Skip to content

Bump org.jboss.pnc:bifrost-upload-client from 3.5.0 to 3.5.1 - #371

Merged
akridl merged 1 commit into
mainfrom
dependabot/maven/org.jboss.pnc-bifrost-upload-client-3.5.1
Sep 2, 2026
Merged

Bump org.jboss.pnc:bifrost-upload-client from 3.5.0 to 3.5.1#371
akridl merged 1 commit into
mainfrom
dependabot/maven/org.jboss.pnc-bifrost-upload-client-3.5.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown
Contributor

Bumps org.jboss.pnc:bifrost-upload-client from 3.5.0 to 3.5.1.

Release notes

Sourced from org.jboss.pnc:bifrost-upload-client's releases.

3.5.1

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 Project Dependencies

👒 CI Dependencies

New Contributors

Full Changelog: project-ncl/bifrost-upload-client@3.5.0...3.5.1

Commits
  • 5407cc7 [maven-release-plugin] prepare release 3.5.1
  • 5b0cbb6 Spotless missing during release (#76)
  • 87879b6 Update httpclient5 to 5.6.2 (#75)
  • 00f02cf Bump shared-github-actions to v0.0.21
  • edb8359 Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml (#67)
  • 2d1ffc6 Bump project-ncl/shared-github-actions/.github/workflows/mend-ci.yml (#68)
  • adc4266 Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml (...
  • 23cc784 Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml (#70)
  • daf5040 Bump org.sonatype.central:central-publishing-maven-plugin (#71)
  • 07d2fd8 Bump project-ncl/shared-github-actions/.github/workflows/validate-gh-action.y...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jul 7, 2026
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output



Identified 468 dependencies

Detected 36 vulnerabilities (2 Critical, 14 High, 19 Medium, 1 Low)

+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                    LIBRARY                    |       ID       |                                               TOP FIX                                                |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.6.2.jar                         | CVE-2026-71290 | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                               |                | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.135.Final.jar               | CVE-2026-75595 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                               |                | netty-4.2.17.Final                                                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                              | CVE-2026-75140 | N/A                                                                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.135.Final.jar                 | CVE-2026-59901 | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-haproxy-4.1.135.Final.jar         | CVE-2026-55851 | Upgrade to version io.netty:netty-codec-haproxy:4.2.16.Final,                                        |
|          |                                               |                | io.netty:netty-codec-haproxy:4.1.136.Final, https://github.com/netty/netty.git - netty-4.2.16.Final, |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.1.136.Final                                             |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-55831 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-55833 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-56745 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                               |                | netty-4.2.16.Final                                                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-56819 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final,io.netty:netty-codec-http2:4.2.16.Final, |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                               |                | netty-4.2.16.Final                                                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-59900 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final                                          |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.135.Final.jar               | CVE-2026-62243 | Upgrade to version io.netty:netty-handler:4.1.137.Final,io.netty:netty-handler:4.2.17.Final          |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.135.Final.jar               | CVE-2026-75596 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.2.17.Final, https://github.com/netty/netty.git -        |
|          |                                               |                | netty-4.1.137.Final                                                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | sshd-common-2.17.1.jar                        | CVE-2026-56624 | Upgrade to version  https://github.com/apache/mina-sshd.git - sshd-3.0.0-M5,                         |
|          |                                               |                | org.apache.sshd:sshd-core:2.19.0,org.apache.sshd:sshd-common:3.0.0-M5,                               |
|          |                                               |                | org.apache.sshd:sshd-core:3.0.0-M5, https://github.com/apache/mina-sshd.git - sshd-2.19.0,           |
|          |                                               |                | org.apache.sshd:sshd-common:2.19.0                                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-core-4.5.28.jar                         | CVE-2026-15075 | Upgrade to version  https://github.com/eclipse-vertx/vert.x.git - 5.1.5,io.vertx:vertx-core:4.5.30,  |
|          |                                               |                | io.vertx:vertx-core:5.1.5, https://github.com/eclipse-vertx/vert.x.git - 4.5.30                      |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-web-client-4.5.28.jar                   | CVE-2026-15076 | Upgrade to version io.vertx:vertx-web-client:4.5.30, https://github.com/vert-x3/vertx-web.git -      |
|          |                                               |                | 4.5.30, https://github.com/vert-x3/vertx-web.git - 5.1.5,io.vertx:vertx-web-client:5.1.5             |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | wildfly-elytron-password-impl-2.9.1.Final.jar | CVE-2026-19611 | N/A                                                                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | httpclient5-5.6.2.jar                         | CVE-2026-64607 | Upgrade to version org.apache.httpcomponents.client5:httpclient5:5.6.3                               |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | ivy-2.5.3.jar                                 | CVE-2026-26032 | Upgrade to version org.apache.ivy:ivy:2.6.0, https://github.com/apache/ant-ivy.git - rel/2.6.0       |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-19032 | Upgrade to version tools.jackson.core:jackson-databind:3.2.2,                                        |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.1.6,        |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.10                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                          |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                                               |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                        |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5         |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-83557 | Upgrade to version tools.jackson.core:jackson-databind:3.1.6,                                        |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                                  |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,                                                 |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.2.2         |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | lz4-java-1.10.1.jar                           | CVE-2026-59949 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.1                                 |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.16.6.jar                    | CVE-2026-59295 | Upgrade to version io.micrometer:micrometer-core:1.17.1,io.micrometer:micrometer-core:1.16.7         |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | micrometer-core-1.16.6.jar                    | CVE-2026-59296 | Upgrade to version io.micrometer:micrometer-registry-statsd:1.16.7,                                  |
|          |                                               |                | io.micrometer:micrometer-registry-statsd:1.17.1,                                                     |
|          |                                               |                | https://github.com/micrometer-metrics/micrometer.git - v1.16.7,io.micrometer:micrometer-core:1.17.1, |
|          |                                               |                | io.micrometer:micrometer-core:1.16.7, https://github.com/micrometer-metrics/micrometer.git - v1.17.1 |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-dns-4.1.135.Final.jar             | CVE-2026-73508 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.136.Final                         |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-haproxy-4.1.135.Final.jar         | CVE-2026-59919 | io.netty:netty-codec-haproxy:4.1.136.Final,io.netty:netty-codec-haproxy:4.2.16.Final                 |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.135.Final.jar            | CVE-2026-56746 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                               |                | netty-4.2.16.Final                                                                                   |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.135.Final.jar            | CVE-2026-59898 | io.netty:netty-codec-http:4.1.136.Final,io.netty:netty-codec-http:4.2.16.Final                       |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.135.Final.jar            | CVE-2026-59899 | io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final                       |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.135.Final.jar            | CVE-2026-59903 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.137.Final,                        |
|          |                                               |                | https://github.com/netty/netty.git - netty-4.2.17.Final                                              |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-http-4.1.135.Final.jar            | CVE-2026-59921 | io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final                       |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | netty-codec-socks-4.1.135.Final.jar           | CVE-2026-62380 | Upgrade to version io.netty:netty-codec-socks:4.2.17.Final,io.netty:netty-codec-socks:4.1.137.Final  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | opentelemetry-api-1.60.1.jar                  | CVE-2026-45292 | Upgrade to version  https://github.com/open-telemetry/opentelemetry-java.git - v1.62.0,              |
|          |                                               |                | io.opentelemetry:opentelemetry-extension-trace-propagators:1.62.0                                    |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | LatencyUtils-2.0.3.jar                        | CVE-2026-82596 | N/A                                                                                                  |
+----------+-----------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-micrometer-opentelemetry-3.37.1.jar
|-- opentelemetry-micrometer-1.5-2.26.1-alpha.jar
	|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
|-- quarkus-micrometer-3.37.1.jar
	|-- micrometer-core-1.16.6.jar [2 MEDIUM]
		|-- LatencyUtils-2.0.3.jar [1 LOW]
	|-- quarkus-vertx-http-3.37.1.jar
		|-- smallrye-mutiny-vertx-web-3.22.2.jar
			|-- smallrye-mutiny-vertx-uri-template-3.22.2.jar
				|-- vertx-uri-template-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
|-- quarkus-opentelemetry-3.37.1.jar
	|-- opentelemetry-instrumentation-annotations-support-2.26.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-instrumentation-annotations-2.26.1.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-instrumentation-api-2.26.1.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-jdbc-2.26.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-runtime-telemetry-java17-2.26.1-alpha.jar
		|-- opentelemetry-runtime-telemetry-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-api-incubator-1.60.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-exporter-otlp-common-1.60.1.jar
		|-- opentelemetry-exporter-common-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-exporter-otlp-1.60.1.jar
		|-- opentelemetry-sdk-metrics-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-sdk-1.60.1.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-common-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-logs-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-trace-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- quarkus-grpc-common-3.37.1.jar
		|-- vertx-grpc-server-4.5.28.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- vertx-grpc-4.5.28.jar
			|-- grpc-netty-1.81.0.jar
				|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-tls-registry-3.37.1.jar
		|-- smallrye-private-key-pem-parser-0.9.3.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- vertx-web-4.5.28.jar
			|-- vertx-auth-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-bridge-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-vertx-3.37.1.jar
		|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- quarkus-netty-3.37.1.jar
			|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
		|-- quarkus-virtual-threads-3.37.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-mutiny-vertx-core-3.22.2.jar
			|-- smallrye-mutiny-vertx-runtime-3.22.2.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-fault-tolerance-vertx-6.11.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- smallrye-common-vertx-context-2.18.1.jar
		|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- vertx-grpc-client-4.5.28.jar
		|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-handler-proxy-4.1.135.Final.jar
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-codec-socks-4.1.135.Final.jar [1 MEDIUM]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- netty-resolver-dns-4.1.135.Final.jar
				|-- netty-codec-dns-4.1.135.Final.jar [1 MEDIUM]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
		|-- vertx-grpc-common-4.5.28.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
reqour-adjuster-3.5.6-SNAPSHOT.jar
|-- quarkus-micrometer-opentelemetry-3.37.1.jar
	|-- opentelemetry-micrometer-1.5-2.26.1-alpha.jar
		|-- opentelemetry-instrumentation-api-2.26.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- quarkus-micrometer-3.37.1.jar
		|-- lz4-java-1.10.1.jar [1 MEDIUM]
		|-- micrometer-core-1.16.6.jar [2 MEDIUM]
			|-- httpclient5-5.6.2.jar [1 CRITICAL, 1 MEDIUM]
			|-- LatencyUtils-2.0.3.jar [1 LOW]
		|-- resteasy-reactive-client-3.37.1.jar
			|-- smallrye-mutiny-vertx-core-3.22.2.jar
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
				|-- smallrye-mutiny-vertx-runtime-3.22.2.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-client-4.5.28.jar [1 HIGH]
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
				|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-uri-template-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-web-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- quarkus-vertx-http-3.37.1.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- kafka-clients-4.2.1.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
	|-- quarkus-opentelemetry-3.37.1.jar
		|-- opentelemetry-instrumentation-annotations-support-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-instrumentation-annotations-2.26.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-jdbc-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-runtime-telemetry-java17-2.26.1-alpha.jar
			|-- opentelemetry-runtime-telemetry-2.26.1-alpha.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-incubator-1.60.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-common-1.60.1.jar
			|-- opentelemetry-exporter-common-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-1.60.1.jar
			|-- opentelemetry-sdk-trace-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-common-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-logs-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-metrics-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- quarkus-grpc-common-3.37.1.jar
			|-- vertx-grpc-server-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-4.5.28.jar
				|-- grpc-netty-1.81.0.jar
					|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- quarkus-tls-registry-3.37.1.jar
			|-- smallrye-private-key-pem-parser-0.9.3.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-4.5.28.jar
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
				|-- vertx-auth-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-bridge-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- quarkus-vertx-3.37.1.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- quarkus-netty-3.37.1.jar
				|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- quarkus-virtual-threads-3.37.1.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- smallrye-fault-tolerance-vertx-6.11.1.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-common-vertx-context-2.18.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- vertx-grpc-client-4.5.28.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
|-- common-5.4-test-fixtures.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- opentelemetry-ext-cli-java-1.5.0.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-semconv-1.29.0-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- groovy-3.0.25.jar
		|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- pom-manipulation-common-5.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- pom-manipulation-core-5.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- pom-manipulation-io-5.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- unirest-objectmapper-jackson-3.14.5.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pom-manipulation-common-lite-5.3.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- npm-manipulator-npm-1.3.4.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- unirest-java-3.14.5.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- opentelemetry-ext-cli-java-2.1.0.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
|-- reqour-core-3.5.6-SNAPSHOT.jar
	|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
		|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
		|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
	|-- quarkus-logging-json-3.5.0.jar
		|-- quarkus-jackson-3.37.1.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
				|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
					|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
					|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-handler-proxy-4.1.135.Final.jar
					|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
					|-- netty-codec-socks-4.1.135.Final.jar [1 MEDIUM]
						|-- netty-codec-4.1.135.Final.jar [1 HIGH]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
					|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
				|-- netty-resolver-dns-4.1.135.Final.jar
					|-- netty-codec-dns-4.1.135.Final.jar [1 MEDIUM]
						|-- netty-codec-4.1.135.Final.jar [1 HIGH]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
					|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
	|-- quarkus-oidc-client-3.37.1.jar
		|-- quarkus-oidc-common-3.37.1.jar
			|-- smallrye-mutiny-vertx-web-client-3.22.2.jar
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
				|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-web-client-4.5.28.jar [1 HIGH]
	|-- quarkus-rest-client-jackson-3.37.1.jar
		|-- resteasy-reactive-jackson-3.37.1.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- quarkus-rest-jackson-3.37.1.jar
		|-- quarkus-rest-3.37.1.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- resteasy-reactive-vertx-3.37.1.jar
				|-- vertx-web-client-4.5.28.jar [1 HIGH]
	|-- quarkus-smallrye-fault-tolerance-3.37.1.jar
		|-- smallrye-fault-tolerance-6.11.1.jar
			|-- micrometer-core-1.16.6.jar [2 MEDIUM]
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- smallrye-fault-tolerance-core-6.11.1.jar
				|-- micrometer-core-1.16.6.jar [2 MEDIUM]
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- gitlab4j-api-6.3.0.jar
		|-- gitlab4j-models-6.3.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jersey-media-json-jackson-3.1.10.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- bifrost-upload-client-3.5.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- httpclient5-5.6.2.jar [1 CRITICAL, 1 MEDIUM]
		|-- pnc-api-3.5.1-jakarta.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- pnc-api-3.5.0-jakarta.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- pnc-common-3.5.4-jakarta.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jackson-datatype-jdk8-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jackson-datatype-jsr310-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jackson-module-parameter-names-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jsoup-1.23.1.jar [1 HIGH]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
	|-- github-api-1.330.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
reqour-core-3.5.6-SNAPSHOT.jar
|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
	|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- lz4-java-1.10.1.jar [1 MEDIUM]
	|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
		|-- netty-codec-4.1.135.Final.jar [1 HIGH]
|-- quarkus-logging-json-3.5.0.jar
	|-- quarkus-jackson-3.37.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-handler-proxy-4.1.135.Final.jar
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-codec-socks-4.1.135.Final.jar [1 MEDIUM]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-resolver-dns-4.1.135.Final.jar
				|-- netty-codec-dns-4.1.135.Final.jar [1 MEDIUM]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
|-- quarkus-hibernate-validator-3.37.1.jar
	|-- quarkus-vertx-http-3.37.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- vertx-web-4.5.28.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- vertx-auth-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-bridge-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
|-- quarkus-micrometer-opentelemetry-3.37.1.jar
	|-- opentelemetry-micrometer-1.5-2.26.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- quarkus-micrometer-3.37.1.jar
		|-- lz4-java-1.10.1.jar [1 MEDIUM]
		|-- micrometer-core-1.16.6.jar [2 MEDIUM]
		|-- resteasy-reactive-client-3.37.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-client-4.5.28.jar [1 HIGH]
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
				|-- vertx-core-4.5.28.jar [1 HIGH]
	|-- quarkus-opentelemetry-3.37.1.jar
		|-- opentelemetry-instrumentation-annotations-support-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-instrumentation-annotations-2.26.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-instrumentation-api-2.26.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-jdbc-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-runtime-telemetry-java17-2.26.1-alpha.jar
			|-- opentelemetry-runtime-telemetry-2.26.1-alpha.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-incubator-1.60.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-common-1.60.1.jar
			|-- opentelemetry-exporter-common-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-1.60.1.jar
			|-- opentelemetry-sdk-metrics-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-trace-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-common-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-logs-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- quarkus-grpc-common-3.37.1.jar
			|-- vertx-grpc-server-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-4.5.28.jar
				|-- grpc-netty-1.81.0.jar
					|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-common-vertx-context-2.18.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- vertx-grpc-client-4.5.28.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
|-- quarkus-oidc-client-3.37.1.jar
	|-- quarkus-oidc-common-3.37.1.jar
		|-- smallrye-mutiny-vertx-web-client-3.22.2.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- smallrye-mutiny-vertx-uri-template-3.22.2.jar
				|-- vertx-uri-template-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-client-4.5.28.jar [1 HIGH]
	|-- quarkus-vertx-3.37.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- quarkus-netty-3.37.1.jar
			|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
				|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- netty-handler-4.1.135.Final.jar [1 CRITICAL, 2 HIGH]
		|-- quarkus-virtual-threads-3.37.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-mutiny-vertx-core-3.22.2.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
			|-- smallrye-mutiny-vertx-runtime-3.22.2.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-fault-tolerance-vertx-6.11.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
|-- quarkus-rest-client-jackson-3.37.1.jar
	|-- resteasy-reactive-jackson-3.37.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- quarkus-rest-client-3.37.1.jar
		|-- quarkus-tls-registry-3.37.1.jar
			|-- smallrye-private-key-pem-parser-0.9.3.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
|-- quarkus-rest-jackson-3.37.1.jar
	|-- quarkus-rest-3.37.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
... *truncated, see full logs below*
SAST scan output
*no findings*

Full logs and artifacts

@akridl

akridl commented Sep 2, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

Bumps [org.jboss.pnc:bifrost-upload-client](https://github.com/project-ncl/bifrost-upload-client) from 3.5.0 to 3.5.1.
- [Release notes](https://github.com/project-ncl/bifrost-upload-client/releases)
- [Commits](project-ncl/bifrost-upload-client@3.5.0...3.5.1)

---
updated-dependencies:
- dependency-name: org.jboss.pnc:bifrost-upload-client
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/org.jboss.pnc-bifrost-upload-client-3.5.1 branch from a14c7ce to 4f87080 Compare September 2, 2026 14:48
@akridl
akridl merged commit b98c86c into main Sep 2, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/maven/org.jboss.pnc-bifrost-upload-client-3.5.1 branch September 2, 2026 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant