Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23 by dependabot[bot] · Pull Request #126 · project-ncl/rpm-importer

dependabot · 2026-08-24T10:34:42Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-ci.yml's releases.

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

Update from main to v0.0.22 by @rnc in project-ncl/shared-github-actions#103

Ignore commonjava libraries for cooldown by @rnc in project-ncl/shared-github-actions#104

Add gradle-release workflow by @rnc in project-ncl/shared-github-actions#111

Fix gh release. Remove release_type. by @rnc in project-ncl/shared-github-actions#112

Update README by @rnc in project-ncl/shared-github-actions#113

👒 CI Dependencies

Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in project-ncl/shared-github-actions#105

Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 by @dependabot[bot] in project-ncl/shared-github-actions#106

Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in project-ncl/shared-github-actions#107

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#108

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#109

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.21 to 0.0.22 by @dependabot[bot] in project-ncl/shared-github-actions#110

Full Changelog: project-ncl/shared-github-actions@v0.0.22...v0.0.23

Commits

646d9b6 Merge pull request #113 from rnc/BR1
c3d39a7 Update README
72c18d4 Merge pull request #112 from rnc/BR1
8f83747 Fix gh release. Remove release_type.
1184278 Merge pull request #111 from rnc/GRADLERELEASE
83338f8 Merge pull request #110 from project-ncl/dependabot/github_actions/project-nc...
4768239 Merge pull request #109 from project-ncl/dependabot/github_actions/project-nc...
1f0a576 Merge pull request #108 from project-ncl/dependabot/github_actions/project-nc...
3f6ac23 Merge pull request #107 from project-ncl/dependabot/github_actions/zizmorcore...
1f44af1 Merge pull request #106 from project-ncl/dependabot/github_actions/gradle/act...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [project-ncl/shared-github-actions/.github/workflows/maven-ci.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.22 to 0.0.23. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@a27e6fb...646d9b6) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-24T10:39:23Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 204 dependencies

Detected 27 vulnerabilities (0 Critical, 7 High, 17 Medium, 3 Low)

+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                LIBRARY                 |       ID       |                                               TOP FIX                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.22.2.jar                       | CVE-2026-75140 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-core-25.0.3.jar               | CVE-2024-10039 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                        |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2024-3884  | Upgrade to version io.undertow:undertow-core:2.4.0.Beta1,io.undertow:undertow-core:2.2.39.Final,     |
|          |                                        |                | io.undertow:undertow-core:2.3.21.Final                                                               |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2024-4027  | Upgrade to version  https://github.com/undertow-io/undertow.git - 2.3.21.Final,                      |
|          |                                        |                | io.undertow:undertow-core:2.3.21.Final,io.undertow:undertow-core:2.2.39.Final,                       |
|          |                                        |                | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,io.undertow:undertow-core:2.4.0.Beta1      |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2026-15554 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.2.39.Final.jar         | CVE-2026-15561 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar            | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar            | CVE-2026-59889 | Upgrade to version tools.jackson.core:jackson-databind:3.1.5,                                        |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.2.1,        |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.21.5                                                   |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jsoup-1.22.2.jar                       | CVE-2026-71497 | Upgrade to version org.jsoup:jsoup:1.23.1, https://github.com/jhy/jsoup.git - jsoup-1.23.1           |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-adapter-core-25.0.3.jar       | CVE-2026-1180  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-common-25.0.3.jar             | CVE-2024-11736 | Upgrade to version org.keycloak:keycloak-saml-adapter-core:26.0.8;                                   |
|          |                                        |                | org.keycloak:keycloak-saml-adapter-core-jakarta:26.0.8;org.keycloak:keycloak-common:26.0.8;          |
|          |                                        |                | org.keycloak:keycloak-services:26.0.8;org.keycloak:keycloak-saml-core:26.0.8;                        |
|          |                                        |                | org.keycloak:keycloak-model-jpa:26.0.8;org.keycloak:keycloak-core:26.0.8                             |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-common-25.0.3.jar             | CVE-2024-9666  | Upgrade to version org.keycloak:keycloak-common:26.0.6, org.keycloak:keycloak-quarkus-server:26.0.6, |
|          |                                        |                | org.keycloak:keycloak-services:26.0.6                                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2024-11736 | Upgrade to version org.keycloak:keycloak-saml-adapter-core:26.0.8;                                   |
|          |                                        |                | org.keycloak:keycloak-saml-adapter-core-jakarta:26.0.8;org.keycloak:keycloak-common:26.0.8;          |
|          |                                        |                | org.keycloak:keycloak-services:26.0.8;org.keycloak:keycloak-saml-core:26.0.8;                        |
|          |                                        |                | org.keycloak:keycloak-model-jpa:26.0.8;org.keycloak:keycloak-core:26.0.8                             |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2024-7318  | Upgrade to version org.keycloak:keycloak-core:24.0.7                                                 |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2026-1180  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2024-11734 | org.keycloak:keycloak-quarkus-server:26.0.8                                                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-0871  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.5.1                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-3190  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.5.6                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-37982 | org.keycloak:keycloak-services:26.6.2                                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9704  | org.keycloak:keycloak-services:26.6.3,org.keycloak:keycloak-server-spi-private:26.6.3                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9791  | org.keycloak:keycloak-server-spi-private:26.6.3,org.keycloak:keycloak-services:26.6.3                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9799  | Upgrade to version org.keycloak:keycloak-server-spi-private:26.6.4                                   |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | undertow-core-2.2.39.Final.jar         | CVE-2026-19879 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-core-25.0.3.jar               | CVE-2024-4028  | Upgrade to version org.keycloak:keycloak-core - 1.5.0-Final                                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-core-25.0.3.jar               | CVE-2025-5416  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-server-spi-private-25.0.3.jar | CVE-2025-13881 | Upgrade to version org.keycloak:keycloak-server-spi-private:26.5.2,                                  |
|          |                                        |                | https://github.com/keycloak/keycloak.git - 26.5.2                                                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-rest-client-jackson-3.38.2.jar
|-- resteasy-reactive-jackson-3.38.2.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-rest-client-3.38.2.jar
	|-- quarkus-rest-client-jaxrs-3.38.2.jar
		|-- resteasy-reactive-client-3.38.2.jar
			|-- smallrye-mutiny-vertx-core-3.23.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- vertx-web-client-4.5.32.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- quarkus-vertx-3.38.2.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-rest-jackson-common-3.38.2.jar
	|-- quarkus-jackson-3.38.2.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-datatype-jdk8-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- vertx-core-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
undertow-core-2.2.39.Final.jar [4 HIGH, 1 MEDIUM]
auth-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- unirest-java-3.14.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- unirest-objectmapper-jackson-3.14.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- common-3.5.1-SNAPSHOT.jar
	|-- pnc-common-3.5.1.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-module-parameter-names-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- pnc-api-3.5.2.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
	|-- rest-api-3.5.14-java-client.jar
		|-- undertow-core-2.2.39.Final.jar [4 HIGH, 1 MEDIUM]
		|-- dto-3.5.14.jar
			|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- undertow-core-2.2.39.Final.jar [4 HIGH, 1 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
	|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- keycloak-common-25.0.3.jar [2 MEDIUM]
config-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-dataformat-yaml-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pom-manipulation-common-lite-5.5.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]


No Policy violations were detected

Project 'rpm-importer' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=5a2834d6-2f49-478a-9592-197f95530bb7
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=1d6315cd961845d4879b0bbfd0912564f9875127d32e4533b36fef2b7e1a9e91

Mend AI scan succeeded.

Support Token: 225b5e2596e32488faaea1bf20ae9b6a91787567911536

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 24, 2026

Navigation Menu

Uh oh!

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23 - #126

Bump project-ncl/shared-github-actions/.github/workflows/maven-ci.yml from 0.0.22 to 0.0.23#126
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-ci.yml-0.0.23

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026

v0.0.23

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

Uh oh!

github-actions Bot commented Aug 24, 2026

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants