Skip to content

Conversation

@tgodzik
Copy link
Contributor

@tgodzik tgodzik commented Dec 11, 2025

No description provided.

@tgodzik tgodzik force-pushed the fix-ci2 branch 2 times, most recently from e75ca1a to a8a35c8 Compare December 11, 2025 10:39
@github-actions
Copy link

Dependency Review

The following issues were found:
  • ❌ 5 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.
Consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

sbt-plugin/build.sbt

NameVersionVulnerabilitySeverity
com.squareup.okhttp3:okhttp3.14.2Square OkHttp can accept the wrong certificatehigh
com.squareup.okio:okio1.17.2Okio Signed to Unsigned Conversion Error vulnerabilitymoderate
org.apache.logging.log4j:log4j-core2.17.0Improper Input Validation and Injection in Apache Log4j2moderate
org.scala-sbt:io_2.121.5.1sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)low
org.scala-sbt:sbt1.5.8sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)low

Scanned Manifest Files

package-lock.json
sbt-plugin/build.sbt

@tgodzik tgodzik merged commit 7291cb0 into main Dec 11, 2025
7 of 8 checks passed
@tgodzik tgodzik deleted the fix-ci2 branch December 11, 2025 10:57
@mkurz
Copy link
Contributor

mkurz commented Dec 11, 2025

@tgodzik
Copy link
Contributor Author

tgodzik commented Dec 11, 2025

yeah, I was fixing things around the repo because of it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants