Repository navigation
Review Dependabot security alerts #500
Description
GitHub reports 23 open Dependabot alerts on master (4 critical, 3 high, 15 moderate, 1 low). They appeared once the Gradle build was submitted to the dependency graph (dependency-submission workflow), which covers every Gradle configuration, including the ones only used to build the plugin.
| Package | Alerts | Highest severity | First patched version |
|---|---|---|---|
org.bouncycastle:bcprov-jdk18on |
10 | critical | 1.85 |
org.bouncycastle:bcprov-jdk15on |
5 | moderate | 1.78 (some: none, the jdk15on line ended at 1.70) |
org.bouncycastle:bcpkix-jdk18on |
2 | moderate | 1.84 |
org.bouncycastle:bcpg-jdk15on |
1 | high | none (jdk15on line ended) |
org.apache.maven:maven-core |
1 | critical | 3.8.1 |
org.apache.maven.shared:maven-shared-utils |
1 | critical | 3.3.3 |
io.airlift:aircompressor |
1 | high | 2.0.3 |
com.google.guava:guava |
2 | moderate | 32.0.0-android |
org.apache.logging.log4j:log4j-api |
1 | moderate | 2.25.5 |
Not every alert affects users: some of these packages may only be used to build the plugin (e.g. the embedded Maven that generates the plugin descriptor, or signing), and never reach a user's build.
Plan
- For each package, find which dependency brings it and whether it's in what users download (the published POM or Gradle module metadata) or only in the plugin's own build.
- Update or constrain the ones users get, keeping Java 8 compatibility and the minimum Maven version (
maven-plugin-api3.6.0), and check them with the smoke tests. - Update the build-only ones where it's easy; otherwise dismiss the alert with the reason.
- Replace the
*-jdk15onBouncy Castle artifacts (no longer maintained) with*-jdk18onwhere possible.
Activity
Close the 2.0.0 MiniSpec notes
Close the 2.0.0 MiniSpec notes
fvarrui commentedon Oct 11, 2026
The new documentation site (
docs/, Docusaurus) added 7 more alerts, from its npm dependencies indocs/package-lock.json:tinypoolserialize-javascriptbracespostcss-selector-parseruuidThey are transitive dependencies of Docusaurus, only used to build the site, which is static HTML: they don't reach plugin users nor site visitors. Plan:
overridesindocs/package.json, and check thatnpm run buildstill works.Add the docs site alerts to the Dependabot note (#500)
Fix the Dependabot alerts that reach users (#500)