Skip to content

Bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2 - #639

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/com.mycila-license-maven-plugin-5.1.2
Open

Bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2#639
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/com.mycila-license-maven-plugin-5.1.2

Bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2

8c51771
Select commit
Loading
Failed to load commit list.
Sign in for the full log view
GitHub Actions / Mend CLI scan succeeded Sep 3, 2026 in 2m 23s

Mend CLI scan

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output 



Identified 357 dependencies

Detected 11 vulnerabilities (0 Critical, 2 High, 8 Medium, 1 Low)

+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |            LIBRARY             |       ID       |                                               TOP FIX                                                |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar               | CVE-2026-75140 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | resteasy-core-6.2.16.Final.jar | CVE-2026-17615 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-19032 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.22.2,                               |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.1.6,        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,tools.jackson.core:jackson-databind:3.2.2        |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,     |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1,                         |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4                           |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                                |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-83557 | Upgrade to version tools.jackson.core:jackson-databind:3.1.6,                                        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,                                                 |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.2.2         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar            | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                                 |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar     | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.17.1,io.micrometer:micrometer-core:1.16.7         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar     | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-core:1.16.7,                                             |
|          |                                |                | https://github.com/micrometer-metrics/micrometer.git - v1.17.1,io.micrometer:micrometer-core:1.17.1, |
|          |                                |                | io.micrometer:micrometer-registry-statsd:1.17.1,io.micrometer:micrometer-registry-statsd:1.16.7,     |
|          |                                |                | https://github.com/micrometer-metrics/micrometer.git - v1.16.7                                       |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | LatencyUtils-2.0.3.jar         | CVE-2026-82596 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

jackson-jaxrs-json-provider-2.22.2.jar
|-- jackson-jaxrs-base-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-jaxb-annotations-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
micrometer-registry-prometheus-1.17.0.jar
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-hibernate-orm-panache-3.39.0.jar
|-- quarkus-hibernate-orm-3.39.0.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- quarkus-jackson-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-micrometer-3.39.0.jar
|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- quarkus-resteasy-client-3.39.0.jar
	|-- quarkus-resteasy-common-3.39.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- microprofile-config-3.0.1.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
	|-- resteasy-multipart-provider-6.2.16.Final.jar
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-jaxb-provider-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- quarkus-resteasy-3.39.0.jar
	|-- quarkus-resteasy-server-common-3.39.0.jar
		|-- resteasy-cdi-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- quarkus-vertx-http-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- vertx-web-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- kafka-clients-4.2.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- LatencyUtils-2.0.3.jar [1 LOW]
quarkus-oidc-client-3.39.0.jar
|-- quarkus-oidc-common-3.39.0.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- vertx-web-client-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- quarkus-vertx-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-resteasy-client-jackson-3.39.0.jar
|-- resteasy-jackson2-provider-6.2.16.Final.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
failsafe-2.4.4.jar
|-- vertx-core-4.5.32.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- netty-resolver-dns-4.1.137.Final.jar
		|-- netty-codec-4.1.137.Final.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
indy-client-core-java-3.4.5.jar
|-- indy-model-core-java-1.5.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- atlas-bindings-jackson-identities-1.1.3.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- atlas-relationships-api-1.1.3.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-common-3.5.5-SNAPSHOT-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pom-manipulation-common-lite-5.6.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pnc-api-3.5.2-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jsoup-1.23.1.jar [1 HIGH]
rest-client-jakarta-3.5.15.jar
|-- jackson-jakarta-rs-json-provider-2.22.0.jar
	|-- jackson-jakarta-rs-base-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- common-3.5.15-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- dto-3.5.15-patch-builders-jakarta.jar
	|-- jsoup-1.23.1.jar [1 HIGH]
rest-client-3.5.15-jakarta.jar
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- json-patch-1.13.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-coreutils-2.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
resteasy-client-6.2.16.Final.jar
|-- resteasy-core-6.2.16.Final.jar [1 HIGH]


No Policy violations were detected

Project 'cleaner' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=b6b32547-c032-445d-a1e9-03a59d6b736b
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=10a714dfb5574fcead8c6d64898dcf58d430f60259204c6eb77f4ee4bf394908

Mend AI scan succeeded.

Support Token: 0f2e929ff95694652834763aa150c47d71788394190043
SAST scan output 
*no findings*

Full logs and artifacts

View more details on GitHub Actions