Bump org.jboss.pnc:pnc-common from 3.5.2 to 3.5.3 by dependabot[bot] · Pull Request #41 · project-ncl/attester

dependabot · 2026-08-19T21:44:34Z

Bumps org.jboss.pnc:pnc-common from 3.5.2 to 3.5.3.

Release notes

Sourced from org.jboss.pnc:pnc-common's releases.

3.5.3

What's Changed

🐛 Fixes / 🚀 Enhancements

Add tests by @rnc in project-ncl/pnc-common#336

Bump shared-github-actions to v0.0.22 by @patrikk0123 in project-ncl/pnc-common#350

Update jboss-parent by @rnc in project-ncl/pnc-common#349

Fix MD5 calculation by @rnc in project-ncl/pnc-common#355

Add helper method to know if suffixes were configured by @thescouser89 in project-ncl/pnc-common#356

👒 Project Dependencies

Bump com.diffplug.spotless:spotless-maven-plugin from 3.7.0 to 3.8.0 by @dependabot[bot] in project-ncl/pnc-common#338

Bump org.jboss.pnc:pnc-api from 3.5.1 to 3.5.2 by @dependabot[bot] in project-ncl/pnc-common#339

Bump org.junit.jupiter:junit-jupiter-engine from 6.1.0 to 6.1.1 by @dependabot[bot] in project-ncl/pnc-common#340

Bump io.smallrye.config:smallrye-config-core from 3.17.2 to 3.18.0 by @dependabot[bot] in project-ncl/pnc-common#342

Bump jackson.version from 2.22.0 to 2.22.1 by @dependabot[bot] in project-ncl/pnc-common#341

Bump org.jboss.pnc.maven-manipulator:pom-manipulation-common-lite from 5.3 to 5.4 by @dependabot[bot] in project-ncl/pnc-common#344

Bump org.junit.jupiter:junit-jupiter-engine from 6.1.1 to 6.1.2 by @dependabot[bot] in project-ncl/pnc-common#345

Bump org.jboss.pnc.maven-manipulator:pom-manipulation-common-lite from 5.4 to 5.5 by @dependabot[bot] in project-ncl/pnc-common#347

Bump io.smallrye.config:smallrye-config-core from 3.18.0 to 3.18.1 by @dependabot[bot] in project-ncl/pnc-common#346

Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in project-ncl/pnc-common#353

Bump org.jsoup:jsoup from 1.22.2 to 1.23.1 by @dependabot[bot] in project-ncl/pnc-common#352

Bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @dependabot[bot] in project-ncl/pnc-common#351

Full Changelog: project-ncl/pnc-common@3.5.2...3.5.3

Commits

ee8018d [maven-release-plugin] prepare release 3.5.3
9642007 Add helper method to know if suffixes were configured
4c02c84 Fix MD5 calculation
09185a2 Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
3476bb5 Bump org.jsoup:jsoup from 1.22.2 to 1.23.1
792af76 Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0
d3e0aa7 Update jboss-parent
1c25f62 Bump shared-github-actions to v0.0.22
7ed513c Bump io.smallrye.config:smallrye-config-core from 3.18.0 to 3.18.1
f3004de Bump org.jboss.pnc.maven-manipulator:pom-manipulation-common-lite
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.jboss.pnc:pnc-common](https://github.com/project-ncl/pnc-common) from 3.5.2 to 3.5.3. - [Release notes](https://github.com/project-ncl/pnc-common/releases) - [Commits](project-ncl/pnc-common@3.5.2...3.5.3) --- updated-dependencies: - dependency-name: org.jboss.pnc:pnc-common dependency-version: 3.5.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-19T21:49:45Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

⚠️ SAST findings detected

SCA scan output




Identified 286 dependencies

Detected 4 vulnerabilities (0 Critical, 0 High, 4 Medium, 0 Low)

+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| SEVERITY |              LIBRARY               |       ID       |                                             TOP FIX                                             |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar        | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4, |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                             |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                             |
|          |                                    |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                    |
|          |                                    |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                    |
|          |                                    |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                     |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar        | CVE-2026-59889 | Upgrade to version tools.jackson.core:jackson-databind:3.1.5,                                   |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.2.1,   |
|          |                                    |                | com.fasterxml.jackson.core:jackson-databind:2.21.5                                              |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar                | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                            |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.136.Final.jar | CVE-2026-59903 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.137.Final,                   |
|          |                                    |                | https://github.com/netty/netty.git - netty-4.2.17.Final                                         |
+----------+------------------------------------+----------------+-------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

jackson-jaxrs-json-provider-2.22.0.jar
|-- jackson-jaxrs-base-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-module-jaxb-annotations-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-messaging-kafka-3.38.1.jar
|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- quarkus-jackson-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-kafka-client-3.38.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- kafka-clients-4.2.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
quarkus-micrometer-opentelemetry-3.38.1.jar
|-- quarkus-micrometer-3.38.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
quarkus-oidc-client-3.38.1.jar
|-- quarkus-oidc-common-3.38.1.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- vertx-web-client-4.5.30.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-oidc-3.38.1.jar
|-- quarkus-vertx-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- quarkus-netty-3.38.1.jar
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-rest-client-jackson-3.38.1.jar
|-- resteasy-reactive-jackson-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-rest-jackson-3.38.1.jar
|-- quarkus-rest-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-smallrye-health-3.38.1.jar
|-- quarkus-vertx-http-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- vertx-web-4.5.30.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pnc-common-3.5.3-jakarta.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- pom-manipulation-common-lite-5.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- pnc-api-3.5.2.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jsoup-1.23.1.jar
	|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
rest-client-jakarta-3.5.10.jar
|-- jackson-jakarta-rs-json-provider-2.22.0.jar
	|-- jackson-jakarta-rs-base-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- common-3.5.10-jakarta.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
rest-client-3.5.10-jakarta.jar
|-- json-patch-1.13.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- jackson-coreutils-2.0.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- vertx-core-4.5.30.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- netty-codec-http2-4.1.136.Final.jar
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
	|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-codec-4.1.136.Final.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
	|-- netty-handler-proxy-4.1.136.Final.jar
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]


No Policy violations were detected

Project 'attester' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=03ce69bb-fcbb-4fa8-90ad-29718d5a330e
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=219d83d4221b40039ad2a9d242d4294f7b6af41e050641a4925c95e5d6894808

Mend AI scan succeeded.

Support Token: 3a3aa87db89464fc99830ab00bf113a1f1787176128802

SAST scan output

warning: 'error' method could be abused to perform a Log Injection attack. User input reached a Log4j sink. (src/main/java/org/jboss/pnc/attester/Attester.java:135)

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 19, 2026

thescouser89 merged commit 4e52ade into main Aug 21, 2026
3 checks passed

dependabot Bot deleted the dependabot/maven/org.jboss.pnc-pnc-common-3.5.3 branch August 21, 2026 14:12

Navigation Menu

Uh oh!

Bump org.jboss.pnc:pnc-common from 3.5.2 to 3.5.3 - #41

Bump org.jboss.pnc:pnc-common from 3.5.2 to 3.5.3#41
thescouser89 merged 1 commit into
mainfrom
dependabot/maven/org.jboss.pnc-pnc-common-3.5.3

dependabot Bot commented on behalf of github Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 19, 2026

3.5.3

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 Project Dependencies

Uh oh!

github-actions Bot commented Aug 19, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant