Skip to content

Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4 - #41

Merged
rnc merged 1 commit into
mainfrom
dependabot/maven/com.diffplug.spotless-spotless-maven-plugin-3.10.4
Oct 19, 2026
Merged

Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4#41
rnc merged 1 commit into
mainfrom
dependabot/maven/com.diffplug.spotless-spotless-maven-plugin-3.10.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown

Bumps com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4.

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.10.4

Changes

  • Bump default eclipse version from 4.40 to 4.41.
  • Bump default gherkin version 42.0.0 -> 42.0.1. (#3088)
  • Bump default jackson version 2.22.2 -> 2.22.3. (#3101)
  • Bump default palantir-java-format version 2.98.0 -> 2.102.0. (#3103, #3132)
  • Bump default mockito-core version 5.23.0 -> 5.24.0. (#3106)
  • Bump default greclipse version to latest 4.40 -> 4.41. (#3123)
  • Bump default ktfmt version 0.64 -> 0.65. (#3135)
    Which moved to the org.jetbrains.kotlinx:ktfmt coordinate and org.jetbrains.kotlinx.ktfmt package. Older versions are still supported.
  • Bump default palantir-java-format version 2.99.0 -> 2.102.0. (#3132)

Fixed

  • Migrate Plexus component injection to JSR-330 and Maven parameter. (#3122)
  • shortenFullyQualifiedTypes leaves a qualified name alone when the enclosing type extends or implements a type that is not in the same file, so an inherited member type cannot take the simple name. (#3117)
  • expandWildcardImports no longer drops the import of a type that is only used to qualify a static member (such as Collections.sort(list) or TimeUnit.SECONDS), or the static import of a field or enum constant (such as PI from import static java.lang.Math.*), which produced code that did not compile. (#2833)
Commits
  • 62e727d Published maven/3.10.4
  • d9e7a41 Published gradle/8.10.4
  • c006d66 Published lib/4.10.4
  • 8adb835 Merge release publishing fixes into main (#3138)
  • 67b4dbf Remove internal publishing changes from release notes
  • b9c4830 Keep Rewrite plugin on publicly resolvable releases (#3036)
  • 1c93df4 Update dependency com.palantir.javaformat:palantir-java-format to v2.102.0 (#...
  • ab153a9 Keep Rewrite plugin on publicly resolvable releases
  • feb10d8 Update plugin rewrite to v7.41.0
  • 2083664 Update changelogs for default formatter version bump (#3132)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4
8a63ea9 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.10.3 to 3.10.4.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.10.3...maven/3.10.4)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies java Pull requests that update java code labels Oct 16, 2026
@github-actions

github-actions Bot commented Oct 16, 2026

Copy link
Copy Markdown

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output 



Identified 244 dependencies

Detected 11 vulnerabilities (0 Critical, 2 High, 9 Medium, 0 Low)

+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |         LIBRARY         |       ID        |                                               TOP FIX                                                |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | guava-33.6.0-jre.jar    | CVE-2026-102554 | Upgrade to version com.google.guava:guava:33.7.2, https://github.com/google/guava.git - v33.7.2      |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-web-4.5.34.jar    | CVE-2026-102460 | Upgrade to version io.vertx:vertx-web:5.1.9,io.vertx:vertx-web:4.5.35,                               |
|          |                         |                 | https://github.com/vert-x3/vertx-web.git - 5.1.9, https://github.com/vert-x3/vertx-web.git - 4.5.35, |
|          |                         |                 | https://github.com/vert-x3/vertx-web.git - 5.2.1                                                     |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110257 | Upgrade to version  https://gitlab.ow2.org/asm/asm.git - ASM_9_11,org.ow2.asm:asm:9.11               |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110258 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110259 | Upgrade to version org.ow2.asm:asm:9.11                                                              |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110260 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110261 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110263 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-9.10.1.jar          | CVE-2026-110591 | Upgrade to version org.ow2.asm:asm-analysis:9.11,org.ow2.asm:asm:9.11,                               |
|          |                         |                 | https://gitlab.ow2.org/asm/asm.git - ASM_9_11                                                        |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.86.jar | CVE-2026-97873  | N/A                                                                                                  |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | okio-2.10.0.jar         | CVE-2023-3635   | Upgrade to version com.squareup.okio:okio-jvm:3.4.0                                                  |
+----------+-------------------------+-----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

okhttp-4.12.0.jar
|-- okio-2.10.0.jar [1 MEDIUM]
okio-2.10.0.jar [1 MEDIUM]
micrometer-registry-prometheus-1.17.1.jar
|-- micrometer-core-1.17.1.jar
	|-- guava-33.6.0-jre.jar [1 HIGH]
|-- prometheus-metrics-core-1.7.0.jar
	|-- guava-33.6.0-jre.jar [1 HIGH]
quarkus-config-yaml-3.40.1.jar
|-- smallrye-config-source-yaml-3.17.2.jar
	|-- smallrye-config-core-3.17.2.jar
		|-- asm-9.10.1.jar [7 MEDIUM]
quarkus-opentelemetry-3.40.1.jar
|-- quarkus-grpc-common-3.40.1.jar
	|-- grpc-core-1.81.0.jar
		|-- guava-33.6.0-jre.jar [1 HIGH]
	|-- vertx-grpc-4.5.34.jar
		|-- guava-33.6.0-jre.jar [1 HIGH]
		|-- grpc-netty-1.81.0.jar
			|-- guava-33.6.0-jre.jar [1 HIGH]
			|-- grpc-util-1.81.0.jar
				|-- guava-33.6.0-jre.jar [1 HIGH]
|-- vertx-grpc-client-4.5.34.jar
	|-- grpc-api-1.81.0.jar
		|-- guava-33.6.0-jre.jar [1 HIGH]
	|-- grpc-stub-1.81.0.jar
		|-- guava-33.6.0-jre.jar [1 HIGH]
	|-- vertx-grpc-common-4.5.34.jar
		|-- guava-33.6.0-jre.jar [1 HIGH]
		|-- grpc-protobuf-1.81.0.jar
			|-- guava-33.6.0-jre.jar [1 HIGH]
			|-- grpc-protobuf-lite-1.81.0.jar
				|-- guava-33.6.0-jre.jar [1 HIGH]
quarkus-rest-client-3.40.1.jar
|-- quarkus-rest-client-config-3.40.1.jar
	|-- jandex-3.6.0.jar
		|-- asm-9.10.1.jar [7 MEDIUM]
|-- quarkus-tls-registry-3.40.1.jar
	|-- smallrye-private-key-pem-parser-0.9.4.jar
		|-- bcprov-jdk18on-1.86.jar [1 MEDIUM]
	|-- vertx-web-4.5.34.jar [1 HIGH]
quarkus-smallrye-health-3.40.1.jar
|-- quarkus-vertx-http-3.40.1.jar
	|-- smallrye-mutiny-vertx-web-3.23.1.jar
		|-- vertx-web-4.5.34.jar [1 HIGH]
	|-- vertx-web-4.5.34.jar [1 HIGH]
quarkus-vertx-3.40.1.jar
|-- netty-codec-haproxy-4.1.138.Final.jar
	|-- gson-2.14.0.jar
		|-- guava-33.6.0-jre.jar [1 HIGH]
bcpkix-jdk18on-1.86.jar
|-- bcutil-jdk18on-1.86.jar
	|-- bcprov-jdk18on-1.86.jar [1 MEDIUM]
artifactory-java-client-services-2.22.4-SNAPSHOT.jar
|-- build-info-api-2.43.9.jar
	|-- commons-compress-1.28.0.jar
		|-- asm-9.10.1.jar [7 MEDIUM]


No Policy violations were detected

Project 'generic-http-proxy-pr' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=1d0ad24f-108a-4726-a6ae-2e0672d80029
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=91b869161bbf4af7a3b77c7cb54fdc82985b2475b795470c954b91886bc5ba6d

Mend AI scan succeeded.

Support Token: 1cccf4769ad7848fd9a726a8452c726c71792170432180
SAST scan output 
*no findings*

Full logs and artifacts

@rnc
rnc merged commit 5cdb029 into main Oct 19, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/maven/com.diffplug.spotless-spotless-maven-plugin-3.10.4 branch October 19, 2026 08:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rnc