From 6167b6cc86a7ff5989c108eb81df258fe1172b3a Mon Sep 17 00:00:00 2001 From: "Brian M. Carr" Date: Tue, 6 Oct 2026 09:20:06 -0500 Subject: [PATCH] Bump CycloneDX Gradle plugin to 3.4.1 (Dependabot #4) 3.4.1 depends on maven-core 3.9.16, which brings plexus-utils 3.6.1 and clears GHSA-6fmv-xxpf-w3cw (CVE-2025-67030, extractFile directory traversal). The jackson 2.22.3 buildscript pin is still needed: the plugin's own jackson-dataformat-xml is 2.22.1. Co-Authored-By: Claude Opus 5.5 --- gradle/libs.versions.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 55bfd68..7fe799d 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -8,7 +8,7 @@ google-osdetector-plugin = "1.7.3" graalvm-native-plugin = "0.11.0" google-protobuf-plugin = "0.9.6" jlleitschuh-ktlint-plugin = "14.2.0" -cyclonedx = "3.2.4" +cyclonedx = "3.4.1" jk1-dependency-license-report = "2.9" [plugins]