Skip to content

Make release work - #446

Merged
akridl merged 2 commits into
project-ncl:v3.5.xfrom
akridl:ft
Oct 22, 2026
Merged

Make release work#446
akridl merged 2 commits into
project-ncl:v3.5.xfrom
akridl:ft

Conversation

@akridl

@akridl akridl commented Oct 22, 2026

Copy link
Copy Markdown
Member

No description provided.

@akridl
akridl merged commit c405075 into project-ncl:v3.5.x Oct 22, 2026
1 check passed
@github-actions

github-actions Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output 



Identified 468 dependencies

Detected 97 vulnerabilities (3 Critical, 47 High, 44 Medium, 3 Low)

Displaying top 50 vulnerabilities. View the full list on the application.
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                    LIBRARY                    |       ID        |                                               TOP FIX                                                |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.6.1.jar                         | CVE-2026-71290  | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                               |                 | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | jackson-databind-2.22.0.jar                   | CVE-2026-110879 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.12,    |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-databind:2.22.4,                                                  |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-databind:2.21.8,                                                  |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.4,                          |
|          |                                               |                 | tools.jackson.core:jackson-databind:3.1.8,com.fasterxml.jackson.core:jackson-databind:2.18.12,       |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.8,                         |
|          |                                               |                 | tools.jackson.core:jackson-databind:3.2.4, https://github.com/FasterXML/jackson-databind.git -       |
|          |                                               |                 | jackson-databind-3.1.8, https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.4  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.135.Final.jar               | CVE-2026-75595  | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                               |                 | netty-4.2.17.Final                                                                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | guava-33.6.0-jre.jar                          | CVE-2026-102554 | Upgrade to version com.google.guava:guava:33.7.2, https://github.com/google/guava.git - v33.7.2      |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.4.jar                             | CVE-2026-54399  | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                               |                 | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                               |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                               |                 | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.4.jar                          | CVE-2026-54428  | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                               |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                               |                 | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                               |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.0.jar                       | CVE-2026-68498  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.22.2,                                   |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-core:2.18.10,com.fasterxml.jackson.core:jackson-core:2.21.6,      |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.10,                                |
|          |                                               |                 | tools.jackson.core:jackson-core:3.1.6,tools.jackson.core:jackson-core:3.2.2,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.22.2,                                 |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.2.2,                                  |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.6,                                 |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.6                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.0.jar                       | CVE-2026-89407  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.18.11,                                  |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-core:2.21.7,com.fasterxml.jackson.core:jackson-core:2.22.3,       |
|          |                                               |                 | tools.jackson.core:jackson-core:3.1.7, https://github.com/FasterXML/jackson-core.git -               |
|          |                                               |                 | jackson-core-2.22.3, https://github.com/FasterXML/jackson-core.git - jackson-core-3.2.2,             |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7,                                  |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.0.jar                       | CVE-2026-89425  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.18.11,                                  |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-core:2.21.7,com.fasterxml.jackson.core:jackson-core:2.22.3,       |
|          |                                               |                 | tools.jackson.core:jackson-core:3.1.7, https://github.com/FasterXML/jackson-core.git -               |
|          |                                               |                 | jackson-core-3.2.3, https://github.com/FasterXML/jackson-core.git - jackson-core-2.22.3,             |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7,                                 |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                                               |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.0.jar                   | CVE-2026-68497  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.10,                              |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                                  |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-databind:2.21.6,                                                  |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.6,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.2,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.10                         |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.0.jar                   | CVE-2026-91776  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.11,                              |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-databind:2.21.7,tools.jackson.core:jackson-databind:3.1.7,        |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7,                          |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3                           |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.0.jar                   | CVE-2026-91777  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.11,                              |
|          |                                               |                 | com.fasterxml.jackson.core:jackson-databind:2.21.7,tools.jackson.core:jackson-databind:3.1.7,        |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3,                          |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                                               |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7                           |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-dataformat-yaml-2.22.0.jar            | WS-2026-0134    | Upgrade to version  https://github.com/FasterXML/jackson-dataformats-text.git -                      |
|          |                                               |                 | jackson-dataformats-text-2.21.6,com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.6,     |
|          |                                               |                 | https://github.com/FasterXML/jackson-dataformats-text.git - jackson-dataformats-text-2.22.2,         |
|          |                                               |                 | tools.jackson.dataformat:jackson-dataformat-yaml:3.1.6,                                              |
|          |                                               |                 | https://github.com/FasterXML/jackson-dataformats-text.git - jackson-dataformats-text-3.1.6,          |
|          |                                               |                 | com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.22.2,                                     |
|          |                                               |                 | tools.jackson.dataformat:jackson-dataformat-yaml:3.2.2,                                              |
|          |                                               |                 | https://github.com/FasterXML/jackson-dataformats-text.git - jackson-dataformats-text-3.2.2           |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.22.2.jar                              | CVE-2026-75140  | org.jsoup:jsoup:1.23.2                                                                               |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | lz4-java-1.10.1.jar                           | CVE-2026-106451 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.11.4,at.yawk.lz4:lz4-java:1.11.4     |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.135.Final.jar                 | CVE-2026-59901  | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-haproxy-4.1.135.Final.jar         | CVE-2026-55851  | Upgrade to version io.netty:netty-codec-haproxy:4.2.16.Final,                                        |
|          |                                               |                 | io.netty:netty-codec-haproxy:4.1.136.Final, https://github.com/netty/netty.git - netty-4.2.16.Final, |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.136.Final                                             |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-haproxy-4.1.135.Final.jar         | CVE-2026-93564  | Upgrade to version io.netty:netty-codec-haproxy:4.1.138.Final, https://github.com/netty/netty.git -  |
|          |                                               |                 | netty-4.1.138.Final, https://github.com/netty/netty.git - netty-4.2.18.Final,                        |
|          |                                               |                 | io.netty:netty-codec-haproxy:4.2.18.Final,io.netty:netty-all:4.1.138.Final                           |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-100666 | N/A                                                                                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-55831  | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-55833  | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-56745  | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                               |                 | netty-4.2.16.Final                                                                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-93558  | Upgrade to version io.netty:netty-codec-http:4.1.138.Final,io.netty:netty-codec-http:4.2.18.Final,   |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.138.Final, https://github.com/netty/netty.git -       |
|          |                                               |                 | netty-4.2.18.Final                                                                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.135.Final.jar            | CVE-2026-93565  | Upgrade to version io.netty:netty-codec-http:4.2.18.Final,io.netty:netty-codec-http:4.1.138.Final,   |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.138.Final, https://github.com/netty/netty.git -       |
|          |                                               |                 | netty-4.2.18.Final,io.netty:netty-all:4.1.138.Final                                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-56819  | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final,io.netty:netty-codec-http2:4.2.16.Final, |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                               |                 | netty-4.2.16.Final                                                                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-59900  | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final                                          |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-93567  | Upgrade to version io.netty:netty-codec-http2:4.1.138.Final,io.netty:netty-all:4.1.138.Final,        |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.1.138.Final, https://github.com/netty/netty.git -       |
|          |                                               |                 | netty-4.2.18.Final,io.netty:netty-codec-http2:4.2.18.Final                                           |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-93568  | Upgrade to version io.netty:netty-codec-http2:4.1.138.Final,io.netty:netty-all:4.1.138.Final,        |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.2.18.Final, https://github.com/netty/netty.git -        |
|          |                                               |                 | netty-4.1.138.Final,io.netty:netty-codec-http2:4.2.18.Final,io.netty:netty-codec-http3:4.2.18.Final  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.135.Final.jar           | CVE-2026-93569  | Upgrade to version io.netty:netty-codec-http2:4.1.138.Final,io.netty:netty-codec-http2:4.2.18.Final, |
|          |                                               |                 | io.netty:netty-all:4.1.138.Final, https://github.com/netty/netty.git - netty-4.1.138.Final,          |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.2.18.Final                                              |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.135.Final.jar               | CVE-2026-62243  | Upgrade to version io.netty:netty-handler:4.1.137.Final,io.netty:netty-handler:4.2.17.Final          |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-handler-4.1.135.Final.jar               | CVE-2026-75596  | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                               |                 | https://github.com/netty/netty.git - netty-4.2.17.Final, https://github.com/netty/netty.git -        |
|          |                                               |                 | netty-4.1.137.Final                                                                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | quarkus-vertx-http-3.37.1.jar                 | CVE-2026-87743  | Upgrade to version io.quarkus:quarkus-vertx-http:3.27.5.3,io.quarkus:quarkus-vertx-http:3.33.3.3,    |
|          |                                               |                 | io.quarkus:quarkus-vertx-http:3.39.5, https://github.com/quarkusio/quarkus.git - 3.40.0,             |
|          |                                               |                 | https://github.com/quarkusio/quarkus.git - 3.33.3.3, https://github.com/quarkusio/quarkus.git -      |
|          |                                               |                 | 3.27.5.3, https://github.com/quarkusio/quarkus.git - 3.39.5,io.quarkus:quarkus-vertx-http:3.40.0     |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | smallrye-fault-tolerance-core-6.11.1.jar      | CVE-2026-94449  | Upgrade to version  https://github.com/smallrye/smallrye-fault-tolerance.git - 6.9.4,                |
|          |                                               |                 | https://github.com/smallrye/smallrye-fault-tolerance.git - 6.11.4,                                   |
|          |                                               |                 | https://github.com/smallrye/smallrye-fault-tolerance.git - 6.10.2,                                   |
|          |                                               |                 | https://github.com/smallrye/smallrye-fault-tolerance.git - 7.0.0,                                    |
|          |                                               |                 | io.smallrye:smallrye-fault-tolerance-core:6.9.4,io.smallrye:smallrye-fault-tolerance-core:6.10.2,    |
|          |                                               |                 | io.smallrye:smallrye-fault-tolerance-core:6.11.4,io.smallrye:smallrye-fault-tolerance-core:7.0.0     |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | snappy-java-1.1.10.8.jar                      | CVE-2026-108106 | Upgrade to version org.xerial.snappy:snappy-java:1.1.10.9, https://github.com/xerial/snappy-java.git |
|          |                                               |                 | - v1.1.10.9                                                                                          |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | snappy-java-1.1.10.8.jar                      | CVE-2026-90559  | N/A                                                                                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | sshd-common-2.17.1.jar                        | CVE-2026-56624  | Upgrade to version  https://github.com/apache/mina-sshd.git - sshd-3.0.0-M5,                         |
|          |                                               |                 | org.apache.sshd:sshd-core:2.19.0,org.apache.sshd:sshd-common:3.0.0-M5,                               |
|          |                                               |                 | org.apache.sshd:sshd-core:3.0.0-M5, https://github.com/apache/mina-sshd.git - sshd-2.19.0,           |
|          |                                               |                 | org.apache.sshd:sshd-common:2.19.0                                                                   |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-core-4.5.28.jar                         | CVE-2026-102467 | Upgrade to version io.vertx:vertx-core:5.1.9,io.vertx:vertx-core:4.5.35,io.vertx:vertx-core:5.2.1    |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-core-4.5.28.jar                         | CVE-2026-15075  | Upgrade to version  https://github.com/eclipse-vertx/vert.x.git - 5.1.5,io.vertx:vertx-core:4.5.30,  |
|          |                                               |                 | io.vertx:vertx-core:5.1.5, https://github.com/eclipse-vertx/vert.x.git - 4.5.30                      |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-grpc-server-4.5.28.jar                  | CVE-2026-102477 | Upgrade to version io.vertx:vertx-grpc-server:4.5.35,io.vertx:vertx-grpc-server:5.1.10               |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-web-4.5.28.jar                          | CVE-2026-102460 | Upgrade to version io.vertx:vertx-web:5.1.9,io.vertx:vertx-web:4.5.35,                               |
|          |                                               |                 | https://github.com/vert-x3/vertx-web.git - 5.1.9, https://github.com/vert-x3/vertx-web.git - 4.5.35, |
|          |                                               |                 | https://github.com/vert-x3/vertx-web.git - 5.2.1                                                     |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | vertx-web-client-4.5.28.jar                   | CVE-2026-15076  | Upgrade to version io.vertx:vertx-web-client:4.5.30, https://github.com/vert-x3/vertx-web.git -      |
|          |                                               |                 | 4.5.30, https://github.com/vert-x3/vertx-web.git - 5.1.5,io.vertx:vertx-web-client:5.1.5             |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | wildfly-elytron-password-impl-2.9.1.Final.jar | CVE-2026-19611  | N/A                                                                                                  |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-87795  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-87823  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-87824  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-87825  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-87877  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-89046  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-90560  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | zstd-jni-1.5.6-10.jar                         | CVE-2026-90852  | Upgrade to version com.github.luben:zstd-jni:1.5.7-14, https://github.com/luben/zstd-jni.git -       |
|          |                                               |                 | v1.5.7-14                                                                                            |
+----------+-----------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-micrometer-opentelemetry-3.37.1.jar
|-- opentelemetry-micrometer-1.5-2.26.1-alpha.jar
	|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
|-- quarkus-micrometer-3.37.1.jar
	|-- micrometer-core-1.16.6.jar [2 MEDIUM]
		|-- guava-33.6.0-jre.jar [1 HIGH]
		|-- grpc-api-1.81.0.jar
			|-- guava-33.6.0-jre.jar [1 HIGH]
		|-- LatencyUtils-2.0.3.jar [1 LOW]
	|-- quarkus-vertx-http-3.37.1.jar [1 HIGH]
		|-- smallrye-mutiny-vertx-web-3.22.2.jar
			|-- smallrye-mutiny-vertx-uri-template-3.22.2.jar
				|-- vertx-uri-template-4.5.28.jar
					|-- vertx-core-4.5.28.jar [2 HIGH]
			|-- vertx-web-4.5.28.jar [1 HIGH]
		|-- vertx-web-4.5.28.jar [1 HIGH]
			|-- vertx-auth-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [2 HIGH]
			|-- vertx-bridge-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [2 HIGH]
			|-- vertx-core-4.5.28.jar [2 HIGH]
			|-- vertx-web-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [2 HIGH]
	|-- vertx-codegen-4.5.28.jar
		|-- jackson-core-2.22.0.jar [3 HIGH]
|-- quarkus-opentelemetry-3.37.1.jar
	|-- opentelemetry-instrumentation-annotations-support-2.26.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-instrumentation-annotations-2.26.1.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-instrumentation-api-2.26.1.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-jdbc-2.26.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-runtime-telemetry-java17-2.26.1-alpha.jar
		|-- opentelemetry-runtime-telemetry-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-api-incubator-1.60.1-alpha.jar
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-exporter-otlp-common-1.60.1.jar
		|-- opentelemetry-exporter-common-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-exporter-otlp-1.60.1.jar
		|-- opentelemetry-sdk-logs-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-metrics-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-trace-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- opentelemetry-sdk-1.60.1.jar
... *truncated, see full logs below*
SAST scan output 
*no findings*

Full logs and artifacts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@akridl