fix(deps): update mend: high confidence minor and patch dependency updates - #20
Security Report
❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Exploit Maturity | EPSS | Vulnerable Library | Direct Library | Suggested Fix | Issue | Reachability |
|---|---|---|---|---|---|---|---|---|---|
CVE-2023-2976Path to dependency file: /modules/coverage-reports/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar Dependency Hierarchy: -> continuous-delivery-common-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
 Medium |
5.5 | Not Defined | 0.248% | Transitive guava-30.1.1-jre.jar |
continuous-delivery-common-99-SNAPSHOT.jar | Transitive 32.0.1-android |
None |
|
CVE-2023-2976Path to dependency file: /modules/coverage-reports/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar Dependency Hierarchy: -> sdk-core-9.17.5.jar (Root Library) -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
Medium |
5.5 | Not Defined | 0.248% | Transitive guava-30.1.1-jre.jar |
sdk-core-9.17.5.jar | Transitive 32.0.1-android |
None |
|
CVE-2023-2976Path to dependency file: /modules/coverage-reports/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar Dependency Hierarchy: -> cd-toolchain-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
Medium |
5.5 | Not Defined | 0.248% | Transitive guava-30.1.1-jre.jar |
cd-toolchain-99-SNAPSHOT.jar | Transitive 32.0.1-android |
None |
|
CVE-2025-48924Path to dependency file: /modules/cd-tekton-pipeline/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar Dependency Hierarchy: -> continuous-delivery-common-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ commons-lang3-3.8.1.jar (Vulnerable Library) |
Medium |
5.3 | Not Defined | 2.164% | Transitive commons-lang3-3.8.1.jar |
continuous-delivery-common-99-SNAPSHOT.jar | Transitive 3.18.0 |
None |
|
CVE-2025-48924Path to dependency file: /modules/cd-tekton-pipeline/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar Dependency Hierarchy: -> sdk-core-9.17.5.jar (Root Library) -> ❌ commons-lang3-3.8.1.jar (Vulnerable Library) |
Medium |
5.3 | Not Defined | 2.164% | Transitive commons-lang3-3.8.1.jar |
sdk-core-9.17.5.jar | Transitive 3.18.0 |
None |
|
CVE-2025-48924Path to dependency file: /modules/cd-tekton-pipeline/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar Dependency Hierarchy: -> cd-toolchain-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ commons-lang3-3.8.1.jar (Vulnerable Library) |
Medium |
5.3 | Not Defined | 2.164% | Transitive commons-lang3-3.8.1.jar |
cd-toolchain-99-SNAPSHOT.jar | Transitive 3.18.0 |
None |
|
CVE-2020-8908Path to dependency file: /modules/coverage-reports/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar Dependency Hierarchy: -> continuous-delivery-common-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
 Low |
3.3 | Not Defined | 0.964% | Transitive guava-30.1.1-jre.jar |
continuous-delivery-common-99-SNAPSHOT.jar | Transitive 32.0.0-android |
None |
|
CVE-2020-8908Path to dependency file: /modules/coverage-reports/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar Dependency Hierarchy: -> sdk-core-9.17.5.jar (Root Library) -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
Low |
3.3 | Not Defined | 0.964% | Transitive guava-30.1.1-jre.jar |
sdk-core-9.17.5.jar | Transitive 32.0.0-android |
None |
|
CVE-2020-8908Path to dependency file: /modules/coverage-reports/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar,/home/wss-scanner/.m2/repository/com/google/guava/guava/30.1.1-jre/guava-30.1.1-jre.jar Dependency Hierarchy: -> cd-toolchain-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
Low |
3.3 | Not Defined | 0.964% | Transitive guava-30.1.1-jre.jar |
cd-toolchain-99-SNAPSHOT.jar | Transitive 32.0.0-android |
None |
|
CVE-2024-47554Path to dependency file: /modules/cd-tekton-pipeline/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar Dependency Hierarchy: -> continuous-delivery-common-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ commons-io-2.7.jar (Vulnerable Library) |
Medium |
4.3 | Not Defined | 1.241% | Transitive commons-io-2.7.jar |
continuous-delivery-common-99-SNAPSHOT.jar | Transitive 2.14.0 |
None |
|
CVE-2024-47554Path to dependency file: /modules/cd-tekton-pipeline/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar Dependency Hierarchy: -> sdk-core-9.17.5.jar (Root Library) -> ❌ commons-io-2.7.jar (Vulnerable Library) |
Medium |
4.3 | Not Defined | 1.241% | Transitive commons-io-2.7.jar |
sdk-core-9.17.5.jar | Transitive 2.14.0 |
None |
|
CVE-2024-47554Path to dependency file: /modules/cd-tekton-pipeline/pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar,/home/wss-scanner/.m2/repository/commons-io/commons-io/2.7/commons-io-2.7.jar Dependency Hierarchy: -> cd-toolchain-99-SNAPSHOT.jar (Root Library) -> sdk-core-9.17.5.jar -> ❌ commons-io-2.7.jar (Vulnerable Library) |
Medium |
4.3 | Not Defined | 1.241% | Transitive commons-io-2.7.jar |
cd-toolchain-99-SNAPSHOT.jar | Transitive 2.14.0 |
None |
|
Base branch total remaining vulnerabilities: 0
Base branch commit: null
Total libraries scanned: 29
Scan token: bfa15babbef34f1d8d134046c729d208