Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.24 to 0.0.27 by dependabot[bot] · Pull Request #523 · Commonjava/galley

dependabot · 2026-10-14T11:02:02Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.24 to 0.0.27.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-release.yml's releases.

v0.0.27

What's Changed

🐛 Fixes / 🚀 Enhancements

Fix Quarkus container image not pushed during Central release by @thescouser89 in project-ncl/shared-github-actions#152

Add quay username and password for maven release by @thescouser89 in project-ncl/shared-github-actions#153

Use non-deprecated setup-java credential inputs by @thescouser89 in project-ncl/shared-github-actions#155

Provide empty default for QUARKUS_CONTAINER_IMAGE_USERNAME/PASSWORD by @thescouser89 in project-ncl/shared-github-actions#157

Always update Maven snapshots by @rnc in project-ncl/shared-github-actions#156

Revert "Provide empty default for QUARKUS_CONTAINER_IMAGE_USERNAME/PASSWORD" by @rnc in project-ncl/shared-github-actions#163

👒 CI Dependencies

Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 by @dependabot[bot] in project-ncl/shared-github-actions#154

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.25 to 0.0.26 by @dependabot[bot] in project-ncl/shared-github-actions#158

Bump project-ncl/shared-github-actions/.github/actions/mend from 0.0.25 to 0.0.26 by @dependabot[bot] in project-ncl/shared-github-actions#159

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.25 to 0.0.26 by @dependabot[bot] in project-ncl/shared-github-actions#160

Bump project-ncl/shared-github-actions/.github/actions/maven-build from 0.0.25 to 0.0.26 by @dependabot[bot] in project-ncl/shared-github-actions#161

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.25 to 0.0.26 by @dependabot[bot] in project-ncl/shared-github-actions#162

Full Changelog: project-ncl/shared-github-actions@v0.0.26...v0.0.27

v0.0.26

Note that this release is only compatible with jboss-parent 54 and up. Use 0.0.24 or earlier for jboss-parent <=53.

What's Changed

🐛 Fixes / 🚀 Enhancements

Add coverage for snapshot by @rnc in project-ncl/shared-github-actions#142

👒 CI Dependencies

Bump gradle/actions/setup-gradle from 6.3.0 to 6.4.0 by @dependabot[bot] in project-ncl/shared-github-actions#141

Bump project-ncl/shared-github-actions/.github/actions/mend from 0.0.24 to 0.0.25 by @dependabot[bot] in project-ncl/shared-github-actions#145

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.24 to 0.0.25 by @dependabot[bot] in project-ncl/shared-github-actions#147

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.24 to 0.0.25 by @dependabot[bot] in project-ncl/shared-github-actions#146

Bump project-ncl/shared-github-actions/.github/actions/maven-build from 0.0.24 to 0.0.25 by @dependabot[bot] in project-ncl/shared-github-actions#148

Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in project-ncl/shared-github-actions#144

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.24 to 0.0.25 by @dependabot[bot] in project-ncl/shared-github-actions#149

Bump actions/setup-java from 6.0.1 to 6.1.0 by @dependabot[bot] in project-ncl/shared-github-actions#151

Bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in project-ncl/shared-github-actions#150

Full Changelog: project-ncl/shared-github-actions@v0.0.25...v0.0.26

v0.0.25

What's Changed

Note that this release is only compatible with jboss-parent 54 and up. Use prior releases for jboss-parent <=53.

... (truncated)

Commits

e7102dd Revert "Provide empty default for QUARKUS_CONTAINER_IMAGE_USERNAME/PASSWORD"
1ccc374 Always update Maven snapshots
9ad1098 Bump project-ncl/shared-github-actions/.github/actions/gradle-build
25f1d1f Bump project-ncl/shared-github-actions/.github/actions/maven-build
07cdf7c Bump project-ncl/shared-github-actions/.github/actions/npm-build
2d1f7ae Bump project-ncl/shared-github-actions/.github/actions/mend
b4d04ea Bump project-ncl/shared-github-actions/.github/actions/sbt-build
1eb33d9 Merge pull request #157 from thescouser89/provide-dummy-values-for-quay-usern...
208ea6c Provide empty default for QUARKUS_CONTAINER_IMAGE_USERNAME/PASSWORD
30dd8ce Use non-deprecated setup-java credential inputs
Additional commits viewable in compare view

rnc · 2026-11-11T14:40:36Z

@dependabot rebase

…e.yml Bumps [project-ncl/shared-github-actions/.github/workflows/maven-release.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.24 to 0.0.27. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@f0ec169...e7102dd) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-release.yml dependency-version: 0.0.25 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-11T14:41:46Z

Superseded by #529.

github-actions · 2026-11-11T14:45:31Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 113 dependencies

Detected 31 vulnerabilities (1 Critical, 10 High, 16 Medium, 4 Low)

+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |           LIBRARY           |       ID        |                                               TOP FIX                                                |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | jackson-databind-2.22.2.jar | CVE-2026-110879 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.12,    |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.22.4,                                                  |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.21.8,                                                  |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.4,                          |
|          |                             |                 | tools.jackson.core:jackson-databind:3.1.8,com.fasterxml.jackson.core:jackson-databind:2.18.12,       |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.8,                         |
|          |                             |                 | tools.jackson.core:jackson-databind:3.2.4, https://github.com/FasterXML/jackson-databind.git -       |
|          |                             |                 | jackson-databind-3.1.8, https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.4  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.85.jar     | CVE-2026-71888  | Upgrade to version org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,  |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                   |
|          |                             |                 | org.bouncycastle:bcpkix-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv86,                 |
|          |                             |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,      |
|          |                             |                 | org.bouncycastle:bcpkix-fips:1.0.13,org.bouncycastle:bcpkix-fips:2.0.13,                             |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.1.13                                                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.85.jar     | CVE-2026-71889  | Upgrade to version org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-lts8on:2.73.13,    |
|          |                             |                 | org.bouncycastle:bcprov-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,             |
|          |                             |                 | org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86,org.bouncycastle:bcprov-jdk15to18:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13 |
|          |                             |                 | , https://github.com/bcgit/bc-java.git - r1rv86,org.bouncycastle:bcpkix-fips:1.0.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.85.jar     | CVE-2026-71889  | Upgrade to version org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-lts8on:2.73.13,    |
|          |                             |                 | org.bouncycastle:bcprov-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,             |
|          |                             |                 | org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86,org.bouncycastle:bcprov-jdk15to18:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13 |
|          |                             |                 | , https://github.com/bcgit/bc-java.git - r1rv86,org.bouncycastle:bcpkix-fips:1.0.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | commons-codec-1.22.1.jar    | CVE-2026-119078 | Upgrade to version commons-codec:commons-codec:1.23.0, https://github.com/apache/commons-codec.git - |
|          |                             |                 | rel/commons-codec-1.23.0                                                                             |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | guava-19.0.jar              | CVE-2026-102554 | Upgrade to version com.google.guava:guava:33.7.2, https://github.com/google/guava.git - v33.7.2,     |
|          |                             |                 | com.google.guava:guava:33.7.2-jre                                                                    |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.2.jar     | CVE-2026-89407  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.18.11,                                  |
|          |                             |                 | com.fasterxml.jackson.core:jackson-core:2.21.7,com.fasterxml.jackson.core:jackson-core:2.22.3,       |
|          |                             |                 | tools.jackson.core:jackson-core:3.1.7, https://github.com/FasterXML/jackson-core.git -               |
|          |                             |                 | jackson-core-2.22.3, https://github.com/FasterXML/jackson-core.git - jackson-core-3.2.2,             |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7,                                  |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.2.jar     | CVE-2026-89425  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.18.11,                                  |
|          |                             |                 | com.fasterxml.jackson.core:jackson-core:2.21.7,com.fasterxml.jackson.core:jackson-core:2.22.3,       |
|          |                             |                 | tools.jackson.core:jackson-core:3.1.7, https://github.com/FasterXML/jackson-core.git -               |
|          |                             |                 | jackson-core-3.2.3, https://github.com/FasterXML/jackson-core.git - jackson-core-2.22.3,             |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7,                                 |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7                                   |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.2.jar | CVE-2026-91776  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.11,                              |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.21.7,tools.jackson.core:jackson-databind:3.1.7,        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7,                          |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3                           |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.2.jar | CVE-2026-91777  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.11,                              |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.21.7,tools.jackson.core:jackson-databind:3.1.7,        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3,                          |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7                           |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | logback-classic-1.6.3.jar   | CVE-2026-104721 | Upgrade to version ch.qos.logback:logback-classic:1.6.5, https://github.com/qos-ch/logback.git -     |
|          |                             |                 | v_1.6.5                                                                                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110257 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110258 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110260 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110261 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110263 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-analysis-5.0.3.jar      | CVE-2026-110591 | Upgrade to version org.ow2.asm:asm-analysis:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11      |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-commons-5.0.3.jar       | CVE-2026-110270 | Upgrade to version org.ow2.asm:asm-commons:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11       |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.85.jar     | CVE-2026-17508  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,  |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,    |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcprov-jdk14:1.86,                           |
|          |                             |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-java.git - r1rv86,               |
|          |                             |                 | org.bouncycastle:bcprov-jdk15to18:1.86,org.bouncycastle:bcprov-debug-lts8on:2.73.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-lts8on:2.73.13,org.bouncycastle:bcprov-debug-jdk18on:1.86,                   |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,           |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.85.jar     | CVE-2026-71892  | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.13,org.bouncycastle:bcpkix-jdk14:1.86,        |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,      |
|          |                             |                 | org.bouncycastle:bcpkix-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,                   |
|          |                             |                 | org.bouncycastle:bcpkix-debug-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv86,           |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-17508  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,  |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,    |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcprov-jdk14:1.86,                           |
|          |                             |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-java.git - r1rv86,               |
|          |                             |                 | org.bouncycastle:bcprov-jdk15to18:1.86,org.bouncycastle:bcprov-debug-lts8on:2.73.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-lts8on:2.73.13,org.bouncycastle:bcprov-debug-jdk18on:1.86,                   |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,           |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-18036  | Upgrade to version org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcprov-jdk18on:1.85.2 |
|          |                             |                 | , https://github.com/bcgit/bc-java.git - r1rv85v2,org.bouncycastle:bcprov-debug-jdk14:1.86,          |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcprov-jdk14:1.85.2,                   |
|          |                             |                 | org.bouncycastle:bcprov-jdk15to18:1.85.2                                                             |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-18040  | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85.2,org.bouncycastle:bcprov-debug-jdk14:1.86 |
|          |                             |                 | ,org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcprov-jdk18on:1.85.2,                |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv85v2,         |
|          |                             |                 | org.bouncycastle:bcprov-jdk14:1.85.2                                                                 |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-71891  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.86, https://github.com/bcgit/bc-java.git -      |
|          |                             |                 | r1rv86,org.bouncycastle:bcprov-jdk15to18:1.86,org.bouncycastle:bcprov-debug-jdk18on:1.86,            |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86                                                         |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-97873  | N/A                                                                                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | guava-19.0.jar              | CVE-2018-10237  | Upgrade to version 24.1.1-jre, 24.1.1-android                                                        |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | guava-19.0.jar              | CVE-2023-2976   | Upgrade to version com.google.guava:guava:32.0.1-android,32.0.1-jre                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | asm-commons-5.0.3.jar       | CVE-2026-110262 | Upgrade to version org.ow2.asm:asm-commons:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11       |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | commons-codec-1.22.1.jar    | CVE-2026-124077 | Upgrade to version  https://github.com/apache/commons-codec.git - rel/commons-codec-1.23.0,          |
|          |                             |                 | commons-codec:commons-codec:1.23.0                                                                   |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | guava-19.0.jar              | CVE-2020-8908   | Upgrade to version  https://github.com/google/guava.git - v32.0.0                                    |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | guava-19.0.jar              | CVE-2026-118042 | Upgrade to version com.google.guava:guava:33.8.0-android, https://github.com/google/guava.git -      |
|          |                             |                 | v33.8.0                                                                                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

atlas-identities-1.2.3.jar
|-- logback-classic-1.6.3.jar [1 HIGH]
galley-api-1.24-SNAPSHOT.jar
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
galley-caches-1.24-SNAPSHOT.pom
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-cache-partyline-1.24-SNAPSHOT.jar
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- partyline-2.5.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- weft-1.27.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jboss-logging-3.6.3.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-cache-path-mapped-1.24-SNAPSHOT.jar
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
				|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- commons-io-2.22.0.jar
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-core-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- weft-1.27.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- path-mapped-pathdb-datastax-3.3.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- netty-handler-4.1.138.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- cassandra-driver-core-3.12.1.jar
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
			|-- jnr-ffi-2.1.7.jar
				|-- asm-analysis-5.0.3.jar [1 MEDIUM]
				|-- asm-commons-5.0.3.jar [1 MEDIUM, 1 LOW]
				|-- asm-tree-5.0.3.jar
					|-- asm-5.0.4.jar [5 MEDIUM]
				|-- asm-5.0.4.jar [5 MEDIUM]
			|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
		|-- cassandra-driver-mapping-3.12.1.jar
			|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
			|-- asm-5.0.4.jar [5 MEDIUM]
		|-- path-mapped-common-3.3.jar
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- path-mapped-storage-3.3.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- netty-codec-http-4.1.138.Final.jar
			|-- netty-transport-4.1.138.Final.jar
				|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- netty-common-4.1.138.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- s3-2.54.14.jar
			|-- aws-core-2.54.14.jar
				|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
			|-- sdk-core-2.54.14.jar
				|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
|-- galley-cache-tck-1.24-SNAPSHOT.jar
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
galley-cdi-embedder-1.24-SNAPSHOT.jar
|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- jackson-core-2.22.2.jar [2 HIGH]
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-bindings-jackson-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- weft-1.27.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-cache-partyline-1.24-SNAPSHOT.jar
	|-- partyline-2.5.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jboss-logging-3.6.3.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-core-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-maven-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-relationships-api-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-transport-httpclient-1.24-SNAPSHOT.jar
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- httpclient-4.5.14.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- jhttpc-1.18.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- bcpkix-jdk18on-1.85.jar [2 HIGH, 2 MEDIUM]
			|-- bcutil-jdk18on-1.85.jar
				|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]
		|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]
galley-core-1.24-SNAPSHOT.jar
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- weft-1.27.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
galley-maven-1.24-SNAPSHOT.jar
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
|-- atlas-relationships-api-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-bindings-jackson-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-core-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
galley-testing-1.24-SNAPSHOT.pom
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-test-harness-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-test-harness-core-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-core-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-test-harness-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-test-harness-maven-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
				|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-core-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-maven-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- atlas-relationships-api-1.2.3.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-core-2.22.2.jar [2 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
			|-- atlas-bindings-jackson-identities-1.2.3.jar
				|-- logback-classic-1.6.3.jar [1 HIGH]
				|-- jackson-core-2.22.2.jar [2 HIGH]
				|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- galley-test-harness-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- galley-api-1.24-SNAPSHOT.jar
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
galley-transports-1.24-SNAPSHOT.pom
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-transport-filearc-1.24-SNAPSHOT.jar
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-transport-httpclient-1.24-SNAPSHOT.jar
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- httpclient-4.5.14.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- jhttpc-1.18.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- bcpkix-jdk18on-1.85.jar [2 HIGH, 2 MEDIUM]
			|-- bcutil-jdk18on-1.85.jar
				|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]
		|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]


No Policy violations were detected

Project 'galley-pr' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=c3bf3e52-9bc5-446f-ad91-f936410980f9
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=3293e9a2b318410cb3e9cb4e2caace6d82d023dcee944edfa835841f5a97380c

Mend AI scan succeeded.

Support Token: 3663bd3bc08e4476498e829573ffbf9bc1794408267941

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 14, 2026

dependabot Bot changed the title ~~Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.24 to 0.0.25~~ Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.24 to 0.0.27 Nov 11, 2026

dependabot Bot force-pushed the dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-release.yml-0.0.25 branch from 510ddac to 63d96c2 Compare November 11, 2026 14:41

dependabot Bot closed this Nov 11, 2026

dependabot Bot deleted the dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-release.yml-0.0.25 branch November 11, 2026 14:41

Navigation Menu

Repository navigation

Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.24 to 0.0.27 - #523

Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.24 to 0.0.27#523
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-release.yml-0.0.25

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

rnc commented Nov 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.0.27

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

v0.0.26

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

v0.0.25

What's Changed

Uh oh!

rnc commented Nov 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Mend Scan Results

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading