Bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0 by dependabot[bot] · Pull Request #43 · project-ncl/attester

dependabot · 2026-08-26T21:43:57Z

Bumps com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0.

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.10.0

Added

New <shortenFullyQualifiedTypes> step for Java, which replaces fully-qualified type names with their simple names and adds the imports they need. Best combined with <importOrder> and <removeUnusedImports>. (#2945)

Add embedded lockfiles to Eclipse JDT for every supported version (4.9 through 4.40), so eclipse() resolves from Maven Central instead of querying a P2 update site. Versions without an embedded lockfile still fall back to P2 provisioning. (#1996)

Add support to apply alternate license header within same format (#872)

Add support to skip license header application based on source file content pattern (#650).

Fixed

removeUnusedImports no longer fails on Java import module declarations. (#2890)

Concurrent P2 provisioning no longer races Solstice's on-disk cache (affects Eclipse-based formatters under parallel builds). (#3004)

Changes

Default google-java-format remains 1.28.0 on JVM 17; bumps to 1.30.0 on JVM 21+; require at least 1.30.0 on JVM 25+ for import module support.

Bump default eclipse version to latest 4.39 -> 4.40. (#1996)

Document Maven skip properties spotless.skip, spotless.check.skip, and spotless.apply.skip. Goal-specific skips now live on their own mojos so they no longer leak across goals. (#3009)

Bump default adocfmt version 0.2.0 -> 0.3.1, which adds table formatting support (<formatTables>, <tableLayout>, <tableMaxLineWidth>, <tableBlankLines>).

Commits

426b21d Published maven/3.10.0
2fd42ea Published gradle/8.10.0
d71ed1a Published lib/4.10.0
8b57c01 Add shortenFullyQualifiedTypes step (fixes #2945) (#3005 closes #2945)
6b42c5e fix: make the FQN-collecting visitor a named static class
4430823 Better organization on the changelogs.
45bea6d Better place to put the shortenFullyQualifiedTypes docs
0c49e65 chore: spotlessApply
1c5bc0a docs: list the Java import steps in the plugin README tables of contents
cd57b58 docs: document shortenFullyQualifiedTypes in the plugin READMEs
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.9.0 to 3.10.0. - [Release notes](https://github.com/diffplug/spotless/releases) - [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md) - [Commits](diffplug/spotless@maven/3.9.0...maven/3.10.0) --- updated-dependencies: - dependency-name: com.diffplug.spotless:spotless-maven-plugin dependency-version: 3.10.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-advanced-security · 2026-08-26T21:49:12Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-actions · 2026-08-26T21:49:17Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

⚠️ SAST findings detected

SCA scan output




Identified 285 dependencies

Detected 12 vulnerabilities (1 Critical, 3 High, 8 Medium, 0 Low)

+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |               LIBRARY               |       ID       |                                               TOP FIX                                                |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.136.Final.jar     | CVE-2026-75595 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.137.Final,                        |
|          |                                     |                | https://github.com/netty/netty.git - netty-4.2.17.Final,io.netty:netty-handler:4.1.137.Final,        |
|          |                                     |                | io.netty:netty-handler:4.2.17.Final                                                                  |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                    | CVE-2026-75140 | N/A                                                                                                  |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.136.Final.jar     | CVE-2026-62243 | Upgrade to version io.netty:netty-handler:4.1.137.Final,io.netty:netty-handler:4.2.17.Final          |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.136.Final.jar     | CVE-2026-75596 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                     |                | https://github.com/netty/netty.git - netty-4.2.17.Final, https://github.com/netty/netty.git -        |
|          |                                     |                | netty-4.1.137.Final                                                                                  |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar         | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                                     |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1,                         |
|          |                                     |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                                     |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                     |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                     |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5                          |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar         | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                                     |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                                     |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar         | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                        |
|          |                                     |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                                  |
|          |                                     |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                     |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5         |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar                 | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                                 |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar          | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.17.1,io.micrometer:micrometer-core:1.16.7         |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar          | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-core:1.17.1,                                             |
|          |                                     |                | https://github.com/micrometer-metrics/micrometer.git - v1.17.1,io.micrometer:micrometer-core:1.16.7, |
|          |                                     |                | https://github.com/micrometer-metrics/micrometer.git - v1.16.7,                                      |
|          |                                     |                | io.micrometer:micrometer-registry-statsd:1.17.1,io.micrometer:micrometer-registry-statsd:1.16.7      |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.136.Final.jar  | CVE-2026-59903 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.137.Final,                        |
|          |                                     |                | https://github.com/netty/netty.git - netty-4.2.17.Final                                              |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-socks-4.1.136.Final.jar | CVE-2026-62380 | Upgrade to version io.netty:netty-codec-socks:4.2.17.Final,io.netty:netty-codec-socks:4.1.137.Final  |
+----------+-------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

jackson-jaxrs-json-provider-2.22.0.jar
|-- jackson-jaxrs-base-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jackson-module-jaxb-annotations-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-messaging-kafka-3.38.1.jar
|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- quarkus-jackson-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- quarkus-kafka-client-3.38.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- smallrye-reactive-messaging-provider-4.36.0.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- kafka-clients-4.2.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
quarkus-micrometer-opentelemetry-3.38.1.jar
|-- quarkus-micrometer-3.38.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-oidc-client-3.38.1.jar
|-- quarkus-oidc-common-3.38.1.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
		|-- vertx-web-client-4.5.30.jar
			|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-oidc-3.38.1.jar
|-- quarkus-vertx-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- quarkus-netty-3.38.1.jar
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-rest-client-jackson-3.38.1.jar
|-- resteasy-reactive-jackson-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-rest-jackson-3.38.1.jar
|-- quarkus-rest-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-smallrye-fault-tolerance-3.38.1.jar
|-- smallrye-fault-tolerance-6.11.2.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
	|-- smallrye-fault-tolerance-core-6.11.2.jar
		|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-smallrye-health-3.38.1.jar
|-- quarkus-vertx-http-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- vertx-web-4.5.30.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [3 MEDIUM]
pnc-common-3.5.3-jakarta.jar
|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- pom-manipulation-common-lite-5.5.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- pnc-api-3.5.2-jakarta.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jsoup-1.23.1.jar [1 HIGH]
	|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
	|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]
		|-- netty-codec-4.1.136.Final.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
rest-client-jakarta-3.5.12.jar
|-- jackson-jakarta-rs-json-provider-2.22.0.jar
	|-- jackson-jakarta-rs-base-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- common-3.5.12-jakarta.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- dto-3.5.12-patch-builders-jakarta.jar
	|-- jsoup-1.23.1.jar [1 HIGH]
rest-client-3.5.12-jakarta.jar
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- json-patch-1.13.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- jackson-coreutils-2.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- vertx-core-4.5.30.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- netty-codec-http2-4.1.136.Final.jar
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]
	|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]
	|-- netty-handler-proxy-4.1.136.Final.jar
		|-- netty-codec-http-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-codec-socks-4.1.136.Final.jar [1 MEDIUM]
		|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]
	|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]
	|-- netty-resolver-dns-4.1.136.Final.jar
		|-- netty-handler-4.1.136.Final.jar [1 CRITICAL, 2 HIGH]


No Policy violations were detected

Project 'attester' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=03ce69bb-fcbb-4fa8-90ad-29718d5a330e
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=219d83d4221b40039ad2a9d242d4294f7b6af41e050641a4925c95e5d6894808

Mend AI scan succeeded.

Support Token: 16eccb99752754cfcaf0f7ec26c1f229d1787780893784

SAST scan output

warning: 'error' method could be abused to perform a Log Injection attack. User input reached a Log4j sink. (src/main/java/org/jboss/pnc/attester/Attester.java:135)

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 26, 2026

thescouser89 merged commit 3a60cad into main Aug 28, 2026
3 checks passed

dependabot Bot deleted the dependabot/maven/com.diffplug.spotless-spotless-maven-plugin-3.10.0 branch August 28, 2026 15:01

Navigation Menu

Uh oh!

Bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0 - #43

Bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0#43
thescouser89 merged 1 commit into
mainfrom
dependabot/maven/com.diffplug.spotless-spotless-maven-plugin-3.10.0

dependabot Bot commented on behalf of github Aug 26, 2026

Uh oh!

github-advanced-security AI commented Aug 26, 2026

Uh oh!

github-actions Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 26, 2026

Maven Plugin v3.10.0

Added

Fixed

Changes

Uh oh!

github-advanced-security AI commented Aug 26, 2026

What Enabling Code Scanning Means:

Uh oh!

github-actions Bot commented Aug 26, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants