Skip to content

Add configurable versionQualifier to replace hardcoded redhat filter - #1883

Open
koentsje wants to merge 1 commit into
project-ncl:mainfrom
koentsje:configurable-version-qualifier
Open

koentsje wants to merge 1 commit into
project-ncl:mainfrom
koentsje:configurable-version-qualifier

Conversation

@koentsje

@koentsje koentsje commented Oct 5, 2026 •

Copy link
Copy Markdown

Summary

See https://redhat.atlassian.net/browse/NCLSUP-1629

The pig module's repository generation (strategies like BUILD_GROUP, BUILD_CONFIGS, BOM, etc.) has the Red Hat version qualifier (redhat) hardcoded in multiple places: PNC API queries, artifact filtering, community artifact removal, and version deduplication. This makes it impossible to use these strategies on non-Red Hat PNC instances (e.g. IBM PNC) where artifacts use a different qualifier like ibm.

This PR adds a versionQualifier field to RepoGenerationData (default: "redhat") and threads it through all the relevant code paths.

Changes

Config

  • RepoGenerationData: new versionQualifier field (default "redhat"), included in merge()

Core logic

  • RepoManager:
    • getRedhatArtifacts() replaced by getProductArtifacts(): PNC dependency query uses qualifier from config
    • filterAndDownload(): artifact GAPV filter uses qualifier from config
    • hasProdVersionSubdir(): accepts qualifier parameter
    • finalizeArtifacts(): delegates to isProductVersion(qualifier)
    • repackage(): passes qualifier to removeCommunityArtifacts()
  • ResolvedGav: isRedHatVersion() replaced by isProductVersion(String qualifier)
  • RepositoryUtils:
    • isCommunity(): new overload accepting qualifier
    • removeCommunityArtifacts(): new overload accepting qualifier
    • keepOnlyLatestRedHatArtifacts() delegates to new keepOnlyLatestProductArtifacts(dir, qualifier)
    • RedHatArtifactVersion replaced by ProductArtifactVersion with patternFor(qualifier) instead of hardcoded regex
  • RepoBuilder: passes qualifier to keepOnlyLatestProductArtifacts()
  • GAV: new isCommunity(String qualifier) overload

Backward compatibility

All public methods retain their original no-arg signatures, delegating to the new parameterized versions with "redhat" as default. No breaking changes for existing callers.

Tests

  • RepositoryUtilsTest: isCommunity with "ibm" qualifier, ProductArtifactVersion parsing for "redhat" and "ibm", qualifier mismatch
  • RepoGenerationDataTest: default qualifier value, merge override, merge with both defaults

Checklist:

  • Have you added a note in the CHANGELOG wiki for your change if user-facing? => This should probably only be done once the PR is accepted?
  • Have you added unit tests for your change?

@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

⚠️ SAST findings detected

SCA scan output



Identified 371 dependencies

Detected 190 vulnerabilities (9 Critical, 83 High, 94 Medium, 4 Low)

Displaying top 50 vulnerabilities. View the full list on the application.
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                      LIBRARY                      |       ID        |                                               TOP FIX                                                |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2025-14813  | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-5598   | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-58062  | Upgrade to version org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,            |
|          |                                                   |                 | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,                                 |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-59650  | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-8763   | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-jdk15to18:1.85,      |
|          |                                                   |                 | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,                                     |
|          |                                                   |                 | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,                               |
|          |                                                   |                 | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.5.1.jar                             | CVE-2026-71290  | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                                   |                 | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | lz4-1.3.0.jar                                     | CVE-2025-12183  | Upgrade to version org.lz4:lz4-java:1.8.1, https://github.com/yawkat/lz4-java.git - v1.8.1           |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.84.Final.jar                    | CVE-2026-75595  | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                                   |                 | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                 | netty-4.2.17.Final                                                                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | undertow-core-2.2.24.Final.jar                    | CVE-2025-12543  | Upgrade to version io.undertow:undertow-core:2.2.39.Final,                                           |
|          |                                                   |                 | https://github.com/undertow-io/undertow.git - 2.3.21.Final,                                          |
|          |                                                   |                 | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,                                           |
|          |                                                   |                 | https://github.com/undertow-io/undertow.git - 2.2.39.Final                                           |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-12802  | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                                   |                 | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-fips:1.0.12,                            |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                 | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59639  | Upgrade to version org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,      |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:2.1.12,org.bouncycastle:bcpkix-fips:2.0.12,                             |
|          |                                                   |                 | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59642  | Upgrade to version org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-fips:2.0.12,          |
|          |                                                   |                 | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                                   |                 | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                         |
|          |                                                   |                 | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-71888  | Upgrade to version org.bouncycastle:bcpkix-jdk14:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,  |
|          |                                                   |                 | org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                   |
|          |                                                   |                 | org.bouncycastle:bcpkix-jdk18on:1.86, https://github.com/bcgit/bc-java.git - r1rv86,                 |
|          |                                                   |                 | org.bouncycastle:bcpkix-lts8on:2.73.13, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13,      |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:1.0.13,org.bouncycastle:bcpkix-fips:2.0.13,                             |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:2.1.13                                                                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-71889  | Upgrade to version org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-lts8on:2.73.13,    |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                                                   |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,             |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                     |
|          |                                                   |                 | org.bouncycastle:bcprov-debug-jdk14:1.86,org.bouncycastle:bcprov-jdk15to18:1.86,                     |
|          |                                                   |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13 |
|          |                                                   |                 | , https://github.com/bcgit/bc-java.git - r1rv86,org.bouncycastle:bcpkix-fips:1.0.13,                 |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-29857  | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78,     |
|          |                                                   |                 | BouncyCastle.Cryptography - 2.3.1                                                                    |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-30172  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78,      |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1                                |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-34447  | Upgrade to version org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78,        |
|          |                                                   |                 | org.bouncycastle:bctls-fips:1.0.19                                                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12803  | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                 | org.bouncycastle:bcprov-lts8on:2.73.12, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12816  | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12860  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-13506  | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                                   |                 | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-jdk18on:1.85 |
|          |                                                   |                 | ,org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85               |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-14682  | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                 | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.0.2,                                     |
|          |                                                   |                 | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk15to18:1.85,                       |
|          |                                                   |                 | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58059  | Upgrade to version org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,          |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:2.0.2,  |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58060  | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                 | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.0.2 |
|          |                                                   |                 | , https://github.com/bcgit/bc-java.git - r1rv85                                                      |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58061  | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                 | org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,                               |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:1.0.2.7,                             |
|          |                                                   |                 | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-71889  | Upgrade to version org.bouncycastle:bcpkix-jdk15to18:1.86,org.bouncycastle:bcpkix-lts8on:2.73.13,    |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk14:1.86,org.bouncycastle:bcpkix-jdk18on:1.86,                             |
|          |                                                   |                 | org.bouncycastle:bcprov-debug-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk15to18:1.86,             |
|          |                                                   |                 | org.bouncycastle:bcprov-jdk18on:1.86,org.bouncycastle:bcpkix-debug-jdk18on:1.86,                     |
|          |                                                   |                 | org.bouncycastle:bcprov-debug-jdk14:1.86,org.bouncycastle:bcprov-jdk15to18:1.86,                     |
|          |                                                   |                 | org.bouncycastle:bcprov-debug-jdk15to18:1.86, https://github.com/bcgit/bc-lts-java.git - r2rv73dot13 |
|          |                                                   |                 | , https://github.com/bcgit/bc-java.git - r1rv86,org.bouncycastle:bcpkix-fips:1.0.13,                 |
|          |                                                   |                 | org.bouncycastle:bcpkix-fips:2.0.13,org.bouncycastle:bcpkix-fips:2.1.13                              |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcutil-jdk18on-1.74.jar                           | CVE-2026-59645  | Upgrade to version org.bouncycastle:bcutil-lts8on:2.73.12,org.bouncycastle:bcutil-fips:2.1.7,        |
|          |                                                   |                 | org.bouncycastle:bcutil-jdk18on:1.85,org.bouncycastle:bcutil-jdk15to18:1.85,                         |
|          |                                                   |                 | org.bouncycastle:bcutil-fips:2.0.7, https://github.com/bcgit/bc-java.git - r1rv85                    |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | hibernate-validator-6.0.23.Final-redhat-00001.jar | CVE-2025-35036  | Upgrade to version  https://github.com/hibernate/hibernate-validator.git - 7.0.0.Final,              |
|          |                                                   |                 | https://github.com/hibernate/hibernate-validator.git - 6.2.0.Final                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.2.jar                                 | CVE-2026-54399  | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                 | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                 | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.3.6.jar                               | CVE-2026-54399  | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                 | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                 | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.2.jar                              | CVE-2026-54428  | Upgrade to version  https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,              |
|          |                                                   |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                 | org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                                              |
|          |                                                   |                 | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3                                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.3.6.jar                            | CVE-2026-54428  | Upgrade to version  https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,              |
|          |                                                   |                 | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                 | org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                                              |
|          |                                                   |                 | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3                                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jline-builtins-3.30.6.jar                         | CVE-2026-77422  | org.jline:jline-builtins:3.30.15,org.jline:jline-builtins:4.3.1                                      |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jline-builtins-3.30.6.jar                         | CVE-2026-77423  | N/A                                                                                                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.23.1.jar                                  | CVE-2026-75140  | org.jsoup:jsoup:1.23.2                                                                               |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-common-25.0.3.jar                        | CVE-2026-74909  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.6.7,                               |
|          |                                                   |                 | https://github.com/keycloak/keycloak.git - 26.7.4, https://github.com/keycloak/keycloak.git -        |
|          |                                                   |                 | 26.4.16,org.keycloak:keycloak-common:26.7.4                                                          |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar            | CVE-2026-2603   | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                                   |                 | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | lz4-1.3.0.jar                                     | CVE-2025-66566  | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.10.1                                 |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-42583  | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.133.Final,                        |
|          |                                                   |                 | io.netty:netty-codec:4.1.133.Final,io.netty:netty-codec-compression:4.2.13.Final,                    |
|          |                                                   |                 | https://github.com/netty/netty.git - netty-4.2.13.Final                                              |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-59901  | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-dns-4.1.84.Final.jar                  | CVE-2026-42579  | Upgrade to version io.netty:netty-codec-dns:4.1.133.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                 | netty-4.1.133.Final,io.netty:netty-codec-dns:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                 | netty-4.2.13.Final                                                                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-100666 | N/A                                                                                                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-33870  | io.netty:netty-codec-http:4.1.132.Final,io.netty:netty-codec-http:4.2.10.Final                       |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42584  | Upgrade to version io.netty:netty-codec-http:4.1.133.Final, https://github.com/netty/netty.git -     |
|          |                                                   |                 | netty-4.2.13.Final,io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                 | netty-4.1.133.Final                                                                                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42587  | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                 | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                 | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                 | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55831  | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55833  | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-56745  | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                                   |                 | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                 | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-93565  | Upgrade to version io.netty:netty-codec-http:4.2.18.Final,io.netty:netty-codec-http:4.1.138.Final,   |
|          |                                                   |                 | https://github.com/netty/netty.git - netty-4.1.138.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                 | netty-4.2.18.Final,io.netty:netty-all:4.1.138.Final                                                  |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2023-44487  | Upgrade to version org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17,            |
|          |                                                   |                 | org.eclipse.jetty.http2:jetty-http2-server:12.0.2,                                                   |
|          |                                                   |                 | org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17,                               |
|          |                                                   |                 | org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0,       |
|          |                                                   |                 | io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3,                                     |
|          |                                                   |                 | org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14,                                               |
|          |                                                   |                 | org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,  |
|          |                                                   |                 | 7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3,v1.57.1,v1.58.3,             |
|          |                                                   |                 | kubernetes/kubernetes - v1.25.15,v1.26.10,v1.27.7,v1.28.3,v1.29.0, kubernetes/apimachinery -         |
|          |                                                   |                 | v0.25.15,v0.26.10,v0.27.7,v0.28.3,v0.29.0, kubernetes/apiserver- v0.25.15,v0.26.10,v0.27.7,v0.28.3,  |
|          |                                                   |                 | v0.29.0                                                                                              |
+----------+---------------------------------------------------+-----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

auth-4.0.0-SNAPSHOT.jar
|-- common-4.0.0-SNAPSHOT.jar
	|-- pnc-common-3.5.4-jakarta.jar
		|-- jsoup-1.23.1.jar [1 HIGH]
	|-- rest-api-3.6.0-SNAPSHOT-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- dto-3.6.0-SNAPSHOT.jar
			|-- jsoup-1.23.1.jar [1 HIGH]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 15 HIGH, 3 MEDIUM]
		|-- xnio-api-3.8.7.Final.jar [2 HIGH]
		|-- xnio-nio-3.8.7.Final.jar
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
	|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 12 HIGH, 17 MEDIUM]
	|-- resteasy-client-3.15.6.Final.jar
		|-- resteasy-jaxrs-3.15.6.Final.jar [2 HIGH]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 12 HIGH, 17 MEDIUM]
		|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- bcpkix-jdk18on-1.74.jar [5 HIGH, 6 MEDIUM]
				|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 12 HIGH, 17 MEDIUM]
				|-- bcutil-jdk18on-1.74.jar [1 HIGH]
					|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 12 HIGH, 17 MEDIUM]
			|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 12 HIGH, 17 MEDIUM]
			|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
... *truncated, see full logs below*
SAST scan output
warning: 'KeycloakClientException' method could be abused to reveal sensitive internal information. (pig/src/main/java/org/jboss/pnc/bacon/pig/impl/addons/camel/TreeParser.java:246)
warning: 'sha1' method of 'hashlib' uses a non-recommended hash algorithm. (bacon_install.py:188)

Full logs and artifacts

@akridl
akridl requested a review from jomrazek October 6, 2026 08:06

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant