logback.git - v_1.5.35,                                |
|          |                                                   |                | ch.qos.logback:logback-core:1.5.35                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | lz4-1.3.0.jar                                     | CVE-2025-66566 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.10.1                                 |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-42583 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.133.Final,                        |
|          |                                                   |                | io.netty:netty-codec:4.1.133.Final,io.netty:netty-codec-compression:4.2.13.Final,                    |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.13.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-59901 | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-dns-4.1.84.Final.jar                  | CVE-2026-42579 | Upgrade to version io.netty:netty-codec-dns:4.1.133.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final,io.netty:netty-codec-dns:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.2.13.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-33870 | io.netty:netty-codec-http:4.1.132.Final,io.netty:netty-codec-http:4.2.10.Final                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42584 | Upgrade to version io.netty:netty-codec-http:4.1.133.Final, https://github.com/netty/netty.git -     |
|          |                                                   |                | netty-4.2.13.Final,io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55831 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55833 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-56745 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2023-44487 | Upgrade to version org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17,            |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-server:12.0.2,                                                   |
|          |                                                   |                | org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17,                               |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0,       |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3,                                     |
|          |                                                   |                | org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14,                                               |
|          |                                                   |                | org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,  |
|          |                                                   |                | 7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3,v1.57.1,v1.58.3,             |
|          |                                                   |                | kubernetes/kubernetes - v1.25.15,v1.26.10,v1.27.7,v1.28.3,v1.29.0, kubernetes/apimachinery -         |
|          |                                                   |                | v0.25.15,v0.26.10,v0.27.7,v0.28.3,v0.29.0, kubernetes/apiserver- v0.25.15,v0.26.10,v0.27.7,v0.28.3,  |
|          |                                                   |                | v0.29.0                                                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2025-55163 | Upgrade to version  https://github.com/netty/netty.git - 4.2.4.Final,                                |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.124.Final,io.netty:netty-codec-http2:4.1.124.Final,   |
|          |                                                   |                | io.netty:netty-codec-http2:4.2.4.Final                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-33871 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.132.Final,                        |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.11.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-56819 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final,io.netty:netty-codec-http2:4.2.16.Final, |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

auth-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- jackson-datatype-jsr310-2.22.1.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- unirest-java-3.14.5.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- unirest-objectmapper-jackson-3.14.5.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- common-3.5.1-SNAPSHOT.jar
	|-- jackson-dataformat-yaml-2.22.1.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- pom-manipulation-common-lite-5.3.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- pnc-common-3.5.1-jakarta.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- hibernate-validator-6.2.5.Final.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- opentelemetry-ext-cli-java-2.0.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-exporter-otlp-1.51.0.jar
				|-- opentelemetry-exporter-sender-okhttp-1.51.0.jar
					|-- opentelemetry-exporter-common-1.51.0.jar
						|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-trace-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-1.51.0.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-common-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-logs-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-metrics-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- pnc-api-3.5.2-jakarta.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
	|-- rest-api-3.5.14-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- dto-3.5.14-patch-builders.jar
			|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
|-- config-3.5.1-SNAPSHOT.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- xnio-api-3.8.7.Final.jar [2 HIGH]
		|-- xnio-nio-3.8.7.Final.jar
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
	|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
		|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- bcpkix-jdk18on-1.74.jar [3 HIGH, 5 MEDIUM]
				|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
				|-- bcutil-jdk18on-1.74.jar [1 HIGH]
					|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
	|-- keycloak-adapter-spi-25.0.3.jar
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- keycloak-common-25.0.3.jar [2 MEDIUM]
cli-3.5.1-SNAPSHOT.jar
|-- logback-classic-1.5.34.jar [1 HIGH]
	|-- logback-core-1.5.34.jar [1 HIGH]
	|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- jansi-2.4.3.jar [1 LOW]
|-- common-3.5.1-SNAPSHOT.jar
	|-- logback-classic-1.5.34.jar [1 HIGH]
	|-- jackson-dataformat-yaml-2.22.1.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- pom-manipulation-common-lite-5.3.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
	|-- pnc-common-3.5.1-jakarta.jar
		|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- hibernate-validator-6.2.5.Final.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
		|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
|-- da-3.5.1-SNAPSHOT.jar
	|-- reports-model-3.0.5.jar
		|-- pnc-api-3.4.5-jakarta.jar
			|-- jackson-databind-2.22.1.jar [2 MEDIUM]
|-- pig-3.5.1-SNAPSHOT.jar
	|-- logback-classic-1.5.34.jar [1 HIGH]
	|-- logback-core-1.5.34.jar [1 HIGH]
... *truncated, see full logs below*

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 2, 2026

dependabot Bot force-pushed the dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-ci.yml-0.0.23 branch from fd245a6 to dd7f36f Compare September 7, 2026 10:08

Navigation Menu

Uh oh!

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23 - #1827

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23#1827
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-ci.yml-0.0.23

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

Uh oh!

rnc commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

Uh oh!

rnc commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading