Skip to content

Add exclusions in dependabot - #92

Merged
rnc merged 1 commit into
Commonjava:masterfrom
rnc:BR1
Sep 17, 2026
Merged

Add exclusions in dependabot#92
rnc merged 1 commit into
Commonjava:masterfrom
rnc:BR1

Conversation

@rnc

@rnc rnc commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@rnc rnc changed the title Update undertow. Add exclusions in dependabot Add exclusions in dependabot Sep 17, 2026
@rnc
rnc merged commit 76eeef3 into Commonjava:master Sep 17, 2026
2 checks passed
@rnc
rnc deleted the BR1 branch September 17, 2026 14:43
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output 



Identified 158 dependencies

Detected 10 vulnerabilities (0 Critical, 7 High, 2 Medium, 1 Low)

+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| SEVERITY |            LIBRARY             |       ID       |                                               TOP FIX                                               |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | parsson-1.1.5.jar              | CVE-2026-9563  | Upgrade to version org.eclipse.parsson:parsson:1.1.8, https://github.com/eclipse-ee4j/parsson.git - |
|          |                                |                | 1.1.8                                                                                               |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | plexus-utils-3.5.1.jar         | CVE-2025-67030 | org.codehaus.plexus:plexus-utils:4.0.3,org.codehaus.plexus:plexus-utils:3.6.1                       |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | quarkus-core-3.6.9.jar         | CVE-2024-2700  | Upgrade to version io.quarkus:quarkus-core:3.8.4,3.9.2,3.2.12.Final                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.3.26.Final.jar | CVE-2026-15554 | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.3.26.Final.jar | CVE-2026-15561 | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | undertow-core-2.3.26.Final.jar | CVE-2026-5680  | Upgrade to version  https://github.com/undertow-io/undertow.git - 2.4.3.Final,                      |
|          |                                |                | io.undertow:undertow-core:2.4.3.Final                                                               |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| HIGH     | xstream-1.4.20.jar             | CVE-2024-47072 | Upgrade to version com.thoughtworks.xstream:xstream - 1.4.21                                        |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| MEDIUM   | commons-lang3-3.13.0.jar       | CVE-2025-48924 | Upgrade to version  https://github.com/apache/commons-lang.git - commons-lang-3.18.0,               |
|          |                                |                | org.apache.commons:commons-lang3:3.18.0                                                             |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| MEDIUM   | undertow-core-2.3.26.Final.jar | CVE-2026-19879 | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+
| LOW      | jansi-2.4.0.jar                | CVE-2026-8484  | N/A                                                                                                 |
+----------+--------------------------------+----------------+-----------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

http-testserver-core-2.3.4-SNAPSHOT.jar
|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
|-- undertow-servlet-2.3.26.Final.jar
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
http-testserver-junit4-2.3.4-SNAPSHOT.jar
|-- http-testserver-core-2.3.4-SNAPSHOT.jar
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
	|-- undertow-servlet-2.3.26.Final.jar
		|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
http-testserver-junit5-2.3.4-SNAPSHOT.jar
|-- http-testserver-core-2.3.4-SNAPSHOT.jar
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
	|-- undertow-servlet-2.3.26.Final.jar
		|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
http-testserver-quarkus-2.3.4-SNAPSHOT.jar
|-- quarkus-arc-deployment-3.6.9.jar
	|-- quarkus-arc-3.6.9.jar
		|-- quarkus-core-3.6.9.jar [1 HIGH]
	|-- quarkus-core-deployment-3.6.9.jar
		|-- quarkus-core-3.6.9.jar [1 HIGH]
		|-- readline-2.4.jar
			|-- jansi-2.4.0.jar [1 LOW]
		|-- commons-lang3-3.13.0.jar [1 MEDIUM]
|-- quarkus-junit5-3.6.9.jar
	|-- xstream-1.4.20.jar [1 HIGH]
	|-- quarkus-core-3.6.9.jar [1 HIGH]
	|-- quarkus-test-common-3.6.9.jar
		|-- quarkus-bootstrap-maven-resolver-3.6.9.jar
			|-- smallrye-beanbag-maven-1.3.2.jar
				|-- commons-lang3-3.13.0.jar [1 MEDIUM]
				|-- maven-artifact-3.9.6.jar
					|-- commons-lang3-3.13.0.jar [1 MEDIUM]
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-model-builder-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-repository-metadata-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-settings-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-xml-4.0.0.jar
					|-- maven-xml-impl-4.0.0-alpha-5.jar
						|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- maven-resolver-transport-wagon-1.9.18.jar
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- wagon-file-3.5.3.jar
				|-- wagon-provider-api-3.5.3.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- wagon-http-3.5.3.jar
				|-- wagon-http-shared-3.5.3.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- maven-embedder-3.9.6.jar
				|-- commons-lang3-3.13.0.jar [1 MEDIUM]
				|-- maven-shared-utils-3.3.4.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
					|-- jansi-2.4.0.jar [1 LOW]
				|-- maven-core-3.9.6.jar
					|-- commons-lang3-3.13.0.jar [1 MEDIUM]
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-model-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- maven-plugin-api-3.9.6.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- jansi-2.4.0.jar [1 LOW]
			|-- maven-resolver-provider-3.9.6.jar
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- maven-settings-builder-3.9.6.jar
				|-- plexus-sec-dispatcher-2.0.jar
					|-- plexus-utils-3.5.1.jar [1 HIGH]
				|-- plexus-utils-3.5.1.jar [1 HIGH]
			|-- org.eclipse.sisu.plexus-0.9.0.M2.jar
				|-- plexus-utils-3.5.1.jar [1 HIGH]
|-- http-testserver-core-2.3.4-SNAPSHOT.jar
	|-- commons-io-2.15.1.jar
		|-- commons-lang3-3.13.0.jar [1 MEDIUM]
	|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
		|-- jboss-logmanager-3.0.4.Final.jar
			|-- parsson-1.1.5.jar [1 HIGH]
	|-- undertow-servlet-2.3.26.Final.jar
		|-- undertow-core-2.3.26.Final.jar [3 HIGH, 1 MEDIUM]
	|-- commons-lang3-3.13.0.jar [1 MEDIUM]
	|-- httpclient-4.5.14.jar
		|-- commons-codec-1.16.0.jar
			|-- commons-lang3-3.13.0.jar [1 MEDIUM]


No Policy violations were detected

Project 'http-testserver' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=3e4a4791-bd78-42c2-810a-0fe36f078b23
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=377f5a0ae9fd4922a9e55480620df3a0685d6038dc7f41849565798974f4e93d

Mend AI scan succeeded.

Support Token: 15eb2cb14af7e4c79b27eb654c2fe19e11789656281541

Full logs and artifacts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@patrikk0123 patrikk0123 patrikk0123 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@rnc @patrikk0123