Tags: Staffbase/plugins-sdk-java
Tags
CI-1108: Add cooldown to Dependabot to mitigate supply-chain attacks (#… …147) Add a 7-day cooldown period before Dependabot updates dependencies. This helps protect against supply-chain attacks by ensuring new package versions have time to be vetted by the community before adoption. Co-authored-by: opencode <[email protected]>
Bump log4j.version from 2.20.0 to 2.23.1 Bumps `log4j.version` from 2.20.0 to 2.23.1. Updates `org.apache.logging.log4j:log4j-core` from 2.20.0 to 2.23.1 Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.20.0 to 2.23.1 Updates `org.apache.logging.log4j:log4j-jul` from 2.20.0 to 2.23.1 --- updated-dependencies: - dependency-name: org.apache.logging.log4j:log4j-core dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.logging.log4j:log4j-slf4j-impl dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.logging.log4j:log4j-jul dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bump org.apache.maven.plugins:maven-project-info-reports-plugin Bumps [org.apache.maven.plugins:maven-project-info-reports-plugin](https://github.com/apache/maven-project-info-reports-plugin) from 3.4.5 to 3.5.0. - [Commits](apache/maven-project-info-reports-plugin@maven-project-info-reports-plugin-3.4.5...maven-project-info-reports-plugin-3.5.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-project-info-reports-plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
PreviousNext