Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23 by dependabot[bot] · Pull Request #125 · project-ncl/rpm-importer

dependabot · 2026-08-24T10:34:40Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml's releases.

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

Update from main to v0.0.22 by @rnc in project-ncl/shared-github-actions#103

Ignore commonjava libraries for cooldown by @rnc in project-ncl/shared-github-actions#104

Add gradle-release workflow by @rnc in project-ncl/shared-github-actions#111

Fix gh release. Remove release_type. by @rnc in project-ncl/shared-github-actions#112

Update README by @rnc in project-ncl/shared-github-actions#113

👒 CI Dependencies

Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in project-ncl/shared-github-actions#105

Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 by @dependabot[bot] in project-ncl/shared-github-actions#106

Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in project-ncl/shared-github-actions#107

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#108

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#109

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#110

Full Changelog: project-ncl/shared-github-actions@v0.0.22...v0.0.23

Commits

646d9b6 Merge pull request #113 from rnc/BR1
c3d39a7 Update README
72c18d4 Merge pull request #112 from rnc/BR1
8f83747 Fix gh release. Remove release_type.
1184278 Merge pull request #111 from rnc/GRADLERELEASE
83338f8 Merge pull request #110 from project-ncl/dependabot/github_actions/project-nc...
4768239 Merge pull request #109 from project-ncl/dependabot/github_actions/project-nc...
1f0a576 Merge pull request #108 from project-ncl/dependabot/github_actions/project-nc...
3f6ac23 Merge pull request #107 from project-ncl/dependabot/github_actions/zizmorcore...
1f44af1 Merge pull request #106 from project-ncl/dependabot/github_actions/gradle/act...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…ot.yml Bumps [project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.22 to 0.0.23. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@a27e6fb...646d9b6) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-advanced-security · 2026-08-24T10:38:31Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-actions · 2026-08-24T10:38:36Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 204 dependencies

Detected 27 vulnerabilities (0 Critical, 7 High, 17 Medium, 3 Low)

+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                LIBRARY                 |       ID       |                                               TOP FIX                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.22.2.jar                       | CVE-2026-75140 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-core-25.0.3.jar               | CVE-2024-10039 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                        |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2024-3884  | Upgrade to version io.undertow:undertow-core:2.4.0.Beta1,io.undertow:undertow-core:2.2.39.Final,     |
|          |                                        |                | io.undertow:undertow-core:2.3.21.Final                                                               |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2024-4027  | Upgrade to version  https://github.com/undertow-io/undertow.git - 2.3.21.Final,                      |
|          |                                        |                | io.undertow:undertow-core:2.3.21.Final,io.undertow:undertow-core:2.2.39.Final,                       |
|          |                                        |                | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,io.undertow:undertow-core:2.4.0.Beta1      |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2026-15554 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2026-15561 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar            | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar            | CVE-2026-59889 | Upgrade to version tools.jackson.core:jackson-databind:3.1.5,                                        |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.2.1,        |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.21.5                                                   |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jsoup-1.22.2.jar                       | CVE-2026-71497 | Upgrade to version org.jsoup:jsoup:1.23.1, https://github.com/jhy/jsoup.git - jsoup-1.23.1           |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-adapter-core-25.0.3.jar       | CVE-2026-1180  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-common-25.0.3.jar             | CVE-2024-11736 | Upgrade to version org.keycloak:keycloak-saml-adapter-core:26.0.8;                                   |
|          |                                        |                | org.keycloak:keycloak-saml-adapter-core-jakarta:26.0.8;org.keycloak:keycloak-common:26.0.8;          |
|          |                                        |                | org.keycloak:keycloak-services:26.0.8;org.keycloak:keycloak-saml-core:26.0.8;                        |
|          |                                        |                | org.keycloak:keycloak-model-jpa:26.0.8;org.keycloak:keycloak-core:26.0.8                             |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-common-25.0.3.jar             | CVE-2024-9666  | Upgrade to version org.keycloak:keycloak-common:26.0.6, org.keycloak:keycloak-quarkus-server:26.0.6, |
|          |                                        |                | org.keycloak:keycloak-services:26.0.6                                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2024-11736 | Upgrade to version org.keycloak:keycloak-saml-adapter-core:26.0.8;                                   |
|          |                                        |                | org.keycloak:keycloak-saml-adapter-core-jakarta:26.0.8;org.keycloak:keycloak-common:26.0.8;          |
|          |                                        |                | org.keycloak:keycloak-services:26.0.8;org.keycloak:keycloak-saml-core:26.0.8;                        |
|          |                                        |                | org.keycloak:keycloak-model-jpa:26.0.8;org.keycloak:keycloak-core:26.0.8                             |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2024-7318  | Upgrade to version org.keycloak:keycloak-core:24.0.7                                                 |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2026-1180  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2024-11734 | org.keycloak:keycloak-quarkus-server:26.0.8                                                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-0871  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.5.1                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-3190  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.5.6                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-37982 | org.keycloak:keycloak-services:26.6.2                                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9704  | org.keycloak:keycloak-services:26.6.3,org.keycloak:keycloak-server-spi-private:26.6.3                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9791  | org.keycloak:keycloak-server-spi-private:26.6.3,org.keycloak:keycloak-services:26.6.3                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9799  | Upgrade to version org.keycloak:keycloak-server-spi-private:26.6.4                                   |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | undertow-core-2.2.39.Final.jar         | CVE-2026-19879 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-core-25.0.3.jar               | CVE-2024-4028  | Upgrade to version org.keycloak:keycloak-core - 1.5.0-Final                                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-core-25.0.3.jar               | CVE-2025-5416  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-server-spi-private-25.0.3.jar | CVE-2025-13881 | Upgrade to version org.keycloak:keycloak-server-spi-private:26.5.2,                                  |
|          |                                        |                | https://github.com/keycloak/keycloak.git - 26.5.2                                                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-rest-client-jackson-3.38.2.jar
|-- resteasy-reactive-jackson-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-rest-client-3.38.2.jar
	|-- quarkus-rest-client-jaxrs-3.38.2.jar
		|-- resteasy-reactive-client-3.38.2.jar
			|-- smallrye-mutiny-vertx-core-3.23.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- vertx-web-client-4.5.32.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-rest-jackson-common-3.38.2.jar
	|-- quarkus-jackson-3.38.2.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- vertx-core-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- quarkus-rest-common-3.38.2.jar
		|-- quarkus-vertx-3.38.2.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
undertow-core-2.2.39.Final.jar [4 HIGH, 1 MEDIUM]
auth-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- unirest-java-3.14.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- unirest-objectmapper-jackson-3.14.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- common-3.5.1-SNAPSHOT.jar
	|-- pnc-common-3.5.1.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-datatype-jdk8-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-module-parameter-names-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
	|-- rest-api-3.5.14-java-client.jar
		|-- undertow-core-2.2.39.Final.jar [4 HIGH, 1 MEDIUM]
		|-- dto-3.5.14.jar
			|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
		|-- pnc-api-3.5.2.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- undertow-core-2.2.39.Final.jar [4 HIGH, 1 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
	|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- keycloak-common-25.0.3.jar [2 MEDIUM]
config-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-dataformat-yaml-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pom-manipulation-common-lite-5.5.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]


No Policy violations were detected

Project 'rpm-importer' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=5a2834d6-2f49-478a-9592-197f95530bb7
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=1d6315cd961845d4879b0bbfd0912564f9875127d32e4533b36fef2b7e1a9e91

Mend AI scan succeeded.

Support Token: 23841e5e0e72c4d1aaaaef5bc7da3cfad1787567851343

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 24, 2026

Navigation Menu

Uh oh!

Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23 - #125

Bump project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml from 0.0.22 to 0.0.23#125
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-snapshot.yml-0.0.23

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

github-advanced-security AI commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

Uh oh!

github-advanced-security AI commented Aug 24, 2026

What Enabling Code Scanning Means:

Uh oh!

github-actions Bot commented Aug 24, 2026

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant