Provides transitive vulnerable dependency maven:org.codehaus.plexus:plexus-utils:3.3.0 * [CVE-2025-67030](https://www.mend.io/vulnerability-database/CVE-2025-67030?utm_source=Jetbrains) 9.8 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Provides transitive vulnerable dependency maven:org.apache.commons:commons-compress:1.22 * [CVE-2024-25710](https://www.mend.io/vulnerability-database/CVE-2024-25710?utm_source=JetBrains) 8.1 Loop with Unreachable Exit Condition ('Infinite Loop') * [CVE-2023-42503](https://www.mend.io/vulnerability-database/CVE-2023-42503?utm_source=JetBrains) 5.5 Uncontrolled Resource Consumption ('Resource Exhaustion') * [CVE-2024-26308](https://www.mend.io/vulnerability-database/CVE-2024-26308?utm_source=JetBrains) 5.5 Allocation of Resources Without Limits or Throttling Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Provides transitive vulnerable dependency maven:io.netty:netty-codec:4.1.97.Final * [CVE-2025-58057](https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains) 7.5 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Provides transitive vulnerable dependency maven:io.netty:netty-handler:4.1.97.Final * [CVE-2025-24970](https://www.mend.io/vulnerability-database/CVE-2025-24970?utm_source=JetBrains) 7.5 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v3, JetBrains/qodana-action@v2025.3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Duplicated code

Provides transitive vulnerable dependency maven:org.apache.commons:commons-lang3:3.13.0 * [CVE-2025-48924](https://www.mend.io/vulnerability-database/CVE-2025-48924?utm_source=Jetbrains) 5.3 Insufficient Information Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Provides transitive vulnerable dependency maven:org.apache.logging.log4j:log4j-core:2.19.0 * [CVE-2026-34480](https://www.mend.io/vulnerability-database/CVE-2026-34480?utm_source=Jetbrains) 5.8 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters * [CVE-2025-68161](https://www.mend.io/vulnerability-database/CVE-2025-68161?utm_source=Jetbrains) 5.4 Insufficient Information * [CVE-2026-34477](https://www.mend.io/vulnerability-database/CVE-2026-34477?utm_source=Jetbrains) 4.0 Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)

Provides transitive vulnerable dependency maven:commons-io:commons-io:2.13.0 * [CVE-2024-47554](https://www.mend.io/vulnerability-database/CVE-2024-47554?utm_source=Jetbrains) 4.3 Uncontrolled Resource Consumption ('Resource Exhaustion') Results powered by [Mend.io](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains)