Skip to content

[Snyk] Upgrade org.graalvm.sdk:graal-sdk from 21.2.0 to 21.3.4#703

Merged
lvca merged 1 commit into
mainfrom
snyk-upgrade-0e8136b280d21910d95303d35ddaf62a
Dec 25, 2022
Merged

[Snyk] Upgrade org.graalvm.sdk:graal-sdk from 21.2.0 to 21.3.4#703
lvca merged 1 commit into
mainfrom
snyk-upgrade-0e8136b280d21910d95303d35ddaf62a

Conversation

@snyk-bot
Copy link
Copy Markdown
Contributor

Snyk has created this PR to upgrade org.graalvm.sdk:graal-sdk from 21.2.0 to 21.3.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 7 versions ahead of your current version.
  • The recommended version was released 2 months ago, on 2022-10-17.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGGRAALVMSDK-2347581
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Integer Overflow or Wraparound
SNYK-JAVA-ORGGRAALVMSDK-2346571
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Improper Input Validation
SNYK-JAVA-ORGGRAALVMSDK-2346453
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Uncaught Exception
SNYK-JAVA-ORGGRAALVMSDK-2346426
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Improper Input Validation
SNYK-JAVA-ORGGRAALVMSDK-2346397
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Integer Overflow or Wraparound
SNYK-JAVA-ORGGRAALVMSDK-2346395
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Information Exposure
SNYK-JAVA-ORGGRAALVMSDK-2346393
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Infinite loop
SNYK-JAVA-ORGGRAALVMSDK-2346391
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGGRAALVMSDK-2343493
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGGRAALVMSDK-2343490
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGGRAALVMSDK-2343487
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Information Exposure
SNYK-JAVA-ORGGRAALVMSDK-2343477
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGGRAALVMSDK-2343474
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Out-of-bounds Write
SNYK-JAVA-ORGGRAALVMSDK-2343466
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Access Restriction Bypass
SNYK-JAVA-ORGGRAALVMSDK-1766172
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Improper Access Control
SNYK-JAVA-ORGGRAALVMSDK-1765539
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Deserialization of Untrusted Data
SNYK-JAVA-ORGGRAALVMSDK-2343470
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit
Timing Attack
SNYK-JAVA-ORGGRAALVMSDK-1766242
479/1000
Why? Has a fix available, CVSS 5.3
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@lvca lvca self-assigned this Dec 25, 2022
@lvca lvca merged commit f8110b5 into main Dec 25, 2022
@lvca lvca deleted the snyk-upgrade-0e8136b280d21910d95303d35ddaf62a branch December 25, 2022 20:28
@lvca lvca added this to the 23.1.1 milestone Dec 25, 2022
@lvca lvca added the security label Dec 25, 2022
mergify Bot added a commit that referenced this pull request May 31, 2026
Bumps the github-actions group with 2 updates: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) and [actions/setup-dotnet](https://github.com/actions/setup-dotnet).
Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0
Release notes

*Sourced from [docker/setup-qemu-action's releases](https://github.com/docker/setup-qemu-action/releases).*

> v4.1.0
> ------
>
> * Add `reset` input to uninstall current emulators by [`@​crazy-max`](https://github.com/crazy-max) in [docker/setup-qemu-action#21](https://redirect.github.com/docker/setup-qemu-action/pull/21)
> * Bump `@​docker/actions-toolkit` from 0.77.0 to 0.91.0 in [docker/setup-qemu-action#250](https://redirect.github.com/docker/setup-qemu-action/pull/250) [docker/setup-qemu-action#247](https://redirect.github.com/docker/setup-qemu-action/pull/247)
> * Bump brace-expansion from 1.1.12 to 1.1.15 in [docker/setup-qemu-action#265](https://redirect.github.com/docker/setup-qemu-action/pull/265)
> * Bump fast-xml-builder from 1.0.0 to 1.2.0 in [docker/setup-qemu-action#286](https://redirect.github.com/docker/setup-qemu-action/pull/286)
> * Bump fast-xml-parser from 5.4.2 to 5.8.0 in [docker/setup-qemu-action#255](https://redirect.github.com/docker/setup-qemu-action/pull/255)
> * Bump flatted from 3.3.3 to 3.4.2 in [docker/setup-qemu-action#257](https://redirect.github.com/docker/setup-qemu-action/pull/257)
> * Bump glob from 10.3.15 to 10.5.0 in [docker/setup-qemu-action#254](https://redirect.github.com/docker/setup-qemu-action/pull/254)
> * Bump handlebars from 4.7.8 to 4.7.9 in [docker/setup-qemu-action#262](https://redirect.github.com/docker/setup-qemu-action/pull/262)
> * Bump lodash from 4.17.23 to 4.18.1 in [docker/setup-qemu-action#273](https://redirect.github.com/docker/setup-qemu-action/pull/273)
> * Bump postcss from 8.5.6 to 8.5.10 in [docker/setup-qemu-action#285](https://redirect.github.com/docker/setup-qemu-action/pull/285)
> * Bump tar from 6.2.1 to 7.5.15 in [docker/setup-qemu-action#287](https://redirect.github.com/docker/setup-qemu-action/pull/287)
> * Bump tmp from 0.2.5 to 0.2.6 in [docker/setup-qemu-action#291](https://redirect.github.com/docker/setup-qemu-action/pull/291)
> * Bump undici from 6.23.0 to 6.26.0 in [docker/setup-qemu-action#251](https://redirect.github.com/docker/setup-qemu-action/pull/251)
> * Bump vite from 7.3.1 to 7.3.2 in [docker/setup-qemu-action#271](https://redirect.github.com/docker/setup-qemu-action/pull/271)
>
> **Full Changelog**: <docker/setup-qemu-action@v4.0.0...v4.1.0>


Commits

* [`0611638`](docker/setup-qemu-action@0611638) Merge pull request [#21](https://redirect.github.com/docker/setup-qemu-action/issues/21) from crazy-max/uninst
* [`ce59c81`](docker/setup-qemu-action@ce59c81) chore: update generated content
* [`2ddad44`](docker/setup-qemu-action@2ddad44) uninstall current emulators
* [`8c37cd6`](docker/setup-qemu-action@8c37cd6) Merge pull request [#250](https://redirect.github.com/docker/setup-qemu-action/issues/250) from docker/dependabot/npm\_and\_yarn/docker/actions-to...
* [`d1a0ff3`](docker/setup-qemu-action@d1a0ff3) chore: update generated content
* [`0a8f3dc`](docker/setup-qemu-action@0a8f3dc) build(deps): bump `@​docker/actions-toolkit` from 0.79.0 to 0.91.0
* [`9430f61`](docker/setup-qemu-action@9430f61) Merge pull request [#291](https://redirect.github.com/docker/setup-qemu-action/issues/291) from docker/dependabot/npm\_and\_yarn/tmp-0.2.6
* [`978bd77`](docker/setup-qemu-action@978bd77) chore: update generated content
* [`3479feb`](docker/setup-qemu-action@3479feb) build(deps): bump tmp from 0.2.5 to 0.2.6
* [`b113c26`](docker/setup-qemu-action@b113c26) Merge pull request [#255](https://redirect.github.com/docker/setup-qemu-action/issues/255) from docker/dependabot/npm\_and\_yarn/fast-xml-parser-5...
* Additional commits viewable in [compare view](docker/setup-qemu-action@ce36039...0611638)
  
Updates `actions/setup-dotnet` from 5.2.0 to 5.3.0
Release notes

*Sourced from [actions/setup-dotnet's releases](https://github.com/actions/setup-dotnet/releases).*

> v5.3.0
> ------
>
> What's Changed
> --------------
>
> ### Enhancements
>
> * Add dotnet-version: latest support with dotnet-channel input by [`@​mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-dotnet#730](https://redirect.github.com/actions/setup-dotnet/pull/730)
> * Support global.json's rollForward latest\* variants by [`@​js6pak`](https://github.com/js6pak) in [actions/setup-dotnet#538](https://redirect.github.com/actions/setup-dotnet/pull/538)
> * Improve version resolution by [`@​akoeplinger`](https://github.com/akoeplinger) in [actions/setup-dotnet#560](https://redirect.github.com/actions/setup-dotnet/pull/560)
>
> ### Dependency Updates
>
> * Upgrade @actions/\* and fast-xml-parser dependencies by [`@​Copilot`](https://github.com/Copilot) in [actions/setup-dotnet#728](https://redirect.github.com/actions/setup-dotnet/pull/728)
> * Update install scripts to v2026.05.19 (preserve archive links) by [`@​MichaelSimons`](https://github.com/MichaelSimons) in [actions/setup-dotnet#736](https://redirect.github.com/actions/setup-dotnet/pull/736)
> * Add rollForward note in README, improve proxy health check in e2e tests and bump version to v5.3.0 by [`@​priyagupta108`](https://github.com/priyagupta108) in [actions/setup-dotnet#738](https://redirect.github.com/actions/setup-dotnet/pull/738)
>
> ### Bug Fixes
>
> * Update Test Proxy job by [`@​priya-kinthali`](https://github.com/priya-kinthali) in [actions/setup-dotnet#703](https://redirect.github.com/actions/setup-dotnet/pull/703)
>
> New Contributors
> ----------------
>
> * [`@​Copilot`](https://github.com/Copilot) made their first contribution in [actions/setup-dotnet#728](https://redirect.github.com/actions/setup-dotnet/pull/728)
> * [`@​akoeplinger`](https://github.com/akoeplinger) made their first contribution in [actions/setup-dotnet#560](https://redirect.github.com/actions/setup-dotnet/pull/560)
> * [`@​MichaelSimons`](https://github.com/MichaelSimons) made their first contribution in [actions/setup-dotnet#736](https://redirect.github.com/actions/setup-dotnet/pull/736)
> * [`@​js6pak`](https://github.com/js6pak) made their first contribution in [actions/setup-dotnet#538](https://redirect.github.com/actions/setup-dotnet/pull/538)
>
> **Full Changelog**: <actions/setup-dotnet@v5...v5.3.0>


Commits

* [`9a946fd`](actions/setup-dotnet@9a946fd) Add rollForward note in README, improve proxy health check in e2e tests and b...
* [`98af08b`](actions/setup-dotnet@98af08b) Support global.json's rollForward latest\* variants ([#538](https://redirect.github.com/actions/setup-dotnet/issues/538))
* [`8404272`](actions/setup-dotnet@8404272) Update install scripts to v2026.05.19 ([#736](https://redirect.github.com/actions/setup-dotnet/issues/736))
* [`f1970f5`](actions/setup-dotnet@f1970f5) Don't download releases-index.json to resolve major version ([#560](https://redirect.github.com/actions/setup-dotnet/issues/560))
* [`af9211b`](actions/setup-dotnet@af9211b) Add dotnet-version: latest support with dotnet-channel input ([#730](https://redirect.github.com/actions/setup-dotnet/issues/730))
* [`df991ae`](actions/setup-dotnet@df991ae) chore: bump @actions/\* and fast-xml-parser dependencies ([#728](https://redirect.github.com/actions/setup-dotnet/issues/728))
* [`a66eefa`](actions/setup-dotnet@a66eefa) CI: remove manual PowerShell install from test-proxy job (e2e-tests.yml) ([#703](https://redirect.github.com/actions/setup-dotnet/issues/703))
* See full diff in [compare view](actions/setup-dotnet@c2fa09f...9a946fd)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants