Bump org.jsoup:jsoup from 1.23.2 to 1.24.1 by dependabot[bot] · Pull Request #533 · Commonjava/galley

dependabot · 2026-11-11T15:14:25Z

Bumps org.jsoup:jsoup from 1.23.2 to 1.24.1.

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.24.1

jsoup 1.24.1 is out now, with major improvements to CSS selectors and HTML parsing.

This release introduces an opt-in Web query mode, bringing selector behavior closer to CSS and browser DOM standards. It also adds new selectors and improves the correctness and performance of :has() queries. Web mode will become the default in 1.25.1; the selector migration guide explains how to get ready.

HTML parsing is now more closely aligned with the current HTML standard, including improvements to tables, formatting elements, templates, and customizable select elements. This release also adds processing instruction support, and includes a number of performance improvements and bug fixes.

There are some changes to existing behavior, including :root matching and limits on Response.bodyStream(). Please make sure to review the changes below before upgrading.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

Added an opt-in Web query mode to align jsoup's selectors with CSS and Web DOM standards. See the selector migration guide for more details. #2642

Enable with System.setProperty("jsoup.queryMode", "web"). Queries return matching descendants only, can match surrounding ancestors, and follow HTML/XML case rules. Attribute ~= matches whitespace separated tokens instead of regexes.

You can jsoup.queryMode=check to help prepare for Web mode. Selectors return legacy results and print differences to stderr, with caller locations to help identify affected code.

Added :scope, :matchesAttr(name, regex), |= attribute matching, and attribute case flags i and s. These work in both legacy and Web modes, so queries can be updated before switching modes.

Web mode will become the default in 1.25.1 and the only mode in 1.26.1.

Added support for parsing processing instructions in HTML and XML, as ProcessingInstruction nodes. This supports marker nodes such as <?marker name="country-options"?>, matched by \<template for="country-options"> in the HTML Standard's new declarative streaming syntax. Processing instructions can be selected with ::pi or ::pi(target), and their data can be read and changed through the node's attribute methods. Change: when using the XML parser, ordinary <?target ...?> nodes are now represented by ProcessingInstruction instead of XmlDeclaration; the <?xml ...?> declaration remains an XmlDeclaration. #2613

Added Parser.parseAttributes(String) to parse an attribute fragment using that parser's settings.

:has() selectors with child and sibling combinators now run faster by limiting the search to the parts of the document where they can match. This particularly improves selectors such as :has(> a), :has(+ dd), and :has(+ div span). #2610

SVG-specific tag and attribute names are now automatically case corrected (e.g. pathlength becomes pathLength) when parsing HTML. #2630

Improved the HTML parse across document boundaries by handling whitespace separately from subsequent text. This better preserves the input's whitespace through parse and serialize round-trips. #2632

Improved HTML parsing performance for documents with misplaced elements, and DOM update performance. #2646

Changes

Removed APIs previously deprecated and scheduled for removal in 1.24.1. #2597

Response.bodyStream() now observes the configured max body size and request timeout, consistent with the other response body methods. The default max size is 2 MB. You can configure that with maxBodySize(0) before executing the request to disable the cap. Response.isTruncated() reports when the decoded response content exceeded the configured limit. #2598

Query selector parsing now limits each query to 128 structural steps, counting combinators, node selectors, and :has(), :is(), and :not() expressions together. More complex queries throw SelectorParseException during parsing.

Attributes.equals() and hashCode() now exclude internal attributes, such as source ranges and user data. #2633

Bug Fixes

Corrected :root to match the tree's root element in both query modes. Previously, it matched the element the query was called on. Use :scope to refer to that element.

Standardized parser normalization of tag and attribute names so that HTML comparisons use ASCII-only case folding, and accepted control characters are preserved, aligning name handling to the HTML and XML specs. #2594

Named character references without a semicolon before - or _ now decode correctly in attribute values, matching HTML and browser behavior (e.g., &copy- becomes ©-). #2588

Support downloads > 2GB via Response.bodyStream() when maxBodySize(0) is configured. #2593

Updated table and table-fragment parsing to place misnested content correctly per the HTML5 spec. For example, <table><b><p>X</b> places the paragraph before the table. #2601

StreamParser now preserves its progress if you use the same Parser to parse another document, or call Element.append(String) on a streamed element. Previously, these operations replaced the active parse state and prevented streaming from continuing correctly. #2605

Updated the adoption-agency algorithm to match the current HTML5 spec and to preserve formatting order when recovering misnested elements. #2604

:has() now correctly matches sibling alternatives and descendants of siblings. Given <div id=a></div><div><span></span></div>, both #a:has(+ div, > span) and #a:has(+ div span) select #a. #2610

Within node selectors, :not() now correctly applies :contains() and :matches() to the node value. For example, ::comment:not(:contains(foo)) excludes comments containing foo. #2610

Updated <select> parsing to the current HTML spec, retaining elements such as buttons and other markup that the previous rules discarded. #2611

Template parsing now closes unclosed templates at EOF and handles forms correctly in template documents and fragments. #2614

Fixed handling of null characters and initial newlines in HTML to better match the HTML spec, including pre, listing, and textarea elements. Leading newlines in these elements' text are preserved when saving and reparsing HTML. #2616

Fixed several HTML parsing edge cases across malformed doctypes, misplaced text in tables, and whitespace in framesets to match the HTML spec. #2618

If a HTML void element ends up with children (via DOM manipulation), those are no longer serialized in html(). #2619

Fixed a ConcurrentModificationException when emptying and reading separate childless elements concurrently. #2620

Removed the old command, device, and menuitem tags, as they are no longer in the HTML spec. #2621

Double-escaped script tags in body were being closed too early. #2627

... (truncated)

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.24.1 (2026-Nov-03)

Improvements

Added an opt-in Web query mode to align jsoup's selectors with CSS and Web DOM standards. See the selector migration guide for more details. #2642

Enable with System.setProperty("jsoup.queryMode", "web"). Queries return matching descendants only, can match surrounding ancestors, and follow HTML/XML case rules. Attribute ~= matches whitespace separated tokens instead of regexes.

You can jsoup.queryMode=check to help prepare for Web mode. Selectors return legacy results and print differences to stderr, with caller locations to help identify affected code.

Added :scope, :matchesAttr(name, regex), |= attribute matching, and attribute case flags i and s. These work in both legacy and Web modes, so queries can be updated before switching modes.

Web mode will become the default in 1.25.1 and the only mode in 1.26.1.

Added support for parsing processing instructions in HTML and XML, as ProcessingInstruction nodes. This supports marker nodes such as <?marker name="country-options"?>, matched by \<template for="country-options"> in the HTML Standard's new declarative streaming syntax. Processing instructions can be selected with ::pi or ::pi(target), and their data can be read and changed through the node's attribute methods. Change: when using the XML parser, ordinary <?target ...?> nodes are now represented by ProcessingInstruction instead of XmlDeclaration; the <?xml ...?> declaration remains an XmlDeclaration. #2613

Added Parser.parseAttributes(String) to parse an attribute fragment using that parser's settings.

:has() selectors with child and sibling combinators now run faster by limiting the search to the parts of the document where they can match. This particularly improves selectors such as :has(> a), :has(+ dd), and :has(+ div span). #2610

SVG-specific tag and attribute names are now automatically case corrected (e.g. pathlength becomes pathLength) when parsing HTML. #2630

Improved the HTML parse across document boundaries by handling whitespace separately from subsequent text. This better preserves the input's whitespace through parse and serialize round-trips. #2632

Improved HTML parsing performance for documents with misplaced elements, and DOM update performance. #2646

Changes

Removed APIs previously deprecated and scheduled for removal in 1.24.1. #2597

Response.bodyStream() now observes the configured max body size and request timeout, consistent with the other response body methods. The default max size is 2 MB. You can configure that with maxBodySize(0) before executing the request to disable the cap. Response.isTruncated() reports when the decoded response content exceeded the configured limit. #2598

Query selector parsing now limits each query to 128 structural steps, counting combinators, node selectors, and :has(), :is(), and :not() expressions together. More complex queries throw SelectorParseException during parsing.

Attributes.equals() and hashCode() now exclude internal attributes, such as source ranges and user data. #2633

Bug Fixes

Corrected :root to match the tree's root element in both query modes. Previously, it matched the element the query was called on. Use :scope to refer to that element.

Standardized parser normalization of tag and attribute names so that HTML comparisons use ASCII-only case folding, and accepted control characters are preserved, aligning name handling to the HTML and XML specs. #2594

Named character references without a semicolon before - or _ now decode correctly in attribute values, matching HTML and browser behavior (e.g., &copy- becomes ©-). #2588

Support downloads > 2GB via Response.bodyStream() when maxBodySize(0) is configured. #2593

Updated table and table-fragment parsing to place misnested content correctly per the HTML5 spec. For example, <table><b><p>X</b> places the paragraph before the table. #2601

StreamParser now preserves its progress if you use the same Parser to parse another document, or call Element.append(String) on a streamed element. Previously, these operations replaced the active parse state and prevented streaming from continuing correctly. #2605

Updated the adoption-agency algorithm to match the current HTML5 spec and to preserve formatting order when recovering misnested elements. #2604

:has() now correctly matches sibling alternatives and descendants of siblings. Given <div id=a></div><div><span></span></div>, both #a:has(+ div, > span) and #a:has(+ div span) select #a. #2610

Within node selectors, :not() now correctly applies :contains() and :matches() to the node value. For example, ::comment:not(:contains(foo)) excludes comments containing foo. #2610

Updated <select> parsing to the current HTML spec, retaining elements such as buttons and other markup that the previous rules discarded. #2611

Template parsing now closes unclosed templates at EOF and handles forms correctly in template documents and fragments. #2614

Fixed handling of null characters and initial newlines in HTML to better match the HTML spec, including pre, listing, and textarea elements. Leading newlines in these elements' text are preserved when saving and reparsing HTML. #2616

Fixed several HTML parsing edge cases across malformed doctypes, misplaced text in tables, and whitespace in framesets to match the HTML spec. #2618

If a HTML void element ends up with children (via DOM manipulation), those are no longer serialized in html(). #2619

Fixed a ConcurrentModificationException when emptying and reading separate childless elements concurrently. #2620

Removed the old command, device, and menuitem tags, as they are no longer in the HTML spec. #2621

Double-escaped script tags in body were being closed too early. #2627

Node.before(Node) and Node.after(Node) now leave the document unchanged when given the node itself, instead of throwing a NullPointerException. #2628

Fixed HTML parse of <dialog>, <main>, and <search> so their start and end tags close open paragraphs correctly. #2629

Updated the parse of malformed end tags such as </ COMMENT > to match the spec (). #2631

Source position tracking no longer impacts the adoption algo when repeated HTML formatting tags are reconstructed after a paragraph closes. #2633

Fixed fragment parsing to ignore <body> and <frameset> start tags when the second open element is not body, matching the HTML spec. #2634

Updated how the tokeniser handles malformed doctypes, to remove duplicative tokens and error messages. #2635

Corrected HTML tokenisation of malformed comments such as <!---x and incomplete start tags such as <p id=, and improved their error reporting. #2636

Fixed FormElement.empty() retaining associations with removed controls. If an input node removed by empty() was subsequently inserted outside its original form, it could incorrectly reappear in that form's elements() and formData() results. #2646

Commits

5e3c284 [maven-release-plugin] prepare release jsoup-1.24.1
5d63820 Link fix
55aa51e Bump org.sonatype.central:central-publishing-maven-plugin from 0.11.0 to 0.12...
3203485 Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.3 to 0.26.5 (#2...
fdbfd44 Bump github/codeql-action from 4.38.3 to 4.39.0 (#2649)
6fedf39 Bump actions/setup-java from 6.0.1 to 6.1.0 (#2650)
0c508f1 Improve Selector javadoc
6feca03 Detach nested form controls on .empty()
e1d48ba Improve query complexity accounting
76c125d Improve exception handling when parsing selectors across buffer boundaries.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.23.2 to 1.24.1. - [Release notes](https://github.com/jhy/jsoup/releases) - [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md) - [Commits](jhy/jsoup@jsoup-1.23.2...jsoup-1.24.1) --- updated-dependencies: - dependency-name: org.jsoup:jsoup dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-11-11T15:18:51Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 113 dependencies

Detected 31 vulnerabilities (1 Critical, 10 High, 16 Medium, 4 Low)

+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |           LIBRARY           |       ID        |                                               TOP FIX                                                |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | jackson-databind-2.22.2.jar | CVE-2026-110879 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.12,    |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.22.4,                                                  |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.21.8,                                                  |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.4,                          |
|          |                             |                 | tools.jackson.core:jackson-databind:3.1.8,com.fasterxml.jackson.core:jackson-databind:2.18.12,       |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.8,                         |
|          |                             |                 | tools.jackson.core:jackson-databind:3.2.4, https://github.com/FasterXML/jackson-databind.git -       |
|          |                             |                 | jackson-databind-3.1.8, https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.4  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.85.jar     | CVE-2026-71888  | Upgrade to version org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,  |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                   |
|          |                             |                 | org.bouncycastle:bcpkix-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv86,                 |
|          |                             |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,      |
|          |                             |                 | org.bouncycastle:bcpkix-fips:1.0.13,org.bouncycastle:bcpkix-fips:2.0.13,                             |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.1.13                                                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.85.jar     | CVE-2026-71889  | Upgrade to version org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-lts8on:2.73.13,    |
|          |                             |                 | org.bouncycastle:bcprov-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,             |
|          |                             |                 | org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86,org.bouncycastle:bcprov-jdk15to18:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13 |
|          |                             |                 | , https://github.com/bcgit/bc-java.git - r1rv86,org.bouncycastle:bcpkix-fips:1.0.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.85.jar     | CVE-2026-71889  | Upgrade to version org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-lts8on:2.73.13,    |
|          |                             |                 | org.bouncycastle:bcprov-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,             |
|          |                             |                 | org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86,org.bouncycastle:bcprov-jdk15to18:1.86,                     |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13 |
|          |                             |                 | , https://github.com/bcgit/bc-java.git - r1rv86,org.bouncycastle:bcpkix-fips:1.0.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | commons-codec-1.22.1.jar    | CVE-2026-119078 | Upgrade to version commons-codec:commons-codec:1.23.0, https://github.com/apache/commons-codec.git - |
|          |                             |                 | rel/commons-codec-1.23.0                                                                             |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | guava-19.0.jar              | CVE-2026-102554 | Upgrade to version com.google.guava:guava:33.7.2, https://github.com/google/guava.git - v33.7.2,     |
|          |                             |                 | com.google.guava:guava:33.7.2-jre                                                                    |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.2.jar     | CVE-2026-89407  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.18.11,                                  |
|          |                             |                 | com.fasterxml.jackson.core:jackson-core:2.21.7,com.fasterxml.jackson.core:jackson-core:2.22.3,       |
|          |                             |                 | tools.jackson.core:jackson-core:3.1.7, https://github.com/FasterXML/jackson-core.git -               |
|          |                             |                 | jackson-core-2.22.3, https://github.com/FasterXML/jackson-core.git - jackson-core-3.2.2,             |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7,                                  |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.2.jar     | CVE-2026-89425  | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.18.11,                                  |
|          |                             |                 | com.fasterxml.jackson.core:jackson-core:2.21.7,com.fasterxml.jackson.core:jackson-core:2.22.3,       |
|          |                             |                 | tools.jackson.core:jackson-core:3.1.7, https://github.com/FasterXML/jackson-core.git -               |
|          |                             |                 | jackson-core-3.2.3, https://github.com/FasterXML/jackson-core.git - jackson-core-2.22.3,             |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7,                                 |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                             |                 | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7                                   |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.2.jar | CVE-2026-91776  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.11,                              |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.21.7,tools.jackson.core:jackson-databind:3.1.7,        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7,                          |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3                           |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.2.jar | CVE-2026-91777  | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.18.11,                              |
|          |                             |                 | com.fasterxml.jackson.core:jackson-databind:2.21.7,tools.jackson.core:jackson-databind:3.1.7,        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3,                          |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                             |                 | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7                           |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | logback-classic-1.6.3.jar   | CVE-2026-104721 | Upgrade to version ch.qos.logback:logback-classic:1.6.5, https://github.com/qos-ch/logback.git -     |
|          |                             |                 | v_1.6.5                                                                                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110257 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110258 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110260 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110261 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-5.0.4.jar               | CVE-2026-110263 | Upgrade to version org.ow2.asm:asm:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11               |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-analysis-5.0.3.jar      | CVE-2026-110591 | Upgrade to version org.ow2.asm:asm-analysis:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11      |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | asm-commons-5.0.3.jar       | CVE-2026-110270 | Upgrade to version org.ow2.asm:asm-commons:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11       |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.85.jar     | CVE-2026-17508  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,  |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,    |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcprov-jdk14:1.86,                           |
|          |                             |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-java.git - r1rv86,               |
|          |                             |                 | org.bouncycastle:bcprov-jdk15to18:1.86,org.bouncycastle:bcprov-debug-lts8on:2.73.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-lts8on:2.73.13,org.bouncycastle:bcprov-debug-jdk18on:1.86,                   |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,           |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.85.jar     | CVE-2026-71892  | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.13,org.bouncycastle:bcpkix-jdk14:1.86,        |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,      |
|          |                             |                 | org.bouncycastle:bcpkix-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,                   |
|          |                             |                 | org.bouncycastle:bcpkix-debug-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv86,           |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-17508  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,  |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk14:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,    |
|          |                             |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcprov-jdk14:1.86,                           |
|          |                             |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-java.git - r1rv86,               |
|          |                             |                 | org.bouncycastle:bcprov-jdk15to18:1.86,org.bouncycastle:bcprov-debug-lts8on:2.73.13,                 |
|          |                             |                 | org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                             |                 | org.bouncycastle:bcprov-lts8on:2.73.13,org.bouncycastle:bcprov-debug-jdk18on:1.86,                   |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,           |
|          |                             |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-18036  | Upgrade to version org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcprov-jdk18on:1.85.2 |
|          |                             |                 | , https://github.com/bcgit/bc-java.git - r1rv85v2,org.bouncycastle:bcprov-debug-jdk14:1.86,          |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcprov-jdk14:1.85.2,                   |
|          |                             |                 | org.bouncycastle:bcprov-jdk15to18:1.85.2                                                             |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-18040  | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85.2,org.bouncycastle:bcprov-debug-jdk14:1.86 |
|          |                             |                 | ,org.bouncycastle:bcprov-debug-jdk15to18:1.86,org.bouncycastle:bcprov-jdk18on:1.85.2,                |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv85v2,         |
|          |                             |                 | org.bouncycastle:bcprov-jdk14:1.85.2                                                                 |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-71891  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.86, https://github.com/bcgit/bc-java.git -      |
|          |                             |                 | r1rv86,org.bouncycastle:bcprov-jdk15to18:1.86,org.bouncycastle:bcprov-debug-jdk18on:1.86,            |
|          |                             |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86                                                         |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.85.jar     | CVE-2026-97873  | N/A                                                                                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | guava-19.0.jar              | CVE-2018-10237  | Upgrade to version 24.1.1-jre, 24.1.1-android                                                        |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | guava-19.0.jar              | CVE-2023-2976   | Upgrade to version com.google.guava:guava:32.0.1-android,32.0.1-jre                                  |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | asm-commons-5.0.3.jar       | CVE-2026-110262 | Upgrade to version org.ow2.asm:asm-commons:9.11, https://gitlab.ow2.org/asm/asm.git - ASM_9_11       |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | commons-codec-1.22.1.jar    | CVE-2026-124077 | Upgrade to version  https://github.com/apache/commons-codec.git - rel/commons-codec-1.23.0,          |
|          |                             |                 | commons-codec:commons-codec:1.23.0                                                                   |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | guava-19.0.jar              | CVE-2020-8908   | Upgrade to version  https://github.com/google/guava.git - v32.0.0                                    |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| LOW      | guava-19.0.jar              | CVE-2026-118042 | Upgrade to version com.google.guava:guava:33.8.0-android, https://github.com/google/guava.git -      |
|          |                             |                 | v33.8.0                                                                                              |
+----------+-----------------------------+-----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

atlas-identities-1.2.3.jar
|-- logback-classic-1.6.3.jar [1 HIGH]
galley-api-1.24-SNAPSHOT.jar
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
galley-caches-1.24-SNAPSHOT.pom
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-cache-partyline-1.24-SNAPSHOT.jar
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- partyline-2.5.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- weft-1.27.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jboss-logging-3.6.3.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-cache-path-mapped-1.24-SNAPSHOT.jar
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
				|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- commons-io-2.22.0.jar
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-core-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- weft-1.27.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- path-mapped-pathdb-datastax-3.3.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- cassandra-driver-core-3.12.1.jar
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
			|-- jnr-ffi-2.1.7.jar
				|-- asm-analysis-5.0.3.jar [1 MEDIUM]
				|-- asm-commons-5.0.3.jar [1 MEDIUM, 1 LOW]
				|-- asm-tree-5.0.3.jar
					|-- asm-5.0.4.jar [5 MEDIUM]
				|-- asm-5.0.4.jar [5 MEDIUM]
			|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
		|-- cassandra-driver-mapping-3.12.1.jar
			|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
			|-- asm-5.0.4.jar [5 MEDIUM]
		|-- path-mapped-common-3.3.jar
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- path-mapped-storage-3.3.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- netty-common-4.1.138.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- netty-handler-4.1.138.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- netty-transport-4.1.138.Final.jar
				|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- s3-2.54.14.jar
			|-- aws-core-2.54.14.jar
				|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
			|-- sdk-core-2.54.14.jar
				|-- guava-19.0.jar [1 HIGH, 2 MEDIUM, 2 LOW]
|-- galley-cache-tck-1.24-SNAPSHOT.jar
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
galley-cdi-embedder-1.24-SNAPSHOT.jar
|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- jackson-core-2.22.2.jar [2 HIGH]
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-bindings-jackson-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- weft-1.27.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-cache-partyline-1.24-SNAPSHOT.jar
	|-- partyline-2.5.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jboss-logging-3.6.3.Final.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-core-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-maven-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-relationships-api-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-transport-httpclient-1.24-SNAPSHOT.jar
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- httpclient-4.5.14.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- jhttpc-1.18.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- bcpkix-jdk18on-1.85.jar [2 HIGH, 2 MEDIUM]
			|-- bcutil-jdk18on-1.85.jar
				|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]
		|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]
galley-core-1.24-SNAPSHOT.jar
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- weft-1.27.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
galley-maven-1.24-SNAPSHOT.jar
|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- commons-io-2.22.0.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
|-- atlas-relationships-api-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-bindings-jackson-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
		|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
|-- galley-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-core-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
galley-testing-1.24-SNAPSHOT.pom
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-test-harness-api-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-test-harness-core-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-core-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-test-harness-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-test-harness-maven-1.24-SNAPSHOT.jar
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
				|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- weft-1.27.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-core-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-maven-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- atlas-relationships-api-1.2.3.jar
			|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-core-2.22.2.jar [2 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
			|-- atlas-bindings-jackson-identities-1.2.3.jar
				|-- logback-classic-1.6.3.jar [1 HIGH]
				|-- jackson-core-2.22.2.jar [2 HIGH]
				|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- galley-api-1.24-SNAPSHOT.jar
			|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- galley-test-harness-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
galley-transports-1.24-SNAPSHOT.pom
|-- atlas-identities-1.2.3.jar
	|-- logback-classic-1.6.3.jar [1 HIGH]
|-- galley-transport-filearc-1.24-SNAPSHOT.jar
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
|-- galley-transport-httpclient-1.24-SNAPSHOT.jar
	|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
		|-- jackson-core-2.22.2.jar [2 HIGH]
	|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- commons-io-2.22.0.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- httpclient-4.5.14.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- atlas-identities-1.2.3.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
			|-- jackson-databind-2.22.2.jar [1 CRITICAL, 2 HIGH]
	|-- galley-api-1.24-SNAPSHOT.jar
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
	|-- jhttpc-1.18.jar
		|-- logback-classic-1.6.3.jar [1 HIGH]
		|-- commons-codec-1.22.1.jar [1 HIGH, 1 LOW]
		|-- bcpkix-jdk18on-1.85.jar [2 HIGH, 2 MEDIUM]
			|-- bcutil-jdk18on-1.85.jar
				|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]
		|-- bcprov-jdk18on-1.85.jar [1 HIGH, 5 MEDIUM]


No Policy violations were detected

Project 'galley-pr' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=c3bf3e52-9bc5-446f-ad91-f936410980f9
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=3293e9a2b318410cb3e9cb4e2caace6d82d023dcee944edfa835841f5a97380c

Mend AI scan succeeded.

Support Token: 3b866263ab9764a2fb9b477c2c976649b1794410273521

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 11, 2026

rnc approved these changes Nov 11, 2026

View reviewed changes

rnc merged commit f9a9325 into master Nov 11, 2026
3 checks passed

dependabot Bot deleted the dependabot/maven/org.jsoup-jsoup-1.24.1 branch November 11, 2026 15:23

Navigation Menu

Repository navigation

Bump org.jsoup:jsoup from 1.23.2 to 1.24.1 - #533

Bump org.jsoup:jsoup from 1.23.2 to 1.24.1#533
rnc merged 1 commit into
masterfrom
dependabot/maven/org.jsoup-jsoup-1.24.1

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

jsoup 1.24.1

Improvements

Changes

Bug Fixes

1.24.1 (2026-Nov-03)

Improvements

Changes

Bug Fixes

Uh oh!

github-actions Bot commented Nov 11, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant