Move quarkus down by patrikk0123 · Pull Request #85 · Commonjava/http-testserver

patrikk0123 · 2026-09-17T13:47:30Z

No description provided.

github-actions · 2026-09-17T13:50:06Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 158 dependencies

Detected 10 vulnerabilities (0 Critical, 7 High, 2 Medium, 1 Low)

+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| SEVERITY |            LIBRARY             |       ID       |                                               TOP FIX                                               |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | parsson-1.1.5.jar              | CVE-2026-9563  | Upgrade to version org.eclipse.parsson:parsson:1.1.8, https://github.com/eclipse-ee4j/parsson.git - |
|          |                                |                | 1.1.8                                                                                               |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | plexus-utils-3.5.1.jar         | CVE-2025-67030 | org.codehaus.plexus:plexus-utils:4.0.3,org.codehaus.plexus:plexus-utils:3.6.1                       |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | quarkus-core-3.6.9.jar         | CVE-2024-2700  | Upgrade to version io.quarkus:quarkus-core:3.8.4,3.9.2,3.2.12.Final                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.3.26.Final.jar | CVE-2026-15554 | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.3.26.Final.jar | CVE-2026-15561 | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.3.26.Final.jar | CVE-2026-5680  | Upgrade to version  https://github.com/undertow-io/undertow.git - 2.4.3.Final,                      |
|          |                                |                | io.undertow:undertow-core:2.4.3.Final                                                               |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | xstream-1.4.20.jar             | CVE-2024-47072 | Upgrade to version com.thoughtworks.xstream:xstream - 1.4.21                                        |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| MEDIUM   | commons-lang3-3.13.0.jar       | CVE-2025-48924 | Upgrade to version  https://github.com/apache/commons-lang.git - commons-lang-3.18.0,               |
|          |                                |                | org.apache.commons:commons-lang3:3.18.0                                                             |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| MEDIUM   | undertow-core-2.3.26.Final.jar | CVE-2026-19879 | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| LOW      | jansi-2.4.0.jar                | CVE-2026-8484  | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

http-testserver-core-2.3.4-SNAPSHOT.jar
|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
|-- undertow-servlet-2.3.26.Final.jar
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
http-testserver-junit4-2.3.4-SNAPSHOT.jar
|-- http-testserver-core-2.3.4-SNAPSHOT.jar
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
	|-- undertow-servlet-2.3.26.Final.jar
		|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
http-testserver-junit5-2.3.4-SNAPSHOT.jar
|-- http-testserver-core-2.3.4-SNAPSHOT.jar
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
	|-- undertow-servlet-2.3.26.Final.jar
		|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
http-testserver-quarkus-2.3.4-SNAPSHOT.jar
|-- quarkus-arc-deployment-3.6.9.jar
	|-- quarkus-arc-3.6.9.jar
		|-- quarkus-core-3.6.9.jar [1 HIGH]
	|-- quarkus-core-deployment-3.6.9.jar
		|-- quarkus-core-3.6.9.jar [1 HIGH]
		|-- readline-2.4.jar
			|-- jansi-2.4.0.jar [1 LOW]
		|-- commons-lang3-3.13.0.jar [1 MEDIUM]
|-- quarkus-junit5-3.6.9.jar
	|-- xstream-1.4.20.jar [1 HIGH]
	|-- quarkus-core-3.6.9.jar [1 HIGH]
	|-- quarkus-test-common-3.6.9.jar
		|-- quarkus-bootstrap-maven-resolver-3.6.9.jar
			|-- smallrye-beanbag-maven-1.3.2.jar
				|-- commons-lang3-3.13.0.jar [1 MEDIUM]
				|-- wagon-provider-api-3.5.3.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-artifact-3.9.6.jar
					|-- commons-lang3-3.13.0.jar [1 MEDIUM]
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-model-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-repository-metadata-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- maven-resolver-transport-wagon-1.9.18.jar
				|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-xml-4.0.0.jar
					|-- maven-xml-impl-4.0.0-alpha-5.jar
						|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- wagon-file-3.5.3.jar
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- wagon-http-3.5.3.jar
				|-- wagon-http-shared-3.5.3.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- maven-embedder-3.9.6.jar
				|-- commons-lang3-3.13.0.jar [1 MEDIUM]
				|-- maven-shared-utils-3.3.4.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
					|-- jansi-2.4.0.jar [1 LOW]
				|-- maven-core-3.9.6.jar
					|-- commons-lang3-3.13.0.jar [1 MEDIUM]
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-plugin-api-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- jansi-2.4.0.jar [1 LOW]
			|-- maven-resolver-provider-3.9.6.jar
				|-- maven-model-builder-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- maven-settings-builder-3.9.6.jar
				|-- maven-settings-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-sec-dispatcher-2.0.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- org.eclipse.sisu.plexus-0.9.0.M2.jar
				|-- plexus-utils-3.5.1.jar [1 HIGH]
|-- http-testserver-core-2.3.4-SNAPSHOT.jar
	|-- commons-io-2.15.1.jar
		|-- commons-codec-1.16.0.jar
			|-- commons-lang3-3.13.0.jar [1 MEDIUM]
		|-- commons-lang3-3.13.0.jar [1 MEDIUM]
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
		|-- jboss-logmanager-3.0.4.Final.jar
			|-- parsson-1.1.5.jar [1 HIGH]
	|-- undertow-servlet-2.3.26.Final.jar
		|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
	|-- commons-lang3-3.13.0.jar [1 MEDIUM]


No Policy violations were detected

Project 'http-testserver' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=3e4a4791-bd78-42c2-810a-0fe36f078b23
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=377f5a0ae9fd4922a9e55480620df3a0685d6038dc7f41849565798974f4e93d

Mend AI scan succeeded.

Support Token: 048661bc83e4548a2a688f3a3ed075fc51789652991084

Full logs and artifacts

rnc · 2026-09-17T14:04:24Z

For future reference - this also reverts Quarkus to the earlier 3.6.9 version as 3.7.0 requires JDK17

patrikk0123 added 2 commits September 17, 2026 15:46

Move quarkus bom to quarkus module

35e1123

Ignore quarkus dependabot updates

faff35b

rnc approved these changes Sep 17, 2026

View reviewed changes

rnc merged commit e3a6528 into Commonjava:master Sep 17, 2026
2 checks passed

Navigation Menu

Move quarkus down - #85

Move quarkus down#85
rnc merged 2 commits into
Commonjava:masterfrom
patrikk0123:move-quarkus-down

patrikk0123 commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

rnc commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

patrikk0123 commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Mend Scan Results

Uh oh!

rnc commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants