Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from daec766bf11d85450690879a7ae58774f02040b7 to 5724fa71e8573b90c720dbc79fe19ce03157651f

[dependabot]

Bumps project-ncl/shared-github-actions/.github/workflows/maven-release.yml from daec766bf11d85450690879a7ae58774f02040b7 to 5724fa71e8573b90c720dbc79fe19ce03157651f.

Commits

• 5724fa7 Merge pull request #47 from rnc/BR1
• c633dc7 Correct label categories
• de1c690 Merge pull request #43 from project-ncl/dependabot/github_actions/project-ncl...
• e002603 Merge pull request #44 from rnc/BR1
• a475535 Correct tag name from main to fixed version
• dc16c38 NCL-9648 Push repo compile-time m2 dependencies in maven-ci
• 47dde26 Avoid dependabot failures after a release
• ec637c1 Bump project-ncl/shared-github-actions
• 153b977 Merge pull request #29 from project-ncl/dependabot/github_actions/project-ncl...
• 5c44905 Merge pull request #42 from rnc/BR1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

⚠️ SAST findings detected

SCA scan output

ar
		|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
	|-- quarkus-jdbc-postgresql-3.34.5.jar
		|-- postgresql-42.7.10.jar [1 HIGH]
	|-- quarkus-oidc-3.34.5.jar
		|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
	|-- quarkus-opentelemetry-3.34.5.jar
		|-- opentelemetry-instrumentation-annotations-support-2.23.0-alpha.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-instrumentation-api-2.23.0.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-jdbc-2.23.0-alpha.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-runtime-telemetry-java17-2.23.0-alpha.jar
			|-- opentelemetry-runtime-telemetry-java8-2.23.0-alpha.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-api-incubator-1.57.0-alpha.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-common-1.57.0.jar
			|-- opentelemetry-exporter-common-1.57.0.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-1.57.0.jar
			|-- opentelemetry-sdk-metrics-1.57.0.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- opentelemetry-sdk-1.57.0.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-common-1.57.0.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-logs-1.57.0.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-trace-1.57.0.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
		|-- quarkus-grpc-common-3.34.5.jar
			|-- vertx-grpc-4.5.26.jar
				|-- grpc-netty-1.79.0.jar
					|-- netty-codec-http2-4.1.132.Final.jar [1 HIGH]
					|-- netty-handler-proxy-4.1.132.Final.jar [1 HIGH]
		|-- quarkus-tls-registry-3.34.5.jar
			|-- smallrye-private-key-pem-parser-0.9.2.jar
				|-- bcpkix-jdk18on-1.83.jar [1 MEDIUM]
					|-- bcutil-jdk18on-1.83.jar
						|-- bcprov-jdk18on-1.83.jar [2 CRITICAL, 1 MEDIUM]
				|-- bcprov-jdk18on-1.83.jar [2 CRITICAL, 1 MEDIUM]
		|-- quarkus-vertx-3.34.5.jar
			|-- quarkus-netty-3.34.5.jar
				|-- netty-codec-http2-4.1.132.Final.jar [1 HIGH]
				|-- netty-codec-http-4.1.132.Final.jar [2 HIGH, 4 MEDIUM]
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]
	|-- quarkus-smallrye-health-3.34.5.jar
		|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
	|-- quarkus-smallrye-openapi-3.34.5.jar
		|-- quarkus-swagger-ui-3.34.5.jar
			|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
		|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
	|-- reports-rest-3.0.1-SNAPSHOT.jar
		|-- quarkus-rest-jackson-3.34.5.jar
			|-- quarkus-rest-3.34.5.jar
				|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
		|-- quarkus-websockets-3.34.5.jar
			|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
			|-- quarkus-websockets-client-3.34.5.jar
				|-- quarkus-http-websocket-core-5.4.0.jar
					|-- netty-codec-http-4.1.132.Final.jar [2 HIGH, 4 MEDIUM]
		|-- reports-backend-3.0.1-SNAPSHOT.jar
			|-- communication-3.0.1-SNAPSHOT.jar
				|-- quarkus-undertow-3.34.5.jar
					|-- quarkus-http-core-5.4.0.jar
						|-- netty-codec-http-4.1.132.Final.jar [2 HIGH, 4 MEDIUM]
					|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
				|-- galley-cache-partyline-1.22-jakarta.jar
					|-- partyline-2.4.jar
						|-- infinispan-core-9.4.24.Final.jar [1 HIGH, 1 MEDIUM]
				|-- galley-transport-httpclient-1.22-jakarta.jar
					|-- jhttpc-1.17.jar
						|-- bcpkix-jdk18on-1.83.jar [1 MEDIUM]
						|-- bcprov-jdk18on-1.83.jar [2 CRITICAL, 1 MEDIUM]
				|-- source-code-manager-3.0.1-SNAPSHOT.jar
					|-- quarkus-quartz-3.34.5.jar
						|-- quarkus-scheduler-3.34.5.jar
							|-- quarkus-vertx-http-3.34.5.jar [1 HIGH]
					|-- maven-scm-api-1.13.0.jar
						|-- plexus-utils-3.6.1.jar [1 HIGH]
					|-- maven-scm-provider-jgit-1.13.0.jar
						|-- maven-scm-provider-git-commons-1.13.0.jar
							|-- plexus-utils-3.6.1.jar [1 HIGH]
						|-- plexus-utils-3.6.1.jar [1 HIGH]
						|-- org.eclipse.jgit-4.5.4.201711221230-r.jar [1 HIGH, 1 MEDIUM]
					|-- maven-scm-provider-svnexe-1.13.0.jar
						|-- commons-lang-2.6.jar [1 MEDIUM]
						|-- maven-scm-provider-svn-commons-1.13.0.jar
							|-- plexus-utils-3.6.1.jar [1 HIGH]
						|-- plexus-utils-3.6.1.jar [1 HIGH]
|-- rest-client-jakarta-3.4.5.jar
	|-- common-3.4.5-jakarta.jar
		|-- opentelemetry-instrumentation-annotations-2.27.0.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
	|-- pnc-common-3.4.1-jakarta.jar
		|-- opentelemetry-ext-cli-java-1.5.0.jar
			|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.57.0.jar [1 MEDIUM]
	|-- rest-client-3.4.5-jakarta.jar
		|-- vertx-core-4.5.26.jar
			|-- netty-codec-haproxy-4.1.132.Final.jar
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]
			|-- netty-codec-http2-4.1.132.Final.jar [1 HIGH]
				|-- netty-codec-http-4.1.132.Final.jar [2 HIGH, 4 MEDIUM]
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]
			|-- netty-codec-http-4.1.132.Final.jar [2 HIGH, 4 MEDIUM]
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]
			|-- netty-handler-proxy-4.1.132.Final.jar [1 HIGH]
				|-- netty-codec-http-4.1.132.Final.jar [2 HIGH, 4 MEDIUM]
				|-- netty-codec-socks-4.1.132.Final.jar
					|-- netty-codec-4.1.132.Final.jar [1 HIGH]
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]
			|-- netty-handler-4.1.132.Final.jar
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]
			|-- netty-resolver-dns-4.1.132.Final.jar
				|-- netty-codec-dns-4.1.132.Final.jar [1 HIGH]
					|-- netty-codec-4.1.132.Final.jar [1 HIGH]
				|-- netty-codec-4.1.132.Final.jar [1 HIGH]


No Policy violations were detected

Project 'dependency-analysis' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=17cd357b-3d0e-43ac-a982-661505cac482
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=d38fa0abfb554c9cac571a09497e0af3f534680889b74705ab11e416b1c07dd4

Mend AI scan succeeded.

Support Token: 347d4429f2e5445e3b355e3201585c3281778904582531

SAST scan output

warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java:142)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java:140)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java:122)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (source-code-manager/src/main/java/org/jboss/da/scm/impl/SCMImpl.java:69)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java:124)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-backend/src/main/java/org/jboss/da/reports/impl/ReportsGeneratorImpl.java:571)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java:101)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java:103)
warning: 'info' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (source-code-manager/src/main/java/org/jboss/da/scm/impl/SCMImpl.java:44)

Full logs and artifacts