Skip to content

build(deps): bump the maven-minor-and-patch group with 22 updates - #92

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/maven-minor-and-patch-2b1bf21413
Closed

build(deps): bump the maven-minor-and-patch group with 22 updates#92
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/maven-minor-and-patch-2b1bf21413

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown

Bumps the maven-minor-and-patch group with 22 updates:

Package From To
tools.jackson:jackson-bom 3.1.7 3.2.3
com.fasterxml.jackson:jackson-bom 2.21.7 2.22.3
org.apache.tomcat.embed:tomcat-embed-core 11.0.26 11.0.27
org.apache.tomcat.embed:tomcat-embed-el 11.0.26 11.0.27
org.apache.tomcat.embed:tomcat-embed-websocket 11.0.26 11.0.27
net.jqwik:jqwik 1.9.3 1.10.2
org.apache.zookeeper:zookeeper 3.6.4 3.9.6
org.apache.maven.plugins:maven-dependency-plugin 3.7.0 3.11.0
com.github.spotbugs:spotbugs-maven-plugin 4.10.4.1 4.10.5.0
org.apache.maven.plugins:maven-source-plugin 3.3.1 3.4.0
io.dropwizard.metrics:metrics-core 4.1.12.1 4.2.40
commons-logging:commons-logging 1.3.6 1.4.0
org.codehaus.mojo:build-helper-maven-plugin 3.6.1 3.6.2
io.netty:netty-bom 4.1.137.Final 4.2.19.Final
org.apache.hive:hive-jdbc 4.0.1 4.2.1
commons-io:commons-io 2.21.0 2.22.0
commons-cli:commons-cli 1.9.0 1.11.0
org.apache.maven.plugins:maven-shade-plugin 3.6.1 3.6.2
org.codehaus.woodstox:stax2-api 4.2.2 4.3.2
org.apache.commons:commons-text 1.14.0 1.15.0
org.apache.hadoop.thirdparty:hadoop-shaded-guava 1.1.1 1.5.0
org.apache.commons:commons-collections4 4.4 4.6.0

Updates tools.jackson:jackson-bom from 3.1.7 to 3.2.3

Commits
  • 169de87 [maven-release-plugin] prepare release jackson-bom-3.2.3
  • c64410b Prep for 3.2.3 release
  • 1f23ca6 Merge branch '3.1' into 3.2
  • 432ca52 Post-release dep version bump
  • e0d3ccf [maven-release-plugin] prepare for next development iteration
  • c63b07a Post-release dep version bump
  • b0a5033 [maven-release-plugin] prepare for next development iteration
  • 719429d [maven-release-plugin] prepare release jackson-bom-3.2.2
  • d0b9877 Prep for 3.2.2 release
  • e32f526 Merge branch '3.1' into 3.2
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.21.7 to 2.22.3

Commits
  • 9b1c380 [maven-release-plugin] prepare release jackson-bom-2.22.3
  • f76ca14 Prep for 2.22.3 release
  • d6ac108 Merge branch '2.21' into 2.22
  • 093a05e Post-release dep version bump
  • e7a71a2 [maven-release-plugin] prepare for next development iteration
  • 208b1bf Post-release dep version bump
  • 929f6ac [maven-release-plugin] prepare for next development iteration
  • 062d76d [maven-release-plugin] prepare release jackson-bom-2.22.2
  • dcf18f7 Prep for 2.22.2 release
  • 9688c7b Merge branch '2.21' into 2.22
  • Additional commits viewable in compare view

Updates org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-el from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-el from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.26 to 11.0.27

Updates net.jqwik:jqwik from 1.9.3 to 1.10.2

Release notes

Sourced from net.jqwik:jqwik's releases.

Little Fix for IDEs

New and Enhanced Features

  • Annotation @Provide has now @Keep as meta-annotation, which enables IDEs to recognise that methods using this annotation are indeed used. See issue 733 for details. Many thanks to JarvisCraft for finding and fixing it.

Dependency Upgrades and Bug Fixes

  • Upgraded build system to Gradle 9.8.0

Anti-AI Release

Warning: Starting with version 1.10 jqwik comes with an Anti-AI Usage Clause! Usage with any "AI" agent is strongly discouraged. Jqwik's log output may confuse the agent.

This will probably be the last release of Jqwik using JUnit Platform version 1.x. Upcoming releases, if ever realised, will be built on JUnit Platform 6 and thus Java >= 21.

New and Enhanced Features

  • Added paragraph about intended AI usage to user guide: This project is not meant to be used by any “AI” coding agents at all.

  • Made @NotBlank configurator compatible with UTF-8 whitespace. See issue 663 for details.

Breaking Changes

  • Use of jqwik >= 1.10 with coding agents is strongly discouraged. Jqwik's output to stdout may confuse AI-based agents.

Dependency Upgrades and Bug Fixes

  • Upgraded to Kotlin 2.3.21
  • Upgraded to JUnit Platform 1.14.4
Commits
  • c8e1d6a Set release version 1.10.2
  • c15cb3f Set Kotlin base version to 2.1
  • ce65e4d Upgraded to Gradle 9.8.0
  • b4c84f8 Mark @Provide as @Keep
  • ac192eb Bump archunitVersion from 1.5.0 to 1.5.1
  • c66e898 Updated CONTRIBUTING.md
  • b915f62 Bump actions/setup-java from 5 to 6
  • 91d608c Bump archunitVersion from 1.4.2 to 1.5.0
  • 46a33cb Bump com.github.vlsi.gradle-extensions:com.github.vlsi.gradle-extensions.grad...
  • f6e23bd Bump actions/checkout from 6 to 7
  • Additional commits viewable in compare view

Updates org.apache.zookeeper:zookeeper from 3.6.4 to 3.9.6

Updates org.apache.maven.plugins:maven-dependency-plugin from 3.7.0 to 3.11.0

Release notes

Sourced from org.apache.maven.plugins:maven-dependency-plugin's releases.

3.11.0

🚀 New features and improvements

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

3.10.0

🚀 New features and improvements

🐛 Bug Fixes

... (truncated)

Commits
  • c186d05 [maven-release-plugin] prepare release maven-dependency-plugin-3.11.0
  • 3712611 Fix artifact relocation support
  • e873e0e Manage ASM version 9.10 to support JDK 27
  • 70b5356 fix: fix addParentPoms=true causes repositories to be ignored. (#1585)
  • 51d8939 Fix false positive in analyze-exclusions with transitive dependency exclusion...
  • 02b865b Bump eu.maveniverse.maven.domtrip:domtrip-core from 1.5.0 to 1.5.1
  • 04f4de1 Bump eu.maveniverse.maven.domtrip:domtrip-maven from 1.5.0 to 1.5.1
  • 2812490 Bump mavenVersion from 3.9.15 to 3.9.16
  • ce117da Bump org.apache.maven.shared:maven-dependency-analyzer
  • aea7a64 Prevent NPE (#1622)
  • Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-maven-plugin from 4.10.4.1 to 4.10.5.0

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.10.5.0

What's Changed

Full Changelog: spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.4.1...spotbugs-maven-plugin-4.10.5.0

Commits
  • 74f5dd6 [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.5.0
  • 37501b1 [pom] Exclude jcl over slf4j from maven core
  • fe7730c [pom] Adjust required to build maven to 3.9.16 as 3.10.0 needs more work
  • ee87607 [pom] Build internals off maven 3.10.0
  • 18a8404 [pom] Bump maven shared utils to 3.5.0
  • abd6753 [pom] Bump groovy to 5.1.3
  • 187fad4 [pom] Bump base parent to 62
  • 9e4846b [pom] Bump commons-lang to 3.21.0
  • 27cd67a [pom] Bump asm to 9.11
  • c556077 [pom] Bump to spotbugs 4.10.5
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0

Release notes

Sourced from org.apache.maven.plugins:maven-source-plugin's releases.

3.4.0

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

Commits
  • ecf937a [maven-release-plugin] prepare release maven-source-plugin-3.4.0
  • 95b3bf4 Revert "[maven-release-plugin] prepare for next development iteration"
  • 7a9a770 [maven-release-plugin] prepare for next development iteration
  • 292c1ce Use plexus-utils version from parent
  • bf79b71 Bump m-invoker-p to 3.9.1
  • 4f3fcb9 Bump commons-io:commons-io from 2.20.0 to 2.21.0
  • a867442 Bump org.codehaus.plexus:plexus-archiver from 4.10.3 to 4.10.4
  • 51c66ac Bump org.apache.maven:maven-archiver from 3.6.4 to 3.6.5
  • 267df46 Bump org.codehaus.plexus:plexus-archiver from 4.10.1 to 4.10.3
  • ef85324 Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness
  • Additional commits viewable in compare view

Updates io.dropwizard.metrics:metrics-core from 4.1.12.1 to 4.2.40

Release notes

Sourced from io.dropwizard.metrics:metrics-core's releases.

v4.2.40

What's Changed

Full Changelog: dropwizard/metrics@v4.2.39...v4.2.40

... (truncated)

Commits
  • deca21f [maven-release-plugin] prepare release v4.2.40
  • adc06fc feat: add module for logback 1.6.x (#5370)
  • 7a8bae2 fix(deps): update jackson3 monorepo (release/4.2.x) (minor) (#5288)
  • c04e360 build: compile in-process rather than by forking javac (#5369)
  • 16f0efc fix(deps): update dependency com.rabbitmq:amqp-client to v5.35.0 (#5367)
  • 2f4a844 fix(deps): update dependency net.bytebuddy:byte-buddy to v1.18.12-jdk5 (#5361)
  • 9789a72 fix(deps): update jackson monorepo to v3.1.6 (#5362)
  • d8603c7 fix(deps): update dependency org.apache.httpcomponents.client5:httpclient5 to...
  • 75340bd fix(deps): update jetty monorepo to v12.1.12 (#5357)
  • d6fc38e fix(deps): update dependency org.apache.httpcomponents.client5:httpclient5 to...
  • Additional commits viewable in compare view

Updates commons-logging:commons-logging from 1.3.6 to 1.4.0

Changelog

Sourced from commons-logging:commons-logging's changelog.

Apache Commons Logging 1.4.0 Release Notes

The Apache Commons Logging team is pleased to announce the release of Apache Commons Logging 1.4.0.

Apache Commons Logging is a thin adapter allowing configurable bridging to other, well-known logging systems.

This is a feature and maintenance release. Java 8 or later is required.

Changes in this version

Fixed Bugs

  •           Use the new Apache oak leaf logo. Thanks to Gary Gregory.

  •           Fix broken URLs in website links. Thanks to Stanimir Stamenkov, Gary Gregory.

  •           Add support for Jakarta servlets, see org.apache.commons.logging.jakarta.ServletContextCleaner [#419](https://github.com/apache/commons-logging/issues/419). Thanks to Kiril Keranov, Gary Gregory.

Changes

  •           Bump org.apache.commons:commons-parent from 97 to 102. Thanks to Gary Gregory.

  •           Bump log4j2.version from 2.25.3 to 2.26.0. Thanks to Gary Gregory, Dependabot.

  •           Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18. Thanks to Gary Gregory, Dependabot.

Historical list of changes: https://commons.apache.org/proper/commons-logging/changes.html

Download it from https://commons.apache.org/proper/commons-logging/download_logging.cgi

For complete information on Apache Commons Logging, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Logging website:

https://commons.apache.org/proper/commons-logging/

Commits
  • ff5ff39 Prepare for the release candidate 1.4.0 RC1
  • a685f33 Prepare for the next release candidate
  • a253ab6 Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18.
  • d6c9b81 Javadoc
  • 1cf45b2 Update legacy GitHub links in CONTRIBUTING.md
  • 9b48b5b Bump org.apache.commons:commons-parent from 101 to 102.
  • 7a44cb6 Bump GH CI actions/dependency-review-action from 4.9.0 to 5.0.0
  • e884661 Bump GH CI actions/checkout from 6.0.2 to 6.0.3
  • f6ad6f9 Bump org.apache.commons:commons-parent from 100 to 101
  • b468740 Bump github/codeql-action from 4.36.0 to 4.36.2
  • Additional commits viewable in compare view

Updates org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2

Release notes

Sourced from org.codehaus.mojo:build-helper-maven-plugin's releases.

3.6.2

🐛 Bug Fixes

👻 Maintenance

  • Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#248) @​slachiewicz

📦 Dependency updates

Commits
  • 813bc7d [maven-release-plugin] prepare release 3.6.2
  • 07d9109 Remove redundant maven-resolver-api and ignore Resolver/SLF4J 2.x in Dependabot
  • 9abd552 Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0
  • 3c15526 Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml
  • 3b1f104 Bump org.codehaus.mojo:mojo-parent from 96 to 97
  • 1749855 Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml
  • 5230041 Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3
  • c0e9375 Delete .github/release-drafter.yml
  • 84a839e Bump org.codehaus.mojo:mojo-parent from 95 to 96
  • a85c668 Replace raw NPEx with customized exception message
  • Additional commits viewable in compare view

Updates io.netty:netty-bom from 4.1.137.Final to 4.2.19.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.19.Final

Security

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

  • CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
  • CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
  • CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
  • CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
  • CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
  • CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
  • CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
  • CVE-2026-XXXXX : improper access control in io.netty:netty-handler
  • CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
  • CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
  • CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

What's Changed

@dependabot
build(deps): bump the maven-minor-and-patch group with 22 updates
1d65137 
Bumps the maven-minor-and-patch group with 22 updates:

| Package | From | To |
| --- | --- | --- |
| [tools.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `3.1.7` | `3.2.3` |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.21.7` | `2.22.3` |
| org.apache.tomcat.embed:tomcat-embed-core | `11.0.26` | `11.0.27` |
| org.apache.tomcat.embed:tomcat-embed-el | `11.0.26` | `11.0.27` |
| org.apache.tomcat.embed:tomcat-embed-websocket | `11.0.26` | `11.0.27` |
| [net.jqwik:jqwik](https://github.com/jqwik-team/jqwik) | `1.9.3` | `1.10.2` |
| org.apache.zookeeper:zookeeper | `3.6.4` | `3.9.6` |
| [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) | `3.7.0` | `3.11.0` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.4.1` | `4.10.5.0` |
| [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.1` | `3.4.0` |
| [io.dropwizard.metrics:metrics-core](https://github.com/dropwizard/metrics) | `4.1.12.1` | `4.2.40` |
| [commons-logging:commons-logging](https://github.com/apache/commons-logging) | `1.3.6` | `1.4.0` |
| [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.1.137.Final` | `4.2.19.Final` |
| org.apache.hive:hive-jdbc | `4.0.1` | `4.2.1` |
| commons-io:commons-io | `2.21.0` | `2.22.0` |
| [commons-cli:commons-cli](https://github.com/apache/commons-cli) | `1.9.0` | `1.11.0` |
| [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) | `3.6.1` | `3.6.2` |
| [org.codehaus.woodstox:stax2-api](https://github.com/FasterXML/stax2-api) | `4.2.2` | `4.3.2` |
| [org.apache.commons:commons-text](https://github.com/apache/commons-text) | `1.14.0` | `1.15.0` |
| org.apache.hadoop.thirdparty:hadoop-shaded-guava | `1.1.1` | `1.5.0` |
| org.apache.commons:commons-collections4 | `4.4` | `4.6.0` |


Updates `tools.jackson:jackson-bom` from 3.1.7 to 3.2.3
- [Commits](FasterXML/jackson-bom@jackson-bom-3.1.7...jackson-bom-3.2.3)

Updates `com.fasterxml.jackson:jackson-bom` from 2.21.7 to 2.22.3
- [Commits](FasterXML/jackson-bom@jackson-bom-2.21.7...jackson-bom-2.22.3)

Updates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-el` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-el` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.26 to 11.0.27

Updates `net.jqwik:jqwik` from 1.9.3 to 1.10.2
- [Release notes](https://github.com/jqwik-team/jqwik/releases)
- [Commits](jqwik-team/jqwik@1.9.3...1.10.2)

Updates `org.apache.zookeeper:zookeeper` from 3.6.4 to 3.9.6

Updates `org.apache.maven.plugins:maven-dependency-plugin` from 3.7.0 to 3.11.0
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases)
- [Commits](apache/maven-dependency-plugin@maven-dependency-plugin-3.7.0...maven-dependency-plugin-3.11.0)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.4.1 to 4.10.5.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.4.1...spotbugs-maven-plugin-4.10.5.0)

Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/apache/maven-source-plugin/releases)
- [Commits](apache/maven-source-plugin@maven-source-plugin-3.3.1...maven-source-plugin-3.4.0)

Updates `io.dropwizard.metrics:metrics-core` from 4.1.12.1 to 4.2.40
- [Release notes](https://github.com/dropwizard/metrics/releases)
- [Commits](dropwizard/metrics@v4.1.12.1...v4.2.40)

Updates `commons-logging:commons-logging` from 1.3.6 to 1.4.0
- [Changelog](https://github.com/apache/commons-logging/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-logging@rel/commons-logging-1.3.6...rel/commons-logging-1.4.0)

Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.1...3.6.2)

Updates `io.netty:netty-bom` from 4.1.137.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.137.Final...netty-4.2.19.Final)

Updates `org.apache.hive:hive-jdbc` from 4.0.1 to 4.2.1

Updates `commons-io:commons-io` from 2.21.0 to 2.22.0

Updates `commons-cli:commons-cli` from 1.9.0 to 1.11.0
- [Changelog](https://github.com/apache/commons-cli/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-cli@rel/commons-cli-1.9.0...rel/commons-cli-1.11.0)

Updates `org.apache.maven.plugins:maven-shade-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/apache/maven-shade-plugin/releases)
- [Commits](apache/maven-shade-plugin@maven-shade-plugin-3.6.1...maven-shade-plugin-3.6.2)

Updates `org.codehaus.woodstox:stax2-api` from 4.2.2 to 4.3.2
- [Commits](FasterXML/stax2-api@stax2-api-4.2.2...stax2-api-4.3.2)

Updates `org.apache.commons:commons-text` from 1.14.0 to 1.15.0
- [Changelog](https://github.com/apache/commons-text/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-text@rel/commons-text-1.14.0...rel/commons-text-1.15.0)

Updates `org.apache.hadoop.thirdparty:hadoop-shaded-guava` from 1.1.1 to 1.5.0

Updates `org.apache.commons:commons-collections4` from 4.4 to 4.6.0

---
updated-dependencies:
- dependency-name: tools.jackson:jackson-bom
  dependency-version: 3.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-core
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-el
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-websocket
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-el
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-websocket
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: net.jqwik:jqwik
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.zookeeper:zookeeper
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.10.5.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-source-plugin
  dependency-version: 3.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: io.dropwizard.metrics:metrics-core
  dependency-version: 4.2.40
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: commons-logging:commons-logging
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hive:hive-jdbc
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: commons-io:commons-io
  dependency-version: 2.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: commons-cli:commons-cli
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-shade-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.codehaus.woodstox:stax2-api
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.commons:commons-text
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hadoop.thirdparty:hadoop-shaded-guava
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.commons:commons-collections4
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added Dependencies Pull requests that update a dependency file Java Pull requests that update Java code labels Oct 15, 2026
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 8 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
See the Details below.

License Issues

agents/grantforge-agent-hdfs-2.10/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

agents/grantforge-agent-hdfs-2.7/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

agents/grantforge-agent-hdfs-3.2/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

agents/grantforge-agent-hdfs-3.3/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

agents/grantforge-agent-hdfs-3.4/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

agents/grantforge-agent-hdfs-3.5/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

plugins/grantforge-plugin-hdfs/pom.xml

PackageVersionLicenseIssue Type
org.codehaus.mojo:build-helper-maven-plugin3.6.2LicenseRef-bad-non-standardIncompatible License

pom.xml

PackageVersionLicenseIssue Type
net.jqwik:jqwik1.10.2LicenseRef-bad-non-standardIncompatible License
Allowed Licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, CC0-1.0, CC-BY-4.0, Unlicense, BlueOak-1.0.0, Python-2.0, EPL-1.0, EPL-2.0, MPL-2.0, LGPL-2.1-only, LGPL-2.1-or-later
Excluded from license check: pkg:maven/com.oracle.database.jdbc/ojdbc11, pkg:maven/com.oracle.database.jdbc/ucp11, pkg:maven/com.mysql/mysql-connector-j, pkg:npm/robust-predicates, pkg:npm/uri-js, pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.apache.hadoop.thirdparty/hadoop-shaded-protobuf_3_25, pkg:maven/org.apache.maven.plugins/maven-javadoc-plugin

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.codehaus.woodstox:stax2-api 4.3.2 UnknownUnknown
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.commons:commons-text 1.15.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.codehaus.woodstox:stax2-api 4.3.2 UnknownUnknown
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.commons:commons-text 1.15.0 UnknownUnknown
maven/org.apache.hadoop.thirdparty:hadoop-shaded-guava 1.5.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.codehaus.woodstox:stax2-api 4.3.2 UnknownUnknown
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.commons:commons-collections4 4.6.0 UnknownUnknown
maven/org.apache.commons:commons-text 1.15.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.codehaus.woodstox:stax2-api 4.3.2 UnknownUnknown
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.commons:commons-collections4 4.6.0 UnknownUnknown
maven/org.apache.commons:commons-text 1.15.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.codehaus.woodstox:stax2-api 4.3.2 UnknownUnknown
maven/commons-cli:commons-cli 1.11.0 UnknownUnknown
maven/commons-io:commons-io 2.22.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/commons-logging:commons-logging 1.4.0 UnknownUnknown
maven/org.apache.commons:commons-collections4 4.6.0 UnknownUnknown
maven/org.apache.commons:commons-text 1.15.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-dependency-plugin 4.2.1 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.woodstox:stax2-api 4.3.2 UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/io.dropwizard.metrics:metrics-core 4.2.40 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/19 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool detected
Packaging🟢 10packaging workflow detected
maven/org.apache.maven.plugins:maven-shade-plugin 3.6.2 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 6/17 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.zookeeper:zookeeper 3.9.6 UnknownUnknown
maven/io.dropwizard.metrics:metrics-core 4.2.40 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/19 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool detected
Packaging🟢 10packaging workflow detected
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.apache.hive:hive-jdbc 4.2.1 UnknownUnknown
maven/io.dropwizard.metrics:metrics-core 4.2.40 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/19 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool detected
Packaging🟢 10packaging workflow detected
maven/io.netty:netty-bom 4.2.19 UnknownUnknown
maven/com.fasterxml.jackson:jackson-bom 2.22.3 UnknownUnknown
maven/com.github.spotbugs:spotbugs-maven-plugin 4.10.5.0 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/13 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
maven/net.jqwik:jqwik 1.10.2 UnknownUnknown
maven/org.apache.maven.plugins:maven-dependency-plugin 3.11.0 🟢 5
Details
CheckScoreReason
Code-Review🟢 3Found 6/19 approved changesets -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-source-plugin 3.4.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 10/17 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.tomcat.embed:tomcat-embed-core 11.0.27 UnknownUnknown
maven/org.apache.tomcat.embed:tomcat-embed-el 11.0.27 UnknownUnknown
maven/org.apache.tomcat.embed:tomcat-embed-websocket 11.0.27 UnknownUnknown
maven/org.apache.zookeeper:zookeeper 3.9.6 UnknownUnknown
maven/tools.jackson:jackson-bom 3.2.3 UnknownUnknown

Scanned Files

  • agents/grantforge-agent-hdfs-2.10/pom.xml
  • agents/grantforge-agent-hdfs-2.7/pom.xml
  • agents/grantforge-agent-hdfs-3.2/pom.xml
  • agents/grantforge-agent-hdfs-3.3/pom.xml
  • agents/grantforge-agent-hdfs-3.4/pom.xml
  • agents/grantforge-agent-hdfs-3.5/pom.xml
  • agents/grantforge-agent-hdfs-native/pom.xml
  • agents/grantforge-agent-hive/pom.xml
  • agents/grantforge-agent-mysql/pom.xml
  • agents/grantforge-agent-zookeeper/pom.xml
  • core/grantforge-plugin-host/pom.xml
  • plugins/grantforge-plugin-hdfs/pom.xml
  • plugins/grantforge-plugin-hive/pom.xml
  • plugins/grantforge-plugin-zookeeper/pom.xml
  • pom.xml

@qianmoQ qianmoQ closed this Oct 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/maven/maven-minor-and-patch-2b1bf21413 branch October 20, 2026 04:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Dependencies Pull requests that update a dependency file Java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@qianmoQ