Summary
22 open, high-severity Dependabot alerts against transitive Maven dependencies (none of the affected packages are declared directly — manifest_path on every alert is the umbrella settings.gradle.kts). They collapse into 8 packages needing a version bump.
Packages and target versions
| Package |
Alert #s |
Fixed in |
io.netty:netty-handler |
#106, #103, #102, #10 |
4.1.136.Final |
io.netty:netty-codec-http2 |
#118, #101, #92, #14, #4 |
4.1.136.Final |
io.netty:netty-codec-http |
#111, #110, #109, #100, #98, #91 |
4.1.136.Final |
io.netty:netty-codec |
#116, #97 |
4.1.136.Final |
com.fasterxml.jackson.core:jackson-core |
#80 |
2.18.8 (aligning to 2.22.1, already used for jackson-databind) |
com.fasterxml.jackson.core:jackson-databind |
#73, #72 |
2.18.8 (aligning to 2.22.1) |
org.bitbucket.b_c:jose4j |
#27 |
0.9.6 |
org.jdom:jdom2 |
#17 |
2.0.6.1 |
CVEs / GHSAs
Plan
All affected packages are transitive-only, so the fix adds a new sk.ainet.maven-pins build-logic convention plugin (mirroring the existing sk.ainet.npm-pins mechanism used for Yarn) that force-pins exact Maven coordinates via skainet { mavenPins { pin(...) } }, verified by a verifyMavenPins task wired into check.
Summary
22 open, high-severity Dependabot alerts against transitive Maven dependencies (none of the affected packages are declared directly —
manifest_pathon every alert is the umbrellasettings.gradle.kts). They collapse into 8 packages needing a version bump.Packages and target versions
io.netty:netty-handlerio.netty:netty-codec-http2io.netty:netty-codec-httpio.netty:netty-codeccom.fasterxml.jackson.core:jackson-corecom.fasterxml.jackson.core:jackson-databindorg.bitbucket.b_c:jose4jorg.jdom:jdom2CVEs / GHSAs
Plan
All affected packages are transitive-only, so the fix adds a new
sk.ainet.maven-pinsbuild-logic convention plugin (mirroring the existingsk.ainet.npm-pinsmechanism used for Yarn) that force-pins exact Maven coordinates viaskainet { mavenPins { pin(...) } }, verified by averifyMavenPinstask wired intocheck.