Skip to content

Bump software.amazon.awssdk:bom from 2.54.14 to 2.55.4 - #154

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/software.amazon.awssdk-bom-2.55.4
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/software.amazon.awssdk-bom-2.55.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor

Bumps software.amazon.awssdk:bom from 2.54.14 to 2.55.4.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps software.amazon.awssdk:bom from 2.54.14 to 2.55.4.

---
updated-dependencies:
- dependency-name: software.amazon.awssdk:bom
  dependency-version: 2.55.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 1, 2026
@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output



Identified 72 dependencies

Detected 6 vulnerabilities (0 Critical, 4 High, 1 Medium, 1 Low)

+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |           LIBRARY           |       ID       |                                               TOP FIX                                                |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.2.jar     | CVE-2026-89407 | Upgrade to version  https://github.com/FasterXML/jackson-core.git - jackson-core-2.22.3,             |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7,                                 |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7,                                  |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-3.2.2,                                  |
|          |                             |                | tools.jackson.core:jackson-core:3.2.2,tools.jackson.core:jackson-core:3.1.7,                         |
|          |                             |                | com.fasterxml.jackson.core:jackson-core:2.22.3,com.fasterxml.jackson.core:jackson-core:2.21.7,       |
|          |                             |                | com.fasterxml.jackson.core:jackson-core:2.18.11                                                      |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-core-2.22.2.jar     | CVE-2026-89425 | Upgrade to version com.fasterxml.jackson.core:jackson-core:2.21.7,                                   |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.7,                                  |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.11,                                |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.7,                                 |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-2.22.3,                                 |
|          |                             |                | https://github.com/FasterXML/jackson-core.git - jackson-core-3.2.3,                                  |
|          |                             |                | tools.jackson.core:jackson-core:3.2.3,tools.jackson.core:jackson-core:3.1.7,                         |
|          |                             |                | com.fasterxml.jackson.core:jackson-core:2.22.3,com.fasterxml.jackson.core:jackson-core:2.18.11       |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.2.jar | CVE-2026-91776 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.7,                               |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3,                          |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7,                          |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.7,                         |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                             |                | tools.jackson.core:jackson-databind:3.2.3,tools.jackson.core:jackson-databind:3.1.7,                 |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.22.3,                                                  |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.18.11,                                                 |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11                         |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jackson-databind-2.22.2.jar | CVE-2026-91777 | Upgrade to version tools.jackson.core:jackson-databind:3.1.7,                                        |
|          |                             |                | tools.jackson.core:jackson-databind:3.2.3, https://github.com/FasterXML/jackson-databind.git -       |
|          |                             |                | jackson-databind-2.21.7, https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.2.3, |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.3,                         |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.11,                        |
|          |                             |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.7,                          |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.22.3,                                                  |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.21.7,                                                  |
|          |                             |                | com.fasterxml.jackson.core:jackson-databind:2.18.11                                                  |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | guava-19.0.jar              | CVE-2023-2976  | Upgrade to version com.google.guava:guava:32.0.1-android,32.0.1-jre                                  |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | guava-19.0.jar              | CVE-2020-8908  | Upgrade to version  https://github.com/google/guava.git - v32.0.0,                                   |
|          |                             |                | com.google.guava:guava:32.0.0-android                                                                |
+----------+-----------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

path-mapped-pathdb-3.4-SNAPSHOT.pom
|-- path-mapped-pathdb-datastax-3.4-SNAPSHOT.jar
	|-- cassandra-driver-core-3.12.1.jar
		|-- jackson-databind-2.22.2.jar [2 HIGH]
			|-- jackson-core-2.22.2.jar [2 HIGH]
		|-- guava-19.0.jar [1 MEDIUM, 1 LOW]
	|-- cassandra-driver-mapping-3.12.1.jar
		|-- guava-19.0.jar [1 MEDIUM, 1 LOW]


No Policy violations were detected

Project 'path-mapped-storage-pr' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=9730031b-d3fc-4279-98b3-6c66af5ef174
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=85e3802ea2fe477fbf92a247161a37cdaa39c61bed5542af88a94a63b6706473

Mend AI scan succeeded.

Support Token: 358a518efee5f4040b31cbfb8415f41b81790861268110
SAST scan output
*no findings*

Full logs and artifacts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants