Bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2 by dependabot[bot] · Pull Request #639 · project-ncl/cleaner

dependabot · 2026-09-03T00:02:29Z

Bumps com.mycila:license-maven-plugin from 5.1.1 to 5.1.2.

Release notes

Sourced from com.mycila:license-maven-plugin's releases.

v5.1.2

What's Changed

Bump org.sonatype.central:central-publishing-maven-plugin from 0.9.0 to 0.11.0 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1080

Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1079

Bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1081

Bump groovy.version from 5.0.7 to 5.0.8 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1083

fix: Avoid loading foreign build extensions when reading licenses (#1084) by @mathieucarbou in mathieucarbou/license-maven-plugin#1085

Bump junit.version from 6.1.2 to 6.1.3 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1086

Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1087

Bump groovy.version from 5.0.8 to 5.1.0 by @dependabot[bot] in mathieucarbou/license-maven-plugin#1089

Full Changelog: mathieucarbou/license-maven-plugin@v5.1.1...v5.1.2

Commits

eac1ccf [maven-release-plugin] prepare release v5.1.2
6a03ae3 fix doc
cb82d1b Merge pull request #1089 from mathieucarbou/dependabot/maven/groovy.version-5...
2001b61 Bump groovy.version from 5.0.8 to 5.1.0
2fc921b Merge pull request #1087 from mathieucarbou/dependabot/maven/com.puppycrawl.t...
4d9c06a Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0
d6f5a84 Merge pull request #1086 from mathieucarbou/dependabot/maven/junit.version-6.1.3
8e556c6 Bump junit.version from 6.1.2 to 6.1.3
4ce936b Merge pull request #1085 from mathieucarbou/fix/1084
e4394a6 fix: Avoid loading foreign build extensions when reading licenses (#1084)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [com.mycila:license-maven-plugin](https://github.com/mathieucarbou/license-maven-plugin) from 5.1.1 to 5.1.2. - [Release notes](https://github.com/mathieucarbou/license-maven-plugin/releases) - [Changelog](https://github.com/mathieucarbou/license-maven-plugin/blob/master/docs/releases.md) - [Commits](mathieucarbou/license-maven-plugin@v5.1.1...v5.1.2) --- updated-dependencies: - dependency-name: com.mycila:license-maven-plugin dependency-version: 5.1.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-03T00:10:36Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 357 dependencies

Detected 11 vulnerabilities (0 Critical, 2 High, 8 Medium, 1 Low)

+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |            LIBRARY             |       ID       |                                               TOP FIX                                                |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar               | CVE-2026-75140 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | resteasy-core-6.2.16.Final.jar | CVE-2026-17615 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-19032 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.22.2,                               |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.1.6,        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,tools.jackson.core:jackson-databind:3.2.2        |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,     |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1,                         |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4                           |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                                |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-83557 | Upgrade to version tools.jackson.core:jackson-databind:3.1.6,                                        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,                                                 |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.2.2         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar            | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                                 |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar     | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.17.1,io.micrometer:micrometer-core:1.16.7         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar     | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-core:1.16.7,                                             |
|          |                                |                | https://github.com/micrometer-metrics/micrometer.git - v1.17.1,io.micrometer:micrometer-core:1.17.1, |
|          |                                |                | io.micrometer:micrometer-registry-statsd:1.17.1,io.micrometer:micrometer-registry-statsd:1.16.7,     |
|          |                                |                | https://github.com/micrometer-metrics/micrometer.git - v1.16.7                                       |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | LatencyUtils-2.0.3.jar         | CVE-2026-82596 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

jackson-jaxrs-json-provider-2.22.2.jar
|-- jackson-jaxrs-base-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-jaxb-annotations-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
micrometer-registry-prometheus-1.17.0.jar
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-hibernate-orm-panache-3.39.0.jar
|-- quarkus-hibernate-orm-3.39.0.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- quarkus-jackson-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-micrometer-3.39.0.jar
|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- quarkus-resteasy-client-3.39.0.jar
	|-- quarkus-resteasy-common-3.39.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- microprofile-config-3.0.1.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
	|-- resteasy-multipart-provider-6.2.16.Final.jar
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-jaxb-provider-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- quarkus-resteasy-3.39.0.jar
	|-- quarkus-resteasy-server-common-3.39.0.jar
		|-- resteasy-cdi-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- quarkus-vertx-http-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- vertx-web-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- kafka-clients-4.2.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- LatencyUtils-2.0.3.jar [1 LOW]
quarkus-oidc-client-3.39.0.jar
|-- quarkus-oidc-common-3.39.0.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- vertx-web-client-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- quarkus-vertx-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-resteasy-client-jackson-3.39.0.jar
|-- resteasy-jackson2-provider-6.2.16.Final.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
failsafe-2.4.4.jar
|-- vertx-core-4.5.32.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- netty-resolver-dns-4.1.137.Final.jar
		|-- netty-codec-4.1.137.Final.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
indy-client-core-java-3.4.5.jar
|-- indy-model-core-java-1.5.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- atlas-bindings-jackson-identities-1.1.3.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- atlas-relationships-api-1.1.3.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-common-3.5.5-SNAPSHOT-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pom-manipulation-common-lite-5.6.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pnc-api-3.5.2-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jsoup-1.23.1.jar [1 HIGH]
rest-client-jakarta-3.5.15.jar
|-- jackson-jakarta-rs-json-provider-2.22.0.jar
	|-- jackson-jakarta-rs-base-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- common-3.5.15-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- dto-3.5.15-patch-builders-jakarta.jar
	|-- jsoup-1.23.1.jar [1 HIGH]
rest-client-3.5.15-jakarta.jar
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- json-patch-1.13.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-coreutils-2.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
resteasy-client-6.2.16.Final.jar
|-- resteasy-core-6.2.16.Final.jar [1 HIGH]


No Policy violations were detected

Project 'cleaner' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=b6b32547-c032-445d-a1e9-03a59d6b736b
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=10a714dfb5574fcead8c6d64898dcf58d430f60259204c6eb77f4ee4bf394908

Mend AI scan succeeded.

Support Token: 0f2e929ff95694652834763aa150c47d71788394190043

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 3, 2026

Navigation Menu

Uh oh!

Bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2 - #639

Bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2#639
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/com.mycila-license-maven-plugin-5.1.2

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026

v5.1.2

What's Changed

Uh oh!

github-actions Bot commented Sep 3, 2026

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants