Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23 by dependabot[bot] · Pull Request #641 · project-ncl/cleaner

dependabot · 2026-09-03T00:05:09Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml's releases.

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

Update from main to v0.0.22 by @rnc in project-ncl/shared-github-actions#103

Ignore commonjava libraries for cooldown by @rnc in project-ncl/shared-github-actions#104

Add gradle-release workflow by @rnc in project-ncl/shared-github-actions#111

Fix gh release. Remove release_type. by @rnc in project-ncl/shared-github-actions#112

Update README by @rnc in project-ncl/shared-github-actions#113

👒 CI Dependencies

Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in project-ncl/shared-github-actions#105

Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 by @dependabot[bot] in project-ncl/shared-github-actions#106

Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in project-ncl/shared-github-actions#107

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#108

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#109

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#110

Full Changelog: project-ncl/shared-github-actions@v0.0.22...v0.0.23

Commits

646d9b6 Merge pull request #113 from rnc/BR1
c3d39a7 Update README
72c18d4 Merge pull request #112 from rnc/BR1
8f83747 Fix gh release. Remove release_type.
1184278 Merge pull request #111 from rnc/GRADLERELEASE
83338f8 Merge pull request #110 from project-ncl/dependabot/github_actions/project-nc...
4768239 Merge pull request #109 from project-ncl/dependabot/github_actions/project-nc...
1f0a576 Merge pull request #108 from project-ncl/dependabot/github_actions/project-nc...
3f6ac23 Merge pull request #107 from project-ncl/dependabot/github_actions/zizmorcore...
1f44af1 Merge pull request #106 from project-ncl/dependabot/github_actions/gradle/act...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…ot.yml Bumps [project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.22 to 0.0.23. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@a27e6fb...646d9b6) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-03T00:11:05Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 357 dependencies

Detected 11 vulnerabilities (0 Critical, 2 High, 8 Medium, 1 Low)

+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |            LIBRARY             |       ID       |                                               TOP FIX                                                |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar               | CVE-2026-75140 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | resteasy-core-6.2.16.Final.jar | CVE-2026-17615 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-19032 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.22.2,                               |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.1.6,        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,tools.jackson.core:jackson-databind:3.2.2        |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,     |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1,                         |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4                           |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                                |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar    | CVE-2026-83557 | Upgrade to version tools.jackson.core:jackson-databind:3.1.6,                                        |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                                  |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,                                                 |
|          |                                |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.2.2         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar            | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                                 |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar     | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.17.1,io.micrometer:micrometer-core:1.16.7         |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar     | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-core:1.16.7,                                             |
|          |                                |                | https://github.com/micrometer-metrics/micrometer.git - v1.17.1,io.micrometer:micrometer-core:1.17.1, |
|          |                                |                | io.micrometer:micrometer-registry-statsd:1.17.1,io.micrometer:micrometer-registry-statsd:1.16.7,     |
|          |                                |                | https://github.com/micrometer-metrics/micrometer.git - v1.16.7                                       |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | LatencyUtils-2.0.3.jar         | CVE-2026-82596 | N/A                                                                                                  |
+----------+--------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

jackson-jaxrs-json-provider-2.22.2.jar
|-- jackson-jaxrs-base-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-jaxb-annotations-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
micrometer-registry-prometheus-1.17.0.jar
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-hibernate-orm-panache-3.39.0.jar
|-- quarkus-hibernate-orm-3.39.0.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-micrometer-3.39.0.jar
|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- quarkus-resteasy-3.39.0.jar
	|-- quarkus-resteasy-server-common-3.39.0.jar
		|-- resteasy-cdi-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- kafka-clients-4.2.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- LatencyUtils-2.0.3.jar [1 LOW]
quarkus-oidc-client-3.39.0.jar
|-- quarkus-oidc-common-3.39.0.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- vertx-web-client-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- quarkus-vertx-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-resteasy-client-jackson-3.39.0.jar
|-- quarkus-resteasy-client-3.39.0.jar
	|-- quarkus-resteasy-common-3.39.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- microprofile-config-3.0.1.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
	|-- resteasy-multipart-provider-6.2.16.Final.jar
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-jaxb-provider-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- resteasy-jackson2-provider-6.2.16.Final.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-jakarta-rs-base-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
quarkus-resteasy-jackson-3.39.0.jar
|-- quarkus-jackson-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-smallrye-health-3.39.0.jar
|-- quarkus-vertx-http-3.39.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- vertx-web-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
failsafe-2.4.4.jar
|-- vertx-core-4.5.32.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
indy-client-core-java-3.4.5.jar
|-- indy-model-core-java-1.5.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- atlas-bindings-jackson-identities-1.1.3.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- atlas-relationships-api-1.1.3.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-common-3.5.5-SNAPSHOT-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pom-manipulation-common-lite-5.6.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pnc-api-3.5.2-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jsoup-1.23.1.jar [1 HIGH]
	|-- netty-handler-4.1.137.Final.jar
		|-- netty-codec-4.1.137.Final.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
rest-client-jakarta-3.5.15.jar
|-- jackson-jakarta-rs-json-provider-2.22.0.jar
	|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- common-3.5.15-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- dto-3.5.15-patch-builders-jakarta.jar
	|-- jsoup-1.23.1.jar [1 HIGH]
rest-client-3.5.15-jakarta.jar
|-- json-patch-1.13.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-coreutils-2.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
resteasy-client-6.2.16.Final.jar
|-- resteasy-core-6.2.16.Final.jar [1 HIGH]


No Policy violations were detected

Project 'cleaner' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=b6b32547-c032-445d-a1e9-03a59d6b736b
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=10a714dfb5574fcead8c6d64898dcf58d430f60259204c6eb77f4ee4bf394908

Mend AI scan succeeded.

Support Token: 223c6c97add1c47119dcf7ad43c4489eb1788394216230

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 3, 2026

rnc merged commit 3ff1e2e into main Sep 7, 2026
6 checks passed

dependabot Bot deleted the dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-snapshot.yml-0.0.23 branch September 7, 2026 08:10

Navigation Menu

Uh oh!

Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23 - #641

Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23#641
rnc merged 1 commit into
mainfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-snapshot.yml-0.0.23

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

Uh oh!

github-actions Bot commented Sep 3, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant