Skip to content

Move OWASP Dependency Check to a standalone scheduled workflow#78

Merged
Splatcrafter merged 68 commits intomainfrom
refactor/owasp-security-check-only-on-scheduled-times
Feb 2, 2026
Merged

Move OWASP Dependency Check to a standalone scheduled workflow#78
Splatcrafter merged 68 commits intomainfrom
refactor/owasp-security-check-only-on-scheduled-times

Conversation

@Splatcrafter
Copy link
Member

@Splatcrafter Splatcrafter commented Feb 2, 2026

Summary

Split the OWASP Dependency Check into its own dedicated scheduled workflow to enhance modularity and reduce workflow execution times.

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Refactoring
  • Documentation
  • Build / CI

Related Issues

No related issues in this PR

Changes

  • Separated the OWASP Dependency Check from the main CI pipeline.
  • Scheduled the dependency check as a periodic workflow.

Verification

  • Unit tests added/updated
  • Existing tests pass
  • Manual verification performed (if applicable)

Breaking Changes

None.

Checklist

  • Code follows project conventions
  • Public APIs are documented
  • Tests cover new behavior
  • No unnecessary dependencies added

Splatcrafter and others added 30 commits January 18, 2026 12:34
@Splatcrafter
Bump version to 1.0.0-SNAPSHOT across all modules.
10fb6d1
@Splatcrafter
Merge pull request #36 from aether-framework/feature/1.0.0-snapshot-bump
ab165b0 
Bump project version to `1.0.0-SNAPSHOT`
@Splatcrafter
Merge branch 'main' into develop
3db78af
@Splatcrafter
Remove deprecated GsonOps and JacksonOps classes.
aba886d
@Splatcrafter
Removed deprecated TestData.jackson() in favor of `TestData.jackson…
501923e 
…Json()` and update references accordingly.
@Splatcrafter
Merge pull request #37 from aether-framework/feature/removing-depreca…
88438fb 
…ted-codec-packages

Remove deprecated methods and classes
@Splatcrafter
Update .gitignore to exclude current-ticket.md
36260ce
@Splatcrafter
Add benchmarking utilities and JMH tests for Aether Datafixers
1d1d203 
- Introduce `BenchmarkBootstrap` to provide pre-configured `DataFixer` instances.
- Add `BenchmarkDataGenerator` for creating diverse test data payloads.
- Implement `BenchmarkRunner` as a main entry point for executing JMH benchmarks.
- Include `CollectionCodecBenchmark` for measuring encoding/decoding performance of collections.
- Add `ConcurrentMigrationBenchmark` to analyze multithreaded data migration performance.
@Splatcrafter
Expand SingleFixBenchmark with additional benchmark methods, improv…
ffe1316 
…ed Javadoc, and structured state management.
@Splatcrafter
Remove expected performance notes from SingleFixBenchmark Javadoc f…
ccb0fb9 
…or cleaner documentation.
@dependabot
ci(deps): bump actions/cache from 4 to 5
5b3e368 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump actions/setup-java from 4 to 5
e45a1f6 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4 to 5.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps-dev): bump the jackson group with 4 updates
83ec540 
Bumps the jackson group with 4 updates: [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson), [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text), [com.fasterxml.jackson.dataformat:jackson-dataformat-toml](https://github.com/FasterXML/jackson-dataformats-text) and [com.fasterxml.jackson.dataformat:jackson-dataformat-xml](https://github.com/FasterXML/jackson-dataformat-xml).


Updates `com.fasterxml.jackson.core:jackson-databind` from 2.19.0 to 2.21.0
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-toml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformat-xml@jackson-dataformat-xml-2.19.0...jackson-dataformat-xml-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-toml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformat-xml@jackson-dataformat-xml-2.19.0...jackson-dataformat-xml-2.21.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-toml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-toml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump actions/checkout from 4 to 6
eeae4c0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump actions/upload-artifact from 4 to 6
af58d23 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump mikepenz/action-junit-report from 4 to 6
ecb85dd 
Bumps [mikepenz/action-junit-report](https://github.com/mikepenz/action-junit-report) from 4 to 6.
- [Release notes](https://github.com/mikepenz/action-junit-report/releases)
- [Commits](mikepenz/action-junit-report@v4...v6)

---
updated-dependencies:
- dependency-name: mikepenz/action-junit-report
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump the maven-plugins group with 10 updates
a713eeb 
Bumps the maven-plugins group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.11.0` | `3.14.1` |
| [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) | `3.4.1` | `3.6.2` |
| [org.apache.maven.plugins:maven-site-plugin](https://github.com/apache/maven-site-plugin) | `3.20.0` | `3.21.0` |
| [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.1` | `3.4.0` |
| [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.10.1` | `3.12.0` |
| [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) | `3.2.6` | `3.2.8` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.1.2` | `3.5.4` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.1.2` | `3.5.4` |
| [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) | `3.5.1` | `3.6.1` |
| [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.1.0` | `3.6.3` |


Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.11.0 to 3.14.1
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.11.0...maven-compiler-plugin-3.14.1)

Updates `org.apache.maven.plugins:maven-enforcer-plugin` from 3.4.1 to 3.6.2
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](apache/maven-enforcer@enforcer-3.4.1...enforcer-3.6.2)

Updates `org.apache.maven.plugins:maven-site-plugin` from 3.20.0 to 3.21.0
- [Release notes](https://github.com/apache/maven-site-plugin/releases)
- [Commits](apache/maven-site-plugin@maven-site-plugin-3.20.0...maven-site-plugin-3.21.0)

Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/apache/maven-source-plugin/releases)
- [Commits](apache/maven-source-plugin@maven-source-plugin-3.3.1...maven-source-plugin-3.4.0)

Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.10.1 to 3.12.0
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.10.1...maven-javadoc-plugin-3.12.0)

Updates `org.apache.maven.plugins:maven-gpg-plugin` from 3.2.6 to 3.2.8
- [Release notes](https://github.com/apache/maven-gpg-plugin/releases)
- [Commits](apache/maven-gpg-plugin@maven-gpg-plugin-3.2.6...maven-gpg-plugin-3.2.8)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.1.2 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.1.2...surefire-3.5.4)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.1.2 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.1.2...surefire-3.5.4)

Updates `org.apache.maven.plugins:maven-shade-plugin` from 3.5.1 to 3.6.1
- [Release notes](https://github.com/apache/maven-shade-plugin/releases)
- [Commits](apache/maven-shade-plugin@maven-shade-plugin-3.5.1...maven-shade-plugin-3.6.1)

Updates `org.codehaus.mojo:exec-maven-plugin` from 3.1.0 to 3.6.3
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)
- [Commits](mojohaus/exec-maven-plugin@exec-maven-plugin-3.1.0...3.6.3)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-site-plugin
  dependency-version: 3.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-source-plugin
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-gpg-plugin
  dependency-version: 3.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-shade-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.codehaus.mojo:exec-maven-plugin
  dependency-version: 3.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps-dev): bump org.sonatype.central:central-publishing-maven-pl…
aa55ff0 
…ugin

Bumps the build-plugins group with 1 update: [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype/central-publishing-maven-plugin).


Updates `org.sonatype.central:central-publishing-maven-plugin` from 0.8.0 to 0.10.0
- [Commits](https://github.com/sonatype/central-publishing-maven-plugin/commits)

---
updated-dependencies:
- dependency-name: org.sonatype.central:central-publishing-maven-plugin
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: build-plugins
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump picocli.version from 4.7.6 to 4.7.7
94417e2 
Bumps `picocli.version` from 4.7.6 to 4.7.7.

Updates `info.picocli:picocli` from 4.7.6 to 4.7.7
- [Release notes](https://github.com/remkop/picocli/releases)
- [Changelog](https://github.com/remkop/picocli/blob/main/RELEASE-NOTES.md)
- [Commits](remkop/picocli@v4.7.6...v4.7.7)

Updates `info.picocli:picocli-codegen` from 4.7.6 to 4.7.7
- [Release notes](https://github.com/remkop/picocli/releases)
- [Changelog](https://github.com/remkop/picocli/blob/main/RELEASE-NOTES.md)
- [Commits](remkop/picocli@v4.7.6...v4.7.7)

---
updated-dependencies:
- dependency-name: info.picocli:picocli
  dependency-version: 4.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: info.picocli:picocli-codegen
  dependency-version: 4.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump org.jetbrains:annotations from 26.0.2 to 26.0.2-1
db296c4 
Bumps [org.jetbrains:annotations](https://github.com/JetBrains/java-annotations) from 26.0.2 to 26.0.2-1.
- [Release notes](https://github.com/JetBrains/java-annotations/releases)
- [Changelog](https://github.com/JetBrains/java-annotations/blob/master/CHANGELOG.md)
- [Commits](JetBrains/java-annotations@26.0.2...26.0.2-1)

---
updated-dependencies:
- dependency-name: org.jetbrains:annotations
  dependency-version: 26.0.2-1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps-dev): bump org.yaml:snakeyaml from 2.2 to 2.5
50f2827 
Bumps [org.yaml:snakeyaml](https://bitbucket.org/snakeyaml/snakeyaml) from 2.2 to 2.5.
- [Commits](https://bitbucket.org/snakeyaml/snakeyaml/branches/compare/snakeyaml-2.5..snakeyaml-2.2)

---
updated-dependencies:
- dependency-name: org.yaml:snakeyaml
  dependency-version: '2.5'
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump org.assertj:assertj-core in the testing group
ed54697 
Bumps the testing group with 1 update: [org.assertj:assertj-core](https://github.com/assertj/assertj).


Updates `org.assertj:assertj-core` from 3.27.6 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](assertj/assertj@assertj-build-3.27.6...assertj-build-3.27.7)

---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
  dependency-version: 3.27.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: testing
...

Signed-off-by: dependabot[bot] <support@github.com>
@Splatcrafter
Merge pull request #58 from aether-framework/dependabot/maven/org.yam…
16fb3a8 
…l-snakeyaml-2.5

deps(deps-dev): bump org.yaml:snakeyaml from 2.2 to 2.5
@Splatcrafter
Merge pull request #45 from aether-framework/dependabot/github_action…
e208ea6 
…s/actions/cache-5

ci(deps): bump actions/cache from 4 to 5
@Splatcrafter
Merge pull request #46 from aether-framework/dependabot/github_action…
de26b08 
…s/actions/setup-java-5

ci(deps): bump actions/setup-java from 4 to 5
@Splatcrafter
Merge pull request #47 from aether-framework/dependabot/maven/jackson…
4b7761b 
…-9cc57c1ab7

deps(deps-dev): bump the jackson group with 4 updates
@Splatcrafter
Merge pull request #48 from aether-framework/dependabot/github_action…
21611c1 
…s/actions/checkout-6

ci(deps): bump actions/checkout from 4 to 6
@Splatcrafter
Merge pull request #49 from aether-framework/dependabot/github_action…
bb5c755 
…s/actions/upload-artifact-6

ci(deps): bump actions/upload-artifact from 4 to 6
@Splatcrafter
Merge pull request #50 from aether-framework/dependabot/github_action…
6b3c94b 
…s/mikepenz/action-junit-report-6

ci(deps): bump mikepenz/action-junit-report from 4 to 6
@Splatcrafter
Merge pull request #51 from aether-framework/dependabot/maven/maven-p…
854cc4d 
…lugins-62510d0fc5

deps(deps): bump the maven-plugins group with 10 updates
Splatcrafter and others added 23 commits February 1, 2026 01:06
@Splatcrafter
Introduce structure.py for visualizing and exporting folder structu…
c6aac37 
…res with optional filters and exclusions. Includes support for tree views, colored output, and file pattern matching.
@Splatcrafter
Merge pull request #64 from aether-framework/feature/41-operational-r…
d846e25 
…unbook-and-troubleshooting-guide

feature/41-operational-runbook-and-troubleshooting-guide
@Splatcrafter
Add migration guides for v0.5.x to v1.0.0, including breaking changes…
f09dd13 
…, automated migration patterns, and troubleshooting steps. Update documentation index to include the new migration section.
@Splatcrafter
Merge pull request #65 from aether-framework/feature/42-migration-guide
fe9e3ca 
Add migration guides for v0.5.x to v1.0.0, including breaking changes, automated migration patterns, and troubleshooting steps. Update documentation index to include the new migration section.
@dependabot
ci(deps): bump actions/upload-artifact from 4 to 6
39fe237 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump actions/cache from 4 to 5
efab098 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump actions/github-script from 7 to 8
f32abbd 
Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v7...v8)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps-dev): bump the jackson group with 4 updates
c320e68 
Bumps the jackson group with 4 updates: [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson), [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text), [com.fasterxml.jackson.dataformat:jackson-dataformat-toml](https://github.com/FasterXML/jackson-dataformats-text) and [com.fasterxml.jackson.dataformat:jackson-dataformat-xml](https://github.com/FasterXML/jackson-dataformat-xml).


Updates `com.fasterxml.jackson.core:jackson-databind` from 2.19.0 to 2.21.0
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-toml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformat-xml@jackson-dataformat-xml-2.19.0...jackson-dataformat-xml-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-toml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.19.0...jackson-dataformats-text-2.21.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.19.0 to 2.21.0
- [Commits](FasterXML/jackson-dataformat-xml@jackson-dataformat-xml-2.19.0...jackson-dataformat-xml-2.21.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-toml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-toml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: jackson
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump actions/download-artifact from 4 to 7
fc75cd1 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
ci(deps): bump github/codeql-action from 3 to 4
c96759b 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump the spring group with 2 updates
3e70794 
Bumps the spring group with 2 updates: [org.springframework.boot:spring-boot-dependencies](https://github.com/spring-projects/spring-boot) and [org.springframework.boot:spring-boot-starter-test](https://github.com/spring-projects/spring-boot).


Updates `org.springframework.boot:spring-boot-dependencies` from 3.4.1 to 3.5.10
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.4.1...v3.5.10)

Updates `org.springframework.boot:spring-boot-starter-test` from 3.4.1 to 3.5.10
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.4.1...v3.5.10)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-dependencies
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: spring
- dependency-name: org.springframework.boot:spring-boot-starter-test
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: spring
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump picocli.version from 4.7.6 to 4.7.7
7b3a2d5 
Bumps `picocli.version` from 4.7.6 to 4.7.7.

Updates `info.picocli:picocli` from 4.7.6 to 4.7.7
- [Release notes](https://github.com/remkop/picocli/releases)
- [Changelog](https://github.com/remkop/picocli/blob/main/RELEASE-NOTES.md)
- [Commits](remkop/picocli@v4.7.6...v4.7.7)

Updates `info.picocli:picocli-codegen` from 4.7.6 to 4.7.7
- [Release notes](https://github.com/remkop/picocli/releases)
- [Changelog](https://github.com/remkop/picocli/blob/main/RELEASE-NOTES.md)
- [Commits](remkop/picocli@v4.7.6...v4.7.7)

---
updated-dependencies:
- dependency-name: info.picocli:picocli
  dependency-version: 4.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: info.picocli:picocli-codegen
  dependency-version: 4.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps(deps): bump org.jetbrains:annotations from 26.0.2 to 26.0.2-1
88d7cd2 
Bumps [org.jetbrains:annotations](https://github.com/JetBrains/java-annotations) from 26.0.2 to 26.0.2-1.
- [Release notes](https://github.com/JetBrains/java-annotations/releases)
- [Changelog](https://github.com/JetBrains/java-annotations/blob/master/CHANGELOG.md)
- [Commits](JetBrains/java-annotations@26.0.2...26.0.2-1)

---
updated-dependencies:
- dependency-name: org.jetbrains:annotations
  dependency-version: 26.0.2-1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@Splatcrafter
Merge pull request #76
d34a733 
deps(deps): bump org.jetbrains:annotations from 26.0.2 to 26.0.2-1
@Splatcrafter
Merge pull request #75
8fec853 
deps(deps): bump picocli.version from 4.7.6 to 4.7.7
@Splatcrafter
Merge pull request #72
162658f 
deps(deps): bump the spring group with 2 updates
@Splatcrafter
Merge pull request #71
6a77149 
ci(deps): bump github/codeql-action from 3 to 4
@Splatcrafter
Merge pull request #70
130f80b 
ci(deps): bump actions/download-artifact from 4 to 7
@Splatcrafter
Merge pull request #69
dfe1ce8 
deps(deps-dev): bump the jackson group with 4 updates
@Splatcrafter
Merge pull request #68
dd5a2f9 
ci(deps): bump actions/github-script from 7 to 8
@Splatcrafter
Merge pull request #67
a118b30 
ci(deps): bump actions/cache from 4 to 5
@Splatcrafter
Merge pull request #66
a9d3436 
ci(deps): bump actions/upload-artifact from 4 to 6
@Splatcrafter
Move OWASP Dependency Check to a standalone scheduled workflow
d7a2cbd
@Splatcrafter Splatcrafter requested a review from a team as a code owner February 2, 2026 18:10
@Splatcrafter Splatcrafter self-assigned this Feb 2, 2026
@Splatcrafter Splatcrafter added enhancement New feature or request refactor Internal code cleanup without changing external behavior (readability, structure, maintainability) labels Feb 2, 2026
@Splatcrafter Splatcrafter merged commit 7f6cdac into main Feb 2, 2026
5 checks passed
@github-actions
Copy link

github-actions bot commented Feb 2, 2026

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 6 package(s) with unknown licenses.
  • ⚠️ 2 packages with OpenSSF Scorecard issues.
See the Details below.

License Issues

pom.xml

PackageVersionLicenseIssue Type
org.apache.maven.plugins:maven-failsafe-plugin3.5.4NullUnknown License
org.sonatype.central:central-publishing-maven-plugin0.10.0NullUnknown License
com.fasterxml.jackson.dataformat:jackson-dataformat-toml2.21.0NullUnknown License
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml2.21.0NullUnknown License

aether-datafixers-benchmarks/pom.xml

PackageVersionLicenseIssue Type
com.fasterxml.jackson.dataformat:jackson-dataformat-tomlNullUnknown License
com.fasterxml.jackson.dataformat:jackson-dataformat-yamlNullUnknown License
Denied Licenses: GPL-3.0-only, GPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/actions/checkout 6.*.* 🟢 6.6
Details
CheckScoreReason
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/checkout 6.*.* 🟢 6.6
Details
CheckScoreReason
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/download-artifact 7.*.* 🟢 6.2
Details
CheckScoreReason
Maintained🟢 1020 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 9SAST tool detected but not run on all commits
actions/actions/setup-java 5.*.* 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 810 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 82 existing vulnerabilities detected
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/actions/upload-artifact 6.*.* 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1025 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities🟢 82 existing vulnerabilities detected
maven/com.fasterxml.jackson.core:jackson-databind UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-toml UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-xml UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-yaml UnknownUnknown
maven/com.google.code.gson:gson 🟢 9.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1022 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing🟢 10project is fuzzed
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 11 contributing companies or organizations
maven/com.google.guava:guava 🟢 8.7
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 9binaries present in source code
CII-Best-Practices⚠️ 2badge detected: InProgress
Pinned-Dependencies🟢 10all dependencies are pinned
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Signed-Releases⚠️ -1no releases found
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CI-Tests🟢 927 out of 28 merged PRs checked by a CI test -- score normalized to 9
Contributors🟢 10project has 11 contributing companies or organizations
maven/de.splatgames.aether.datafixers:aether-datafixers-api UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-codec UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-core UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-testkit UnknownUnknown
maven/org.apache.maven.plugins:maven-compiler-plugin 🟢 5.7
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1017 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 12/17 approved changesets -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 55 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-enforcer-plugin UnknownUnknown
maven/org.apache.maven.plugins:maven-shade-plugin 🟢 4.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 7/18 approved changesets -- score normalized to 3
Binary-Artifacts🟢 8binaries present in source code
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 049 existing vulnerabilities detected
maven/org.codehaus.mojo:exec-maven-plugin 3.1.0 UnknownUnknown
maven/org.jetbrains:annotations ⚠️ 2.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Maintained🟢 32 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 3
Code-Review🟢 3Found 8/21 approved changesets -- score normalized to 3
Dangerous-Workflow⚠️ -1no workflows found
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities⚠️ 014 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.openjdk.jmh:jmh-core 🟢 4.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.openjdk.jmh:jmh-generator-annprocess 🟢 4.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.yaml:snakeyaml UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-api 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-cli 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-codec 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-core 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-schema-tools 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-spring-boot-starter 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-testkit 1.0.0-SNAPSHOT UnknownUnknown
maven/org.codehaus.mojo:exec-maven-plugin 3.6.3 UnknownUnknown
maven/org.codehaus.mojo:exec-maven-plugin 3.6.3 UnknownUnknown
maven/org.springframework.boot:spring-boot-starter-test 3.5.10 🟢 5.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
Fuzzing🟢 10project is fuzzed
Vulnerabilities⚠️ 012 existing vulnerabilities detected
maven/org.springframework.boot:spring-boot-dependencies 3.5.10 🟢 5.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
Fuzzing🟢 10project is fuzzed
Vulnerabilities⚠️ 012 existing vulnerabilities detected
maven/com.fasterxml.jackson.core:jackson-databind 2.21.0 UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-toml 2.21.0 UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.21.0 UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.21.0 UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-api 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-cli 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-codec 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-core 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-schema-tools 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-spring-boot-starter 1.0.0-SNAPSHOT UnknownUnknown
maven/de.splatgames.aether.datafixers:aether-datafixers-testkit 1.0.0-SNAPSHOT UnknownUnknown
maven/info.picocli:picocli 4.7.7 🟢 5.9
Details
CheckScoreReason
Code-Review⚠️ 2Found 4/19 approved changesets -- score normalized to 2
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Maintained⚠️ 10 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1
Security-Policy🟢 4security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 4binaries present in source code
SAST🟢 7SAST tool detected but not run on all commits
maven/org.apache.maven.plugins:maven-compiler-plugin 3.14.1 🟢 5.7
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1017 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 12/17 approved changesets -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 55 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-enforcer-plugin 3.6.2 UnknownUnknown
maven/org.apache.maven.plugins:maven-failsafe-plugin 3.5.4 🟢 5
Details
CheckScoreReason
Maintained🟢 1018 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 5Found 6/12 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 027 existing vulnerabilities detected
maven/org.apache.maven.plugins:maven-gpg-plugin 3.2.8 UnknownUnknown
maven/org.apache.maven.plugins:maven-javadoc-plugin 3.12.0 🟢 4.8
Details
CheckScoreReason
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1014 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 4Found 8/17 approved changesets -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Binary-Artifacts🟢 9binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
Vulnerabilities⚠️ 022 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-site-plugin 3.21.0 🟢 5.3
Details
CheckScoreReason
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 4Found 5/12 approved changesets -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 46 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-source-plugin 3.4.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-surefire-plugin 3.5.4 🟢 5
Details
CheckScoreReason
Maintained🟢 1018 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 5Found 6/12 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 027 existing vulnerabilities detected
maven/org.assertj:assertj-core 3.27.7 UnknownUnknown
maven/org.jetbrains:annotations 26.0.2-1 ⚠️ 2.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Maintained🟢 32 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 3
Code-Review🟢 3Found 8/21 approved changesets -- score normalized to 3
Dangerous-Workflow⚠️ -1no workflows found
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities⚠️ 014 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.openjdk.jmh:jmh-core 1.37 🟢 4.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.openjdk.jmh:jmh-generator-annprocess 1.37 🟢 4.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.sonatype.central:central-publishing-maven-plugin 0.10.0 UnknownUnknown
maven/org.yaml:snakeyaml 2.5 UnknownUnknown

Scanned Files

  • .github/workflows/dependency-review.yml
  • .github/workflows/release.yml
  • aether-datafixers-benchmarks/pom.xml
  • aether-datafixers-bom/pom.xml
  • aether-datafixers-cli/pom.xml
  • aether-datafixers-examples/pom.xml
  • aether-datafixers-functional-tests/pom.xml
  • aether-datafixers-spring-boot-starter/pom.xml
  • pom.xml

Splatcrafter added a commit that referenced this pull request Feb 2, 2026
@Splatcrafter
Revert "Merge pull request #78"
da0ff06 
This reverts commit 7f6cdac, reversing
changes made to 61ccff2.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@Splatcrafter Splatcrafter

Labels

enhancement New feature or request refactor Internal code cleanup without changing external behavior (readability, structure, maintainability)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Splatcrafter