Bump quarkus.platform.version from 3.38.3 to 3.39.1 by dependabot[bot] · Pull Request #368 · project-ncl/environment-driver

dependabot · 2026-09-08T06:23:30Z

Bumps quarkus.platform.version from 3.38.3 to 3.39.1.
Updates io.quarkus:quarkus-universe-bom from 3.38.3 to 3.39.1

Commits

77e4498 [maven-release-plugin] prepare release 3.39.1
225cd01 Merge pull request #2150 from quarkusio/quarkus-3.39.1
2a77d8f Upgrade to Quarkus 3.39.1
2a6e81a Merge pull request #2145 from JiriOndrusek/cq3.39.0
e831a8b Upgrade to Camel Quarkus 3.39.0
64ef354 Merge pull request #2143 from quarkusio/update-automation/main-cxf-3.39.1
89c6896 Update CXF to 3.39.1
6088b7c Merge pull request #2142 from gsmet/notify-qpid
36a282a Notify Robbie for QPid JMS pull requests
5760da1 Merge pull request #2136 from gemmellr/update-quarkus-qpid-jms-2.13.0
Additional commits viewable in compare view

Updates io.quarkus:quarkus-maven-plugin from 3.38.3 to 3.39.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps `quarkus.platform.version` from 3.38.3 to 3.39.1. Updates `io.quarkus:quarkus-universe-bom` from 3.38.3 to 3.39.1 - [Commits](quarkusio/quarkus-platform@3.38.3...3.39.1) Updates `io.quarkus:quarkus-maven-plugin` from 3.38.3 to 3.39.1 --- updated-dependencies: - dependency-name: io.quarkus:quarkus-universe-bom dependency-version: 3.39.1 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.quarkus:quarkus-maven-plugin dependency-version: 3.39.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-08T06:28:38Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 421 dependencies

Detected 18 vulnerabilities (2 Critical, 8 High, 7 Medium, 1 Low)

+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| SEVERITY |                    LIBRARY                    |       ID       |                                             TOP FIX                                              |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| CRITICAL | amqp-client-5.5.3.jar                         | CVE-2026-63337 | Upgrade to version  https://github.com/rabbitmq/rabbitmq-java-client.git - v5.33.0               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.6.1.jar                         | CVE-2026-71290 | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,            |
|          |                                               |                | org.apache.httpcomponents.client5:httpclient5:5.6.4                                              |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | amqp-client-5.5.3.jar                         | CVE-2026-61634 | Upgrade to version  https://github.com/rabbitmq/rabbitmq-java-client.git - v5.33.0               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | amqp-client-5.5.3.jar                         | CVE-2026-63335 | Upgrade to version  https://github.com/rabbitmq/rabbitmq-java-client.git - v5.31.0               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | amqp-client-5.5.3.jar                         | CVE-2026-63336 | Upgrade to version  https://github.com/rabbitmq/rabbitmq-java-client.git - v5.33.0,              |
|          |                                               |                | com.rabbitmq:amqp-client:5.33.0                                                                  |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | amqp-client-5.5.3.jar                         | CVE-2026-69219 | Upgrade to version  https://github.com/rabbitmq/rabbitmq-java-client.git - v5.33.1               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | amqp-client-5.5.3.jar                         | CVE-2026-69220 | Upgrade to version  https://github.com/rabbitmq/rabbitmq-java-client.git - v5.33.1               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                              | CVE-2026-75140 | N/A                                                                                              |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | resteasy-core-6.2.16.Final.jar                | CVE-2026-17615 | N/A                                                                                              |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| HIGH     | wildfly-elytron-password-impl-2.9.2.Final.jar | CVE-2026-19611 | N/A                                                                                              |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | amqp-client-5.5.3.jar                         | CVE-2023-46120 | Upgrade to version com.rabbitmq:amqp-client:5.18.0                                               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | httpclient5-5.6.1.jar                         | CVE-2026-64607 | Upgrade to version org.apache.httpcomponents.client5:httpclient5:5.6.3                           |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-19032 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.22.2,                           |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.1.6,    |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,tools.jackson.core:jackson-databind:3.2.2    |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1, |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                     |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                     |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                              |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                              |
|          |                                               |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4                       |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                           |
|          |                                               |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,             |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                               |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-77310 | Upgrade to version tools.jackson.core:jackson-databind:3.2.1,                                    |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.9,                                              |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                              |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,tools.jackson.core:jackson-databind:3.1.5     |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar                   | CVE-2026-83557 | Upgrade to version tools.jackson.core:jackson-databind:3.1.6,                                    |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.22.2,                                              |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.18.10,                                             |
|          |                                               |                | com.fasterxml.jackson.core:jackson-databind:2.21.6,tools.jackson.core:jackson-databind:3.2.2     |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+
| LOW      | LatencyUtils-2.0.3.jar                        | CVE-2026-82596 | N/A                                                                                              |
+----------+-----------------------------------------------+----------------+--------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-elytron-security-ldap-3.39.1.jar
|-- quarkus-elytron-security-3.39.1.jar
	|-- quarkus-elytron-security-common-3.39.1.jar
		|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
	|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
|-- wildfly-elytron-realm-ldap-2.9.2.Final.jar
	|-- wildfly-elytron-client-2.9.2.Final.jar
		|-- wildfly-elytron-credential-source-impl-2.9.2.Final.jar
			|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
		|-- wildfly-elytron-credential-store-2.9.2.Final.jar
			|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
		|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
	|-- wildfly-elytron-realm-2.9.2.Final.jar
		|-- wildfly-elytron-password-impl-2.9.2.Final.jar [1 HIGH]
quarkus-micrometer-opentelemetry-3.39.1.jar
|-- quarkus-micrometer-3.39.1.jar
	|-- micrometer-core-1.17.1.jar
		|-- httpclient5-5.6.1.jar [1 CRITICAL, 1 MEDIUM]
	|-- LatencyUtils-2.0.3.jar [1 LOW]
quarkus-oidc-client-3.39.1.jar
|-- quarkus-oidc-common-3.39.1.jar
	|-- smallrye-mutiny-vertx-web-client-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- vertx-web-client-4.5.32.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-oidc-3.39.1.jar
|-- quarkus-vertx-3.39.1.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- smallrye-mutiny-vertx-core-3.23.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-openshift-client-3.39.1.jar
|-- openshift-client-7.8.0-bundle.jar
	|-- kubernetes-client-api-7.8.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jackson-dataformat-yaml-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- kubernetes-model-core-7.8.0.jar
			|-- kubernetes-model-common-7.8.0.jar
				|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- quarkus-kubernetes-client-3.39.1.jar
	|-- kubernetes-client-7.8.0.jar
		|-- zjsonpatch-7.8.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
quarkus-resteasy-client-jackson-3.39.1.jar
|-- quarkus-resteasy-client-3.39.1.jar
	|-- quarkus-resteasy-common-3.39.1.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- microprofile-config-3.0.1.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
	|-- resteasy-multipart-provider-6.2.16.Final.jar
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
		|-- resteasy-jaxb-provider-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
quarkus-resteasy-jackson-3.39.1.jar
|-- quarkus-jackson-3.39.1.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- resteasy-jackson2-provider-6.2.16.Final.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-jakarta-rs-base-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- json-patch-1.13.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
		|-- jackson-coreutils-2.0.jar
			|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
quarkus-resteasy-mutiny-3.39.1.jar
|-- quarkus-resteasy-mutiny-common-3.39.1.jar
	|-- resteasy-client-6.2.16.Final.jar
		|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
|-- quarkus-resteasy-3.39.1.jar
	|-- quarkus-resteasy-server-common-3.39.1.jar
		|-- resteasy-cdi-6.2.16.Final.jar
			|-- resteasy-core-6.2.16.Final.jar [1 HIGH]
quarkus-smallrye-health-3.39.1.jar
|-- quarkus-vertx-http-3.39.1.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- vertx-web-4.5.32.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
failsafe-2.4.4.jar
|-- vertx-core-4.5.32.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pncmetrics-1.1.3.jar
|-- metrics-graphite-4.1.0.jar
	|-- amqp-client-5.5.3.jar [1 CRITICAL, 5 HIGH, 1 MEDIUM]
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
bifrost-upload-client-3.5.1.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- httpclient5-5.6.1.jar [1 CRITICAL, 1 MEDIUM]
pnc-api-3.5.2-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
pnc-common-3.5.4-jakarta.jar
|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-datatype-jdk8-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jackson-module-parameter-names-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pom-manipulation-common-lite-5.5.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
	|-- reports-model-2.6.9.jar
		|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- pnc-api-3.5.1-jakarta.jar
	|-- jackson-databind-2.22.0.jar [5 MEDIUM]
|-- jsoup-1.23.1.jar [1 HIGH]


No Policy violations were detected

Project 'environment-driver' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=c6e1b9a4-53c2-4c66-bb31-69044d6bb4f3
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=3e750feb73054f089ae2c02d8f05cabc014ab023b02b4d3da606baa09b54a06f

Mend AI scan succeeded.

Support Token: 1d95ea252738340bf9f0f5d80f359c5761788848857499

SAST scan output

*no findings*

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 8, 2026

Navigation Menu

Uh oh!

Bump quarkus.platform.version from 3.38.3 to 3.39.1 - #368

Bump quarkus.platform.version from 3.38.3 to 3.39.1#368
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/quarkus.platform.version-3.39.1

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants