Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): bump org.jboss.weld:weld-core-parent from 4.0.3.Final to 6.0.0.Final in /jans-config-api #10440

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump org.jboss.weld:weld-core-parent from 4.0.3.Final to 6.0.0.Final in /jans-config-api #10440

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 17, 2024 •
edited
Loading

Bumps org.jboss.weld:weld-core-parent from 4.0.3.Final to 6.0.0.Final.

Commits
  • eb8de65 [maven-release-plugin] prepare release 6.0.0.Final
  • 1ed5ef1 Trigger Weld 6.0.0.Final release
  • 0dbecdc Upgrade Weld API to Final artifact
  • a68b067 [maven-release-plugin] prepare for next development iteration
  • 09939c4 [maven-release-plugin] prepare release 6.0.0.CR2
  • 7983a58 Trigger release for 6.0.0.CR2
  • de7a926 WELD-2804 Remove deprecated code parts.
  • 8b57e0f WELD-2803 Remove WeldCrossContextFilter
  • 23f8e2f [maven-release-plugin] prepare for next development iteration
  • d6da8f4 [maven-release-plugin] prepare release 6.0.0.CR1
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot requested a review from pujavs as a code owner December 17, 2024 10:08
@dependabot dependabot bot added java Pull requests that update Java code kind-dependencies Pull requests that update a dependency file labels Dec 17, 2024
@dependabot dependabot bot requested review from yuriyz and yurem as code owners December 17, 2024 10:08
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented Dec 17, 2024 •
edited
Loading

DryRun Security Summary

The code change updates the Weld dependency version in the jans-config-api/pom.xml file from 4.0.3.Final to 6.0.0.Final, which is a routine update that requires thorough testing to ensure no regressions or unexpected behavior.

Expand for full summary

Summary:

The provided code change is related to updating the version of the Weld dependency in the jans-config-api/pom.xml file. Specifically, the change updates the <weld.version> property from 4.0.3.Final to 6.0.0.Final. From an application security perspective, this change is not immediately concerning, as updating dependencies to their latest versions is generally a good practice, as it can address known security vulnerabilities and provide improvements in functionality and performance.

However, it is always important to thoroughly test any dependency updates to ensure that they do not introduce regressions or unexpected behavior in the application. Additionally, it is recommended to review the release notes and change logs of the new Weld version to understand any potential security-related changes or improvements. Overall, this change appears to be a routine dependency update and does not raise any significant application security concerns. The review should focus on ensuring that the updated dependency does not introduce any functional or performance issues in the application.

Files Changed:

  • jans-config-api/pom.xml: This file has been updated to change the <weld.version> property from 4.0.3.Final to 6.0.0.Final. This is a routine dependency update that does not raise any immediate application security concerns, but it should be thoroughly tested to ensure that the updated dependency does not introduce any regressions or unexpected behavior in the application.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 1 finding

View PR in the DryRun Dashboard.

@dependabot dependabot bot force-pushed the dependabot/maven/jans-config-api/org.jboss.weld-weld-core-parent-6.0.0.Final branch from 383edd2 to c5fa606 Compare December 24, 2024 14:33
@moabu moabu force-pushed the dependabot/maven/jans-config-api/org.jboss.weld-weld-core-parent-6.0.0.Final branch from c5fa606 to 9a7ee3d Compare December 26, 2024 19:25
@moabu moabu force-pushed the dependabot/maven/jans-config-api/org.jboss.weld-weld-core-parent-6.0.0.Final branch from 9a7ee3d to c40423b Compare December 27, 2024 04:55
@dependabot
chore(deps): bump org.jboss.weld:weld-core-parent in /jans-config-api
03b2171 
Bumps [org.jboss.weld:weld-core-parent](https://github.com/weld/core) from 4.0.3.Final to 6.0.0.Final.
- [Commits](weld/core@4.0.3.Final...6.0.0.Final)

---
updated-dependencies:
- dependency-name: org.jboss.weld:weld-core-parent
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/maven/jans-config-api/org.jboss.weld-weld-core-parent-6.0.0.Final branch from c40423b to 03b2171 Compare December 27, 2024 11:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pujavs pujavs Awaiting requested review from pujavs pujavs is a code owner

@yuriyz yuriyz Awaiting requested review from yuriyz yuriyz is a code owner

@yurem yurem Awaiting requested review from yurem yurem is a code owner

@duttarnab duttarnab Awaiting requested review from duttarnab

@jgomer2001 jgomer2001 Awaiting requested review from jgomer2001

@yuriyzz yuriyzz Awaiting requested review from yuriyzz

@moabu moabu Awaiting requested review from moabu

@iromli iromli Awaiting requested review from iromli

At least 2 approving reviews are required to merge this pull request.

Assignees
No one assigned
Labels
java Pull requests that update Java code kind-dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants