Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23 by dependabot[bot] · Pull Request #758 · project-ncl/bifrost

dependabot · 2026-08-28T18:13:24Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-ci.yml's releases.

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

Update from main to v0.0.22 by @rnc in project-ncl/shared-github-actions#103

Ignore commonjava libraries for cooldown by @rnc in project-ncl/shared-github-actions#104

Add gradle-release workflow by @rnc in project-ncl/shared-github-actions#111

Fix gh release. Remove release_type. by @rnc in project-ncl/shared-github-actions#112

Update README by @rnc in project-ncl/shared-github-actions#113

👒 CI Dependencies

Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in project-ncl/shared-github-actions#105

Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 by @dependabot[bot] in project-ncl/shared-github-actions#106

Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in project-ncl/shared-github-actions#107

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#108

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#109

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#110

Full Changelog: project-ncl/shared-github-actions@v0.0.22...v0.0.23

Commits

646d9b6 Merge pull request #113 from rnc/BR1
c3d39a7 Update README
72c18d4 Merge pull request #112 from rnc/BR1
8f83747 Fix gh release. Remove release_type.
1184278 Merge pull request #111 from rnc/GRADLERELEASE
83338f8 Merge pull request #110 from project-ncl/dependabot/github_actions/project-nc...
4768239 Merge pull request #109 from project-ncl/dependabot/github_actions/project-nc...
1f0a576 Merge pull request #108 from project-ncl/dependabot/github_actions/project-nc...
3f6ac23 Merge pull request #107 from project-ncl/dependabot/github_actions/zizmorcore...
1f44af1 Merge pull request #106 from project-ncl/dependabot/github_actions/gradle/act...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [project-ncl/shared-github-actions/.github/workflows/maven-ci.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.22 to 0.0.23. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@a27e6fb...646d9b6) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-28T18:17:51Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 345 dependencies

Detected 10 vulnerabilities (0 Critical, 3 High, 7 Medium, 0 Low)

+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                    LIBRARY                    |       ID       |                                               TOP FIX                                                |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                              | CVE-2026-75140 | N/A                                                                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | sshd-common-2.18.0.jar                        | CVE-2026-56624 | Upgrade to version  https://github.com/apache/mina-sshd.git - sshd-3.0.0-M5,                         |
|          |                                               |                | org.apache.sshd:sshd-core:2.19.0,org.apache.sshd:sshd-common:3.0.0-M5,                               |
|          |                                               |                | org.apache.sshd:sshd-core:3.0.0-M5, https://github.com/apache/mina-sshd.git - sshd-2.19.0,           |
|          |                                               |                | org.apache.sshd:sshd-common:2.19.0                                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | wildfly-elytron-password-impl-2.9.2.Final.jar | CVE-2026-19611 | N/A                                                                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                          |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.22.1,                               |
|          |                                               |                | tools.jackson.core:jackson-databind:3.2.1,tools.jackson.core:jackson-databind:3.1.5,                 |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                        |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5         |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | log4j-api-2.26.0.jar                          | CVE-2026-49844 | Upgrade to version org.apache.logging.log4j:log4j-api:2.26.1,                                        |
|          |                                               |                | org.apache.logging.log4j:log4j-api:2.25.5                                                            |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar                           | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                                 |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar                    | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.16.7,io.micrometer:micrometer-core:1.17.1         |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.17.0.jar                    | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-registry-statsd:1.16.7,                                  |
|          |                                               |                | io.micrometer:micrometer-registry-statsd:1.17.1,                                                     |
|          |                                               |                | https://github.com/micrometer-metrics/micrometer.git - v1.16.7,io.micrometer:micrometer-core:1.17.1, |
|          |                                               |                | io.micrometer:micrometer-core:1.16.7, https://github.com/micrometer-metrics/micrometer.git - v1.17.1 |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

commons-beanutils-1.11.0.jar
|-- commons-logging-1.3.5.jar
	|-- log4j-api-2.26.0.jar [1 MEDIUM]
quarkus-elytron-security-ldap-3.38.2.jar
|-- quarkus-elytron-security-3.38.2.jar
	|-- quarkus-elytron-security-common-3.38.2.jar
		|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
	|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
	|-- wildfly-elytron-realm-2.9.2.Final.jar
		|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
|-- wildfly-elytron-realm-ldap-2.9.2.Final.jar
	|-- wildfly-elytron-client-2.9.2.Final.jar
		|-- wildfly-elytron-auth-util-2.9.2.Final.jar
			|-- sshd-common-2.18.0.jar [1 HIGH]
		|-- wildfly-elytron-credential-source-impl-2.9.2.Final.jar
			|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
		|-- wildfly-elytron-credential-store-2.9.2.Final.jar
			|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
		|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
		|-- wildfly-elytron-ssh-util-2.9.2.Final.jar
			|-- sshd-common-2.18.0.jar [1 HIGH]
quarkus-hibernate-orm-panache-3.38.2.jar
|-- quarkus-hibernate-orm-3.38.2.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
|-- quarkus-jackson-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-hibernate-validator-3.38.2.jar
|-- quarkus-vertx-http-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-messaging-kafka-3.38.2.jar
|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- quarkus-kafka-client-3.38.2.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
|-- smallrye-reactive-messaging-provider-4.36.0.jar
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- kafka-clients-4.2.1.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
quarkus-micrometer-opentelemetry-3.38.2.jar
|-- quarkus-micrometer-3.38.2.jar
	|-- lz4-java-1.10.1.jar [1 MEDIUM]
	|-- micrometer-core-1.17.0.jar [2 MEDIUM]
quarkus-oidc-3.38.2.jar
|-- quarkus-oidc-common-3.38.2.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-rest-jackson-3.38.2.jar
|-- quarkus-rest-jackson-common-3.38.2.jar
	|-- resteasy-reactive-jackson-3.38.2.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- quarkus-rest-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- resteasy-reactive-vertx-3.38.2.jar
		|-- vertx-web-client-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [3 MEDIUM]
quarkus-scheduler-3.38.2.jar
|-- quarkus-vertx-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- quarkus-virtual-threads-3.38.2.jar
	|-- vertx-core-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
		|-- log4j-api-2.26.0.jar [1 MEDIUM]
quarkus-websockets-3.38.2.jar
|-- quarkus-http-websocket-vertx-5.5.0.jar
	|-- vertx-web-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
log4j2-jboss-logmanager-2.0.1.Final.jar
|-- log4j-api-2.26.0.jar [1 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [3 MEDIUM]
pnc-common-3.5.3-jakarta.jar
|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- smallrye-config-core-3.17.2.jar
	|-- jboss-logging-3.6.3.Final.jar
		|-- log4j-api-2.26.0.jar [1 MEDIUM]
|-- pom-manipulation-common-lite-5.5.jar
	|-- jackson-databind-2.22.0.jar [3 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [3 MEDIUM]
|-- jsoup-1.23.1.jar [1 HIGH]
	|-- netty-handler-4.1.137.Final.jar
		|-- netty-codec-4.1.137.Final.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
		|-- netty-common-4.1.137.Final.jar
			|-- log4j-api-2.26.0.jar [1 MEDIUM]


No Policy violations were detected

Project 'bifrost' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=6f96f5b2-9c9b-4278-9b82-9d6df74668d4
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=36adb091fafb4fcca42e3c432dc659d2db604300d8004d4a845f39d4f10a292f

Mend AI scan succeeded.

Support Token: 1d8273eee472f47868ed4ef66741b1a971787941008198

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 28, 2026

thescouser89 merged commit e91e78f into main Aug 31, 2026
5 checks passed

dependabot Bot deleted the dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-ci.yml-0.0.23 branch August 31, 2026 02:27

Navigation Menu

Uh oh!

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23 - #758

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23#758
thescouser89 merged 1 commit into
mainfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-ci.yml-0.0.23

dependabot Bot commented on behalf of github Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 28, 2026

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

Uh oh!

github-actions Bot commented Aug 28, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant