Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.4 to 3.5.6 by dependabot[bot] · Pull Request #4538 · project-ncl/pnc

dependabot · 2026-06-15T20:43:15Z

Bumps org.apache.maven.plugins:maven-failsafe-plugin from 3.5.4 to 3.5.6.

Release notes

Sourced from org.apache.maven.plugins:maven-failsafe-plugin's releases.

3.5.6

🚀 New features and improvements

Introduce reportTestTimestamp option and include timestamp for test sets and test cases (#3261) (#3302) @olamy

🐛 Bug Fixes

Issue #2613 Debugging failsafe tests: Message 'Listening for transport dt_socket at address' is not displayed anymore when using maven.surefire.debug (#3353) (#3354) @olamy

Ensure that the statistics filename is calculated only once. (#3326) (#3327) @olamy

Add flakes attribute to use in testsuite report (#3306) (#3308) @olamy

[BACKPORT 3.5.x] [SUREFIRE-2049] - Fix SHUTDOWN type lost during command serialization. (#3270) (#3289) @olamy

fix: null guard for context map (#3269) (#3272) @olamy

👻 Maintenance

3.5.x/bug/cherry pick embedded mode its (#3328) @olamy

Use surefire 3.5.5 by project itself for testing (#3324) @slawekjaranowski

Follow Oracle javadoc guidelines (#3177) @elharo

📦 Dependency updates

Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3 (#3334) @dependabot[bot]

Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#3350) @dependabot[bot]

3.5.5

🚀 New features and improvements

Replace runing external process and parsing output with simple ProcessHandle if available (Java9+) (#3252) @olamy

Pass slf4j context to spawned thread (#3241) @scottrw93

[SUREFIRE-3239] - allow override of statistics file checksum (#3247) @XN137

Reduce log level for skipped tests result to info (#3232) @strangelookingnerd

🐛 Bug Fixes

Use PowerShell instead of WMIC for detecting zombie process on Windows (#3258) @jbliznak. Please note if you are using Windows with Java 8 and not PowerShell (you have options to: use Java 9+, install PowerShell or stay on Surefire 3.5.4)

Properly work with test failures caused during beforeAll phase (#3194) @Frawless

📝 Documentation updates

Clarify how late placeholder replacement (@{...}) deals with (#3208) @kwin

👻 Maintenance

Fix Jenkin badges in README (#3254) @slawekjaranowski

Use JUnit5 in failsafe ITs (#3251) @slawekjaranowski

Remove long-deprecated unused encoding property from VerifyMojo (#3198) @Tomlincoln

Add IT and deal with corner cases of handling beforeAll failures (#3200) @Frawless

Revert PR #3194 that handle beforeAll failures to follow proper contributing rules (#3211) @Frawless

... (truncated)

Commits

25ea054 [maven-release-plugin] prepare release surefire-3.5.6
e5f374c Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3
dadd55b Issue #2613 Debugging failsafe tests: Message 'Listening for transport dt_soc...
39dd250 Bump commons-io:commons-io from 2.21.0 to 2.22.0
2774273 Ensure that the statistics filename is calculated only once. (#3326) (#3327)
0d5df8a 3.5.x/bug/cherry pick embedded mode its (#3328)
04ad9a2 Use surefire 3.5.5 by project itself for testing
37e8f69 Add flakes attribute to use in testsuite report (#3306) (#3308)
a970fef Introduce reportTestTimestamp option and include timestamp for test sets and ...
e838393 deploy 3.5.x branch to nexus
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) from 3.5.4 to 3.5.6. - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.5.4...surefire-3.5.6) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-failsafe-plugin dependency-version: 3.5.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-06-15T20:49:10Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

⚠️ SAST findings detected

SCA scan output

8.0.jar
				|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
		|-- opentelemetry-semconv-1.29.0-alpha.jar
			|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
	|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
|-- rest-api-3.6.0-SNAPSHOT-java-client-jakarta.jar
	|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
|-- rest-client-3.6.0-SNAPSHOT-jakarta.jar
	|-- vertx-core-3.9.14.jar [1 MEDIUM]
		|-- netty-codec-http2-4.2.9.Final.jar [2 HIGH, 3 MEDIUM]
			|-- netty-codec-compression-4.2.9.Final.jar [1 HIGH]
			|-- netty-codec-http-4.2.9.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
		|-- netty-codec-http-4.2.9.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-codec-compression-4.2.9.Final.jar [1 HIGH]
			|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
		|-- netty-handler-proxy-4.2.9.Final.jar [1 MEDIUM]
			|-- netty-codec-http-4.2.9.Final.jar [3 HIGH, 5 MEDIUM]
			|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
		|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
		|-- netty-resolver-dns-4.2.9.Final.jar [2 HIGH, 1 MEDIUM]
			|-- netty-codec-dns-4.2.9.Final.jar [1 HIGH]
			|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
rest-client-3.6.0-SNAPSHOT.jar
|-- vertx-core-3.9.14.jar [1 MEDIUM]
	|-- netty-codec-http2-4.2.9.Final.jar [2 HIGH, 3 MEDIUM]
		|-- netty-codec-compression-4.2.9.Final.jar [1 HIGH]
		|-- netty-codec-http-4.2.9.Final.jar [3 HIGH, 5 MEDIUM]
		|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
	|-- netty-codec-http-4.2.9.Final.jar [3 HIGH, 5 MEDIUM]
		|-- netty-codec-compression-4.2.9.Final.jar [1 HIGH]
		|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
	|-- netty-handler-proxy-4.2.9.Final.jar [1 MEDIUM]
		|-- netty-codec-http-4.2.9.Final.jar [3 HIGH, 5 MEDIUM]
		|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
	|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
	|-- netty-resolver-dns-4.2.9.Final.jar [2 HIGH, 1 MEDIUM]
		|-- netty-codec-dns-4.2.9.Final.jar [1 HIGH]
		|-- netty-handler-4.1.77.Final-redhat-00001.jar [4 HIGH, 1 MEDIUM]
|-- common-3.6.0-SNAPSHOT.jar
	|-- opentelemetry-instrumentation-annotations-2.24.0.jar
		|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
|-- dto-3.6.0-SNAPSHOT-patch-builders.jar
	|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
	|-- pnc-api-3.5.0.jar
		|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
|-- rest-api-3.6.0-SNAPSHOT-java-client.jar
	|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
	|-- dto-3.6.0-SNAPSHOT.jar
		|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
spi-3.6.0-SNAPSHOT.jar
|-- opentelemetry-instrumentation-annotations-2.24.0.jar
	|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
|-- dto-3.6.0-SNAPSHOT.jar
	|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
	|-- pnc-api-3.5.0.jar
		|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
|-- model-3.6.0-SNAPSHOT.jar
	|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
	|-- pnc-common-3.4.0.jar
		|-- opentelemetry-ext-cli-java-1.5.0.jar
			|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
			|-- opentelemetry-exporter-otlp-1.58.0.jar
				|-- opentelemetry-exporter-otlp-common-1.58.0.jar
					|-- opentelemetry-exporter-common-1.58.0.jar
						|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
				|-- opentelemetry-sdk-metrics-1.58.0.jar
					|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
			|-- opentelemetry-sdk-1.58.0.jar
				|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
				|-- opentelemetry-sdk-common-1.58.0.jar
					|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
				|-- opentelemetry-sdk-logs-1.58.0.jar
					|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
				|-- opentelemetry-sdk-trace-1.58.0.jar
					|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.12.0.redhat-00001.jar [1 MEDIUM]
		|-- hibernate-validator-6.0.23.Final-redhat-00001.jar [1 HIGH]
test-common-3.6.0-SNAPSHOT.jar
|-- shrinkwrap-resolver-api-maven-3.3.4.jar
	|-- maven-model-3.9.9.jar
		|-- plexus-utils-3.5.1.jar [1 HIGH]
|-- shrinkwrap-resolver-impl-maven-archive-3.3.4.jar
	|-- plexus-compiler-javac-2.15.0.jar
		|-- plexus-compiler-api-2.15.0.jar
			|-- plexus-utils-3.5.1.jar [1 HIGH]
		|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- org.eclipse.sisu.plexus-0.9.0.M3.jar
		|-- plexus-utils-3.5.1.jar [1 HIGH]
		|-- plexus-xml-3.0.1.jar
			|-- plexus-utils-3.5.1.jar [1 HIGH]
|-- shrinkwrap-resolver-impl-maven-3.3.4.jar
	|-- guava-30.1.0.redhat-00001.jar [1 MEDIUM, 1 LOW]
	|-- guice-5.1.0.jar
		|-- guava-30.1.0.redhat-00001.jar [1 MEDIUM, 1 LOW]
	|-- maven-model-builder-3.9.9.jar
		|-- guava-30.1.0.redhat-00001.jar [1 MEDIUM, 1 LOW]
		|-- maven-artifact-3.9.9.jar
			|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- maven-repository-metadata-3.9.9.jar
		|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- maven-resolver-provider-3.9.9.jar
		|-- guava-30.1.0.redhat-00001.jar [1 MEDIUM, 1 LOW]
		|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- maven-settings-builder-3.9.9.jar
		|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- maven-settings-3.9.9.jar
		|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- plexus-sec-dispatcher-2.0.jar
		|-- plexus-utils-3.5.1.jar [1 HIGH]
	|-- plexus-utils-3.5.1.jar [1 HIGH]


No Policy violations were detected

Project 'pnc' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=0225ec74-4391-4ac9-bfb5-714664caa6bb
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=c9f6fd516a5241de98250adf2d7ea547bc93772d823b4ff28dd89e6f18810351

Mend AI scan succeeded.

Support Token: 1c2d50f3043c841c783de4d244ca052661781556501894

SAST scan output

warning: 'error' method of 'org.slf4j.Logger' object could be abused to perform a Log Injection attack. User input reached a Log4j sink. (mapper/src/main/java/org/jboss/pnc/mapper/abstracts/AbstractArtifactMapper.java:92)

Full logs and artifacts

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Jun 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.4 to 3.5.6#4538

Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.4 to 3.5.6#4538
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6

dependabot Bot commented on behalf of github Jun 15, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 15, 2026

3.5.6

🚀 New features and improvements

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

3.5.5

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

Uh oh!

github-actions Bot commented Jun 15, 2026

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants