Skip to content

Bump the gha group with 2 updates - #27

Merged
thc202 merged 1 commit into
mainfrom
dependabot/github_actions/gha-390c89e95a
Sep 1, 2026
Merged

Bump the gha group with 2 updates#27
thc202 merged 1 commit into
mainfrom
dependabot/github_actions/gha-390c89e95a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the gha group with 2 updates: actions/setup-java and gradle/actions/setup-gradle.

Updates actions/setup-java from 5 to 6

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits

Updates gradle/actions/setup-gradle from 6.2.0 to 6.3.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

  • Cache entries failed to store at all on Windows.. Every entry failed with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of @actions/glob combined with a silently swallowed require() in the bundle, which left Windows path separators unnormalized.

  • Cache cleanup deleted instrumented jars that were in use. A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created caches/jars-9 entries as unused and remove them, so the instrumented-jars entry was never saved and every job re-instrumented its classpaths.

    Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT] Existing cache entries are invalidated by this release. The cache protocol version was bumped to v2, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports (Entry not saved: save failed) in the Job Summary when a cache save fails, rather than reporting success (#1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (#1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

  • Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
  • 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

... (truncated)

Commits
  • 9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
  • 760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
  • 73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
  • a9d1438 Add dependabot ignore rules for TypeScript 7.x and @​types/node 25.x/26.x
  • 68f3700 [bot] Update dist directory
  • 5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
  • b5bc804 [bot] Update dist directory
  • dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and secu...
  • ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
  • 4318659 [bot] Update dist directory
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the gha group with 2 updates
c26e92a 
Bumps the gha group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [gradle/actions/setup-gradle](https://github.com/gradle/actions).


Updates `actions/setup-java` from 5 to 6
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5...v6)

Updates `gradle/actions/setup-gradle` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@3f131e8...9c97196)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@psiinon

psiinon commented Sep 1, 2026

Copy link
Copy Markdown
Member

Logo
Checkmarx One – Scan Summary & Details – b816f1ab-e2a0-4d0a-b3f2-6d8ce2b538b1

New Issues (24)

High: 6 · Medium: 18

Checkmarx found the following issues in this Pull Request

# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2025-48734 Maven-commons-beanutils:commons-beanutils-1.9.4
detailsRecommended version: 1.11.0
Description: An Improper Access Control vulnerability exists in Apache Commons. A special "BeanIntrospector" class was added in version 1.9.2. This can be used ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2026-54512 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.21.4
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 prior to 2.18.8, 2....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
3 HIGH CVE-2026-54513 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.19.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.10.0 prior to 2.1...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
4 HIGH Cx2c9af752-2171 Maven-com.fasterxml.jackson.core:jackson-core-2.19.1
detailsRecommended version: 2.21.4
Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH Cx78f40514-81ff Maven-commons-collections:commons-collections-3.2.2
detailsDescription: The framework Apache Commons Collections before 4.3 is vulnerable to Stack Overflow. The function `add()` in the file `SetUniqueList.java` throws a...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.19.1
detailsRecommended version: 2.21.4
Description: The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadCon...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 MEDIUM CVE-2012-5783 Maven-commons-httpclient:commons-httpclient-3.1
detailsDescription: Apache Commons HttpClient prior to 4.0-alpha1, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not ver...
Attack Vector: NETWORK
Attack Complexity: MEDIUM
Vulnerable Package
8 MEDIUM CVE-2012-6153 Maven-commons-httpclient:commons-httpclient-3.1
detailsDescription: http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain na...
Attack Vector: NETWORK
Attack Complexity: MEDIUM
Vulnerable Package
9 MEDIUM CVE-2020-13956 Maven-commons-httpclient:commons-httpclient-3.1
detailsDescription: Apache HttpClient can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong ta...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
10 MEDIUM CVE-2022-27820 Maven-org.zaproxy:zap-2.16.0
detailsDescription: OWASP Zed Attack Proxy (ZAP) does not verify the TLS certificate chain of an HTTPS server.
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
11 MEDIUM CVE-2025-46392 Maven-commons-configuration:commons-configuration-1.10
detailsDescription: Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration versions 1.x. There are a number of issues in Apache Commons Confi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
12 MEDIUM CVE-2025-48924 Maven-commons-lang:commons-lang-2.6
detailsDescription: Uncontrolled Recursion vulnerability in Apache Commons Lang. The methods `ClassUtils.getClass(...)` can `throwStackOverflowError` on very long inpu...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
13 MEDIUM CVE-2025-48924 Maven-org.apache.commons:commons-lang3-3.17.0
detailsRecommended version: 3.18.0
Description: Uncontrolled Recursion vulnerability in Apache Commons Lang. The methods `ClassUtils.getClass(...)` can `throwStackOverflowError` on very long inpu...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
14 MEDIUM CVE-2025-68161 Maven-org.apache.logging.log4j:log4j-core-2.24.2
detailsRecommended version: 2.25.2.redhat-00002
Description: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
15 MEDIUM CVE-2026-34477 Maven-org.apache.logging.log4j:log4j-core-2.24.2
detailsRecommended version: 2.25.4
Description: The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the "log4j2.sslVerifyHostName" system property,...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
16 MEDIUM CVE-2026-34478 Maven-org.apache.logging.log4j:log4j-core-2.24.2
detailsRecommended version: 2.25.4
Description: Apache Log4j Core's Rfc5424Layout https://logging\.apache\.org/log4j/2\.x/manual/layouts\.html\#RFC5424Layout , in versions 2.21.0 through 2.25.3, and ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
17 MEDIUM CVE-2026-34479 Maven-org.apache.logging.log4j:log4j-1.2-api-2.24.2
detailsRecommended version: 2.25.4
Description: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
18 MEDIUM CVE-2026-34480 Maven-org.apache.logging.log4j:log4j-core-2.24.2
detailsRecommended version: 2.25.4
Description: Apache Log4j Core's XmlLayout https://logging\.apache\.org/log4j/2\.x/manual/layouts\.html\#XmlLayout , versions through 2.25.3, and 3.x through 3.0.0-...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
19 MEDIUM CVE-2026-49844 Maven-org.apache.logging.log4j:log4j-api-2.24.2
detailsRecommended version: 2.24.3.redhat-00001
Description: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
20 MEDIUM CVE-2026-54514 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.19.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.0.0 prior to 2.18...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
21 MEDIUM CVE-2026-54515 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.19.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 prior to 2.18.9, 2.1...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
22 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.21.4
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
23 MEDIUM CVE-2026-77310 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.21.5
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.x prior to versions 2....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
24 MEDIUM CVE-2026-83557 Maven-com.fasterxml.jackson.core:jackson-databind-2.19.1
detailsRecommended version: 2.19.2.redhat-00003
Description: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configu...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@thc202
thc202 merged commit f3dab81 into main Sep 1, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/gha-390c89e95a branch September 1, 2026 19:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thc202 thc202 thc202 approved these changes
@kingthorin kingthorin kingthorin approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@psiinon @thc202 @kingthorin