Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.21 to 0.0.22 by dependabot[bot] · Pull Request #1090 · project-ncl/deliverables-analyzer

dependabot · 2026-08-07T08:02:36Z

Bumps project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.21 to 0.0.22.

Release notes

Sourced from project-ncl/shared-github-actions/.github/workflows/maven-release.yml's releases.

v0.0.22

What's Changed

🐛 Fixes / 🚀 Enhancements

Increase SCA log max length in GH comment and change tail->head by @patrikk0123 in project-ncl/shared-github-actions#89

Add option to exclude Gradle configurations in Mend SCA scan (action) by @patrikk0123 in project-ncl/shared-github-actions#97

Add option to exclude Gradle configurations in Mend SCA scan (workflow) by @patrikk0123 in project-ncl/shared-github-actions#98

SBT snapshot changes by @patrikk0123 in project-ncl/shared-github-actions#95

👒 CI Dependencies

Bump project-ncl/shared-github-actions/.github/actions/maven-build from 0.0.19 to 0.0.20 by @dependabot[bot] in project-ncl/shared-github-actions#86

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.19 to 0.0.20 by @dependabot[bot] in project-ncl/shared-github-actions#88

Bump actions/setup-java from 5.3.0 to 5.4.0 by @dependabot[bot] in project-ncl/shared-github-actions#85

Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in project-ncl/shared-github-actions#84

Bump raven-actions/actionlint from 2.1.2 to 2.2.0 by @dependabot[bot] in project-ncl/shared-github-actions#87

Bump project-ncl/shared-github-actions/.github/actions/npm-build from 0.0.20 to 0.0.21 by @dependabot[bot] in project-ncl/shared-github-actions#94

Bump project-ncl/shared-github-actions/.github/actions/gradle-build from 0.0.20 to 0.0.21 by @dependabot[bot] in project-ncl/shared-github-actions#92

Bump project-ncl/shared-github-actions/.github/actions/maven-build from 0.0.20 to 0.0.21 by @dependabot[bot] in project-ncl/shared-github-actions#90

Bump project-ncl/shared-github-actions/.github/actions/mend from 0.0.20 to 0.0.21 by @dependabot[bot] in project-ncl/shared-github-actions#93

Bump project-ncl/shared-github-actions/.github/actions/sbt-build from 0.0.20 to 0.0.21 by @dependabot[bot] in project-ncl/shared-github-actions#91

Bump actions/setup-java from 5.4.0 to 5.6.0 by @dependabot[bot] in project-ncl/shared-github-actions#100

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in project-ncl/shared-github-actions#101

Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in project-ncl/shared-github-actions#102

Full Changelog: project-ncl/shared-github-actions@v0.0.21...v0.0.22

Commits

a27e6fb Make SBT snapshot workflow generic in realm/host params
4247291 Rename SBT Sonatype Snapshots to new URL
813d47a Add option to exclude Gradle configurations in Mend SCA scan (workflow)
95399e1 Merge pull request #102 from project-ncl/dependabot/github_actions/zizmorcore...
b5e2bca Merge pull request #101 from project-ncl/dependabot/github_actions/actions/ch...
ee64012 Merge pull request #100 from project-ncl/dependabot/github_actions/actions/se...
2077576 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1
5d071e8 Bump actions/checkout from 7.0.0 to 7.0.1
03754d4 Bump actions/setup-java from 5.4.0 to 5.6.0
7a159ca Add option to exclude Gradle configurations in Mend SCA scan (action)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…e.yml Bumps [project-ncl/shared-github-actions/.github/workflows/maven-release.yml](https://github.com/project-ncl/shared-github-actions) from 0.0.21 to 0.0.22. - [Release notes](https://github.com/project-ncl/shared-github-actions/releases) - [Commits](project-ncl/shared-github-actions@0fd979f...a27e6fb) --- updated-dependencies: - dependency-name: project-ncl/shared-github-actions/.github/workflows/maven-release.yml dependency-version: 0.0.22 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-07T08:07:38Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output

.jar [1 MEDIUM]
	|-- quarkus-netty-3.37.0.jar
		|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
			|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 4 MEDIUM]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 4 MEDIUM]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
		|-- netty-handler-4.1.135.Final.jar
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
	|-- protostream-types-6.0.7.jar
		|-- protostream-6.0.7.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- infinispan-client-hotrod-16.0.13.jar
		|-- micrometer-core-1.16.6.jar
			|-- httpclient5-5.6.2.jar [1 MEDIUM]
		|-- netty-resolver-dns-4.1.135.Final.jar
			|-- netty-codec-dns-4.1.135.Final.jar
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- wildfly-elytron-ssh-util-2.9.1.Final.jar
		|-- sshd-common-2.17.1.jar [1 HIGH]
|-- quarkus-micrometer-opentelemetry-3.37.0.jar
	|-- opentelemetry-micrometer-1.5-2.26.1-alpha.jar
		|-- opentelemetry-instrumentation-api-2.26.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
	|-- quarkus-micrometer-3.37.0.jar
		|-- lz4-java-1.10.1.jar [1 MEDIUM]
		|-- quarkus-vertx-http-3.37.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- smallrye-mutiny-vertx-web-3.22.2.jar
				|-- smallrye-mutiny-vertx-uri-template-3.22.2.jar
					|-- vertx-uri-template-4.5.28.jar
						|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-web-4.5.28.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- vertx-auth-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-bridge-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-web-common-4.5.28.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- kafka-clients-4.2.1.jar
			|-- lz4-java-1.10.1.jar [1 MEDIUM]
	|-- quarkus-opentelemetry-3.37.0.jar
		|-- opentelemetry-instrumentation-annotations-support-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-instrumentation-annotations-2.26.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-jdbc-2.26.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-runtime-telemetry-java17-2.26.1-alpha.jar
			|-- opentelemetry-runtime-telemetry-2.26.1-alpha.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-api-incubator-1.60.1-alpha.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-exporter-otlp-common-1.60.1.jar
			|-- opentelemetry-exporter-common-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- opentelemetry-sdk-1.60.1.jar
			|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-common-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-logs-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-metrics-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
			|-- opentelemetry-sdk-trace-1.60.1.jar
				|-- opentelemetry-api-1.60.1.jar [1 MEDIUM]
		|-- quarkus-grpc-common-3.37.0.jar
			|-- vertx-grpc-server-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-4.5.28.jar
				|-- grpc-netty-1.81.0.jar
					|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- quarkus-tls-registry-3.37.0.jar
			|-- smallrye-private-key-pem-parser-0.9.3.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- quarkus-vertx-3.37.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-codec-4.1.135.Final.jar [1 HIGH]
			|-- quarkus-virtual-threads-3.37.0.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- smallrye-mutiny-vertx-core-3.22.2.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- smallrye-mutiny-vertx-runtime-3.22.2.jar
					|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- smallrye-fault-tolerance-vertx-6.11.1.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
		|-- smallrye-common-vertx-context-2.18.1.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
				|-- netty-codec-haproxy-4.1.135.Final.jar [1 HIGH, 1 MEDIUM]
				|-- netty-codec-http2-4.1.135.Final.jar [2 HIGH]
				|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 4 MEDIUM]
				|-- netty-handler-proxy-4.1.135.Final.jar
					|-- netty-codec-http-4.1.135.Final.jar [3 HIGH, 4 MEDIUM]
					|-- netty-codec-socks-4.1.135.Final.jar
						|-- netty-codec-4.1.135.Final.jar [1 HIGH]
					|-- netty-codec-4.1.135.Final.jar [1 HIGH]
		|-- vertx-grpc-client-4.5.28.jar
			|-- vertx-core-4.5.28.jar [1 HIGH]
			|-- vertx-grpc-common-4.5.28.jar
				|-- vertx-core-4.5.28.jar [1 HIGH]
|-- quarkus-logging-kafka-deployment-3.0.5.jar
	|-- quarkus-arc-deployment-3.37.0.jar
		|-- quarkus-core-deployment-3.37.0.jar
			|-- readline-2.6.jar
				|-- jansi-2.4.0.jar [1 LOW]
|-- pnc-api-3.5.2-jakarta.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
quarkus-logging-kafka-deployment-3.0.5.jar
|-- quarkus-arc-deployment-3.37.0.jar
	|-- quarkus-core-deployment-3.37.0.jar
		|-- readline-2.6.jar
			|-- jansi-2.4.0.jar [1 LOW]
quarkus-logging-kafka-3.0.5.jar
|-- kafka-log4j-appender-3.9.2.jar
	|-- kafka-clients-4.2.1.jar
		|-- lz4-java-1.10.1.jar [1 MEDIUM]


No Policy violations were detected

Project 'deliverables-analyzer' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=f9100ed5-9f0a-4cf7-98d1-d6841291f0d8
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=d013cb534561419399ab0e3bf6b2334928fb7ad32d124df395424cbc3112ec72

Mend AI scan succeeded.

Support Token: 1b444f3d1887243ea9979c35d71b22a661786089998404

SAST scan output

*no findings*

Full logs and artifacts

dependabot · 2026-08-10T07:49:46Z

Looks like project-ncl/shared-github-actions/.github/workflows/maven-release.yml is up-to-date now, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Aug 7, 2026

github-advanced-security Bot found potential problems Aug 7, 2026

View reviewed changes

Comment thread .github/workflows/maven-release.yml Dismissed

dependabot Bot closed this Aug 10, 2026

dependabot Bot deleted the dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-release.yml-0.0.22 branch August 10, 2026 07:49

Navigation Menu

Uh oh!

Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.21 to 0.0.22 - #1090

Bump project-ncl/shared-github-actions/.github/workflows/maven-release.yml from 0.0.21 to 0.0.22#1090
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/project-ncl/shared-github-actions/dot-github/workflows/maven-release.yml-0.0.22

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.0.22

What's Changed

🐛 Fixes / 🚀 Enhancements

👒 CI Dependencies

Uh oh!

Uh oh!

github-actions Bot commented Aug 7, 2026

Mend Scan Results

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading