chore: use snapshot version for 24.7 flow-components by ZheSun88 · Pull Request #9550 · vaadin/platform

ZheSun88 · 2026-10-01T11:00:00Z

No description provided.

Updated javaVersion to use a placeholder for dynamic versioning.

Restore the NVD database from the GitHub Actions cache (populated daily by update-nvd-db.yml on main) and pass --nvd-cache-dir/--skip-nvd-update to generateAndCheckSBOM.js, so the OWASP check does not download the NVD database on every run. The updateNVD input forces a fresh download. (cherry picked from commit 1757eea)

github-actions · 2026-10-01T12:50:07Z

Dependencies Report

🚫 Vulnerabilities:
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin@24.7-SNAPSHOT [CVE-2025-15022, GHSA-c7v7-rqfm-f44j, CVE-2026-2742] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-upload-flow@24.7-SNAPSHOT [GHSA-94g8-xv23-7656] (osv-bomber)
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-spreadsheet-flow@24.7-SNAPSHOT [CVE-2025-15022] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/flow-server@24.7-SNAPSHOT [CVE-2026-2742] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.2 [CVE-2026-18401, CVE-2026-89425, CVE-2026-89407, GHSA-r7wm-3cxj-wff9] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.jsoup/jsoup@1.18.3 [CVE-2026-71497] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.logging.log4j/log4j-api@2.24.3 [CVE-2026-49844, CVE-2026-34479, CVE-2026-34477] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:apache:log4j::::::::
  · cpe:2.3:a:apache:log4j:2.26.0:::::::*
  · cpe:2.3:a:apache:log4j:3.0.0:alpha1::::::
  · cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1::::::
  · cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2::::::
  · cpe:2.3:a:apache:log4j:3.0.0:beta1::::::
  · cpe:2.3:a:apache:log4j:3.0.0:beta2::::::
  · cpe:2.3:a:apache:log4j:3.0.0:beta3::::::
- Vulnerabilities in: pkg:maven/org.springframework.data/spring-data-commons@3.4.9 [CVE-2026-41721, CVE-2026-41711, CVE-2026-41695, CVE-2026-41716] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-webmvc@6.2.10 [CVE-2026-41845, CVE-2026-22737, CVE-2026-22735, CVE-2026-22745, CVE-2026-41843, CVE-2026-41846, CVE-2026-41853, CVE-2026-41844, CVE-2026-41841, CVE-2026-22741, CVE-2026-41842] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-websocket@6.2.10 [CVE-2025-41254, CVE-2026-41838] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/ch.qos.logback/logback-core@1.5.18 [CVE-2025-11226, CVE-2026-10532, CVE-2026-9828, CVE-2026-1225] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.44 [CVE-2026-24880, CVE-2026-43515, CVE-2026-43513, CVE-2026-25854, CVE-2026-43514, CVE-2026-65905, CVE-2025-66614, CVE-2026-42498, CVE-2026-65182, CVE-2026-41284, CVE-2026-68525, CVE-2026-43512, CVE-2025-61795, CVE-2026-24734, CVE-2026-41293, CVE-2026-34483, CVE-2025-55754, CVE-2025-55752, CVE-2026-34487, BIT-tomcat-2026-24880, BIT-tomcat-2026-43515, BIT-tomcat-2026-43513, BIT-tomcat-2026-25854, BIT-tomcat-2026-43514, BIT-tomcat-2026-65905, BIT-tomcat-2025-66614, BIT-tomcat-2026-42498, BIT-tomcat-2026-65182, BIT-tomcat-2026-41284, BIT-tomcat-2026-68525, BIT-tomcat-2026-43512, BIT-tomcat-2025-61795, BIT-tomcat-2026-24734, BIT-tomcat-2026-41293, BIT-tomcat-2026-34483, BIT-tomcat-2025-55754, BIT-tomcat-2025-55752, BIT-tomcat-2026-34487, CVE-2026-29145, CVE-2026-53434, CVE-2026-55276, CVE-2026-59083, CVE-2026-59084, CVE-2026-65183, CVE-2026-66422, CVE-2026-68569, CVE-2026-29146, CVE-2026-65927, CVE-2026-68763, CVE-2026-53404, CVE-2026-73180, CVE-2026-34500, CVE-2026-55955, CVE-2026-55956, CVE-2026-50229, CVE-2026-66299, CVE-2026-24733] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:apache:tomcat::::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone11::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone12::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone13::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone14::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone15::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone16::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone17::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone18::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone19::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone20::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone9::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone11::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone12::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone13::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone14::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone15::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone16::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone17::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone18::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone19::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone20::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone21::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone22::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone23::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone24::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone25::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone26::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone9::::::
  · cpe:2.3:a:apache:tomcat_native::::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:-::::::
  ·
  · cpe:2.3:a:apache:tomcat:10.1.0:-::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone9::::::
- Vulnerabilities in: pkg:maven/org.springframework/spring-web@6.2.10 [CVE-2026-41854] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-jdk18on@1.78 [CVE-2025-14813, CVE-2026-8763, CVE-2026-0636, CVE-2026-13506] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bitbucket.b_c/jose4j@0.9.5 [CVE-2024-29371] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3 [CVE-2026-59888, CVE-2026-54515, CVE-2026-91777, CVE-2026-83557, CVE-2026-54514, CVE-2026-54512, CVE-2026-68497, CVE-2026-54513, CVE-2026-77310, CVE-2026-19032, CVE-2026-91776, CVE-2023-35116] (osv-bomber,osv-scan,owasp)
  👌 Not a valid CVE report based on the vendor analysis and research
  ·
  · cpe:2.3:a:fasterxml:jackson-databind::::::::
  · cpe:2.3:a:fasterxml:jackson-databind:2.22.0:::::::*
- Vulnerabilities in: pkg:maven/org.cyclonedx/cyclonedx-core-java@9.0.4 [CVE-2025-64518] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.codehaus.plexus/plexus-utils@3.4.2 [CVE-2025-67030] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:codehaus-plexus:plexus-utils::::::::
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.5 [CVE-2026-22748] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.4.5 [CVE-2026-41001] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot@3.4.5 [CVE-2026-40973, CVE-2026-40974, CVE-2026-22731, CVE-2026-22733, CVE-2026-40972, CVE-2026-40975, CVE-2026-40977, CVE-2026-41001, CVE-2026-40992] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:vmware:spring_boot::::::::
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-api@1.44.1 [CVE-2026-45292, CVE-2026-54285] (osv-bomber,osv-scan,owasp)
  ·
  · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
- Vulnerabilities in: pkg:maven/org.springframework/spring-core@6.2.10 [CVE-2026-41848, CVE-2025-41249, CVE-2026-41855, CVE-2026-47884, CVE-2026-47890, CVE-2026-47891, CVE-2026-47892, CVE-2026-59313, CVE-2026-59283, CVE-2026-41838, CVE-2026-41842, CVE-2026-41850, CVE-2026-41851, CVE-2026-47885, CVE-2026-47886, CVE-2026-47888, CVE-2026-47889, CVE-2026-47893, CVE-2026-59282, CVE-2026-22740, CVE-2026-41854, CVE-2026-41844, CVE-2026-41845, CVE-2026-41846, CVE-2026-47883, CVE-2026-47887, CVE-2026-59281, CVE-2026-22737, CVE-2026-41840, CVE-2026-41841, CVE-2026-41843, CVE-2026-22745, CVE-2026-41852, CVE-2026-41853, CVE-2026-59280, CVE-2026-41839, CVE-2026-59314, CVE-2026-22741, CVE-2026-22735] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:vmware:spring_framework::::::::
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-expression@6.2.10 [CVE-2026-41852, CVE-2026-41850, CVE-2026-41851] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-web@6.4.7 [CVE-2026-47838, CVE-2026-22732] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-core@6.4.7 [CVE-2025-41248, CVE-2026-22746, CVE-2026-22751, CVE-2026-22732, CVE-2026-59270, CVE-2026-47838, CVE-2026-40988, CVE-2026-47841, CVE-2026-22748, CVE-2026-47842, CVE-2026-41706, CVE-2026-59276, CVE-2026-41003, CVE-2026-41694] (osv-bomber,osv-scan,owasp)
  ·
  · cpe:2.3:a:vmware:spring_security::::::::
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.4.7 [CVE-2026-22731, CVE-2026-22733] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.micrometer/micrometer-core@1.14.8 [CVE-2026-40984] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.retry/spring-retry@2.0.10 [CVE-2026-41710] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:broadcom:spring_retry::::::::
- Vulnerabilities in: pkg:maven/io.projectreactor.netty/reactor-netty@1.2.9 [CVE-2026-41715] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec@4.1.125.Final [CVE-2026-59901, CVE-2026-42583] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-dns@4.1.125.Final [CVE-2026-42579, CVE-2026-73508] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-haproxy@4.1.125.Final [CVE-2026-44893, CVE-2026-48059, CVE-2026-55851, CVE-2026-59919] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-http@4.1.125.Final [CVE-2026-42585, CVE-2026-59898, CVE-2026-42584, CVE-2026-56746, CVE-2026-55831, CVE-2025-67735, CVE-2026-59903, CVE-2026-42587, CVE-2026-59921, CVE-2026-50020, CVE-2026-56745, CVE-2026-42580, CVE-2026-55833, CVE-2026-33870, CVE-2026-59899, CVE-2026-41417, CVE-2026-42581] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-http2@4.1.125.Final [CVE-2026-50560, CVE-2026-47244, CVE-2026-56819, CVE-2026-48043, CVE-2026-59900, CVE-2026-42587, CVE-2026-33871] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-mqtt@4.1.125.Final [CVE-2026-44248, CVE-2026-45674, CVE-2026-47691, CVE-2026-42581, CVE-2026-42579, CVE-2026-42584, CVE-2026-56820, CVE-2026-75595, CVE-2026-33871, CVE-2026-48006, CVE-2026-48059, CVE-2026-55851, CVE-2026-56745, CVE-2026-59901, CVE-2026-75596, CVE-2026-56817, CVE-2026-44249, CVE-2026-33870, CVE-2026-42583, CVE-2026-42585, CVE-2026-42587, CVE-2026-44250, CVE-2026-44890, CVE-2026-44891, CVE-2026-44893, CVE-2026-45416, CVE-2026-46340, CVE-2026-48043, CVE-2026-50010, CVE-2026-50011, CVE-2026-55831, CVE-2026-55833, CVE-2026-56819, CVE-2026-59902, CVE-2026-59903, CVE-2026-73507, CVE-2026-73508, CVE-2026-56821, CVE-2026-56822, CVE-2026-42586, CVE-2026-50560, CVE-2026-59899, CVE-2026-59900, CVE-2026-45673, CVE-2025-67735, CVE-2026-42580, CVE-2026-56746, CVE-2026-56818, CVE-2026-59920, CVE-2026-59921, CVE-2026-59898, CVE-2026-62380, CVE-2026-59919, CVE-2026-41417, CVE-2026-47244, CVE-2026-50020, CVE-2026-45536, CVE-2026-42578] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:netty:netty::::::::
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-redis@4.1.125.Final [CVE-2026-44250, CVE-2026-50011, CVE-2026-44890, CVE-2026-48006, CVE-2026-56818, CVE-2026-42586] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-smtp@4.1.125.Final [CVE-2025-59419] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-stomp@4.1.125.Final [CVE-2026-59920, CVE-2026-44891] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-xml@4.1.125.Final [CVE-2026-56817, CVE-2026-73507] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-handler@4.1.125.Final [CVE-2026-44249, CVE-2026-75595, CVE-2026-50010, CVE-2026-75596, CVE-2026-45416] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-handler-proxy@4.1.125.Final [CVE-2026-42578] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.125.Final [CVE-2026-56820, CVE-2026-56821, CVE-2026-56822] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-resolver-dns@4.1.125.Final [CVE-2026-47691, CVE-2026-45674, CVE-2026-45673] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-transport-sctp@4.1.125.Final [CVE-2026-59902, CVE-2026-46340] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-transport-native-epoll@4.1.125.Final [CVE-2026-45536] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-transport-native-kqueue@4.1.125.Final [CVE-2026-45536] (osv-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.commons/commons-configuration2@2.12.0 [CVE-2026-45205] (osv-bomber,osv-scan,owasp)
  · cpe:2.3:a:apache:commons_configuration::::::::
- Vulnerabilities in: pkg:npm/glob@11.0.2 [CVE-2025-64756] (osv-bomber,oss-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:npm/react-router@7.5.2 [CVE-2026-40181, CVE-2026-22029, CVE-2026-53666, CVE-2025-59057, CVE-2026-42211, CVE-2026-21884, CVE-2026-42342, CVE-2025-68470, CVE-2026-55685, CVE-2026-33244, CVE-2026-22030, CVE-2026-34077, CVE-2026-53669] (osv-bomber,oss-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:npm/vite@6.3.6 [CVE-2026-39365, CVE-2025-62522, CVE-2026-53571, CVE-2026-39363, CVE-2026-53632] (osv-bomber,oss-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40opentelemetry/core@1.9.0 [CVE-2026-54285] (osv-bomber,oss-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:npm/turbo-stream@2.4.0 [CVE-2026-34077] (osv-bomber,oss-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:npm/serialize-javascript@6.0.2 [GHSA-5c6j-r48x-rmvq, CVE-2026-34043] (osv-bomber,oss-bomber,osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40vaadin/charts@24.7.13 [CVE-2026-91860] (oss-bomber)
  ·
- Vulnerabilities in: pkg:npm/%40vaadin/component-base@24.7.13 [CVE-2026-91860] (oss-bomber)
  ·
- Vulnerabilities in: pkg:npm/deepmerge@4.3.1 [CVE-2026-93753] (oss-bomber)
  ·
- Vulnerabilities in: pkg:maven/tools.jackson.core/jackson-core@2.18.2 [CVE-2026-18401, CVE-2026-89425, CVE-2026-89407] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/tools.jackson.core/jackson-databind@2.15.3 [CVE-2026-59888, CVE-2026-54515, CVE-2026-91777, CVE-2026-83557, CVE-2026-54514, CVE-2026-54512, CVE-2026-68497, CVE-2026-54513, CVE-2026-77310, CVE-2026-19032, CVE-2026-91776] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-server@24.7-SNAPSHOT [CVE-2025-15022] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.micrometer/micrometer-jetty12@1.14.8 [CVE-2026-40984] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.micrometer/micrometer-jetty11@1.14.8 [CVE-2026-40984] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-compression@4.1.125.Final [CVE-2026-59901, CVE-2026-42583] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-extension-trace-propagators@1.44.1 [CVE-2026-45292] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.44 [BIT-tomcat-2026-24880, CVE-2026-24880, BIT-tomcat-2025-66614, CVE-2025-66614, BIT-tomcat-2026-24734, CVE-2026-24734, BIT-tomcat-2026-41293, CVE-2026-41293] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat@10.1.44 [BIT-tomcat-2026-43515, CVE-2026-43515, BIT-tomcat-2026-43513, CVE-2026-43513, BIT-tomcat-2026-25854, CVE-2026-25854, BIT-tomcat-2026-43514, CVE-2026-43514, BIT-tomcat-2026-65905, CVE-2026-65905, BIT-tomcat-2025-66614, CVE-2025-66614, BIT-tomcat-2026-42498, CVE-2026-42498, BIT-tomcat-2026-65182, CVE-2026-65182, BIT-tomcat-2026-41284, CVE-2026-41284, BIT-tomcat-2026-68525, CVE-2026-68525, BIT-tomcat-2026-43512, CVE-2026-43512, BIT-tomcat-2025-61795, CVE-2025-61795, BIT-tomcat-2026-41293, CVE-2026-41293, BIT-tomcat-2026-34483, CVE-2026-34483, BIT-tomcat-2025-55754, CVE-2025-55754, BIT-tomcat-2025-55752, CVE-2025-55752, BIT-tomcat-2026-34487, CVE-2026-34487] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.44 [BIT-tomcat-2026-43515, CVE-2026-43515, BIT-tomcat-2026-43513, CVE-2026-43513, BIT-tomcat-2026-25854, CVE-2026-25854, BIT-tomcat-2026-43514, CVE-2026-43514, BIT-tomcat-2026-65905, CVE-2026-65905, BIT-tomcat-2026-42498, CVE-2026-42498, BIT-tomcat-2026-65182, CVE-2026-65182, BIT-tomcat-2026-41284, CVE-2026-41284, BIT-tomcat-2026-68525, CVE-2026-68525, BIT-tomcat-2026-43512, CVE-2026-43512, BIT-tomcat-2025-61795, CVE-2025-61795, BIT-tomcat-2026-34483, CVE-2026-34483, BIT-tomcat-2025-55754, CVE-2025-55754, BIT-tomcat-2025-55752, CVE-2025-55752] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.44 [BIT-tomcat-2026-34487, CVE-2026-34487] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-jdk14@1.78 [CVE-2025-14813, CVE-2026-0636] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.78 [CVE-2025-14813, CVE-2026-8763, CVE-2026-0636, CVE-2026-13506] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-debug-jdk14@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-ext-jdk14@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-ext-jdk15to18@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-ext-jdk18on@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk14@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15to18@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk18on@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-debug-jdk15on@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-jdk15on@1.78 [CVE-2025-14813] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bc-fips@1.78 [CVE-2026-8763, CVE-2026-13506] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bouncycastle/bcprov-lts8on@1.78 [CVE-2026-8763, CVE-2026-13506] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-webflux@6.2.10 [CVE-2026-22737, CVE-2026-22735, CVE-2026-22745, CVE-2026-41843, CVE-2026-41853, CVE-2026-41844, CVE-2026-41841, CVE-2026-22741, CVE-2026-41842] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40opentelemetry/core@1.8.0 [CVE-2026-54285] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40remix-run/router@7.5.2 [CVE-2026-40181, CVE-2026-22029] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40remix-run/react@7.5.2 [CVE-2025-59057, CVE-2026-21884] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40remix-run/server-runtime@7.5.2 [CVE-2026-42342, CVE-2026-22030] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/turbo-stream@7.5.2 [CVE-2026-34077] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/react-router@2.4.0 [CVE-2026-34077] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/vite-plus@6.3.6 [CVE-2026-53571, CVE-2026-53632] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/launch-editor@6.3.6 [CVE-2026-53632] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.jetbrains.kotlin/kotlin-reflect@1.9.20 [CVE-2026-53914, CVE-2020-29582] (owasp)
  · cpe:2.3:a:jetbrains:kotlin::::::::
  · cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:::::::*
  · cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*
  · cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:::::::*
- Vulnerabilities in: pkg:maven/org.jetbrains.kotlin/kotlin-stdlib@1.6.20 [CVE-2026-53914, CVE-2020-29582] (owasp)
  · cpe:2.3:a:jetbrains:kotlin::::::::
  · cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:::::::*
  · cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*
  · cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:::::::*
- Vulnerabilities in: pkg:maven/io.netty/netty-codec-memcache@4.1.125.Final [CVE-2026-45674, CVE-2026-47691, CVE-2026-42581, CVE-2026-42579, CVE-2026-42584, CVE-2026-56820, CVE-2026-75595, CVE-2026-33871, CVE-2026-48006, CVE-2026-48059, CVE-2026-55851, CVE-2026-56745, CVE-2026-59901, CVE-2026-75596, CVE-2026-56817, CVE-2026-44249, CVE-2026-33870, CVE-2026-42583, CVE-2026-42585, CVE-2026-42587, CVE-2026-44248, CVE-2026-44250, CVE-2026-44890, CVE-2026-44891, CVE-2026-44893, CVE-2026-45416, CVE-2026-46340, CVE-2026-48043, CVE-2026-50010, CVE-2026-50011, CVE-2026-55831, CVE-2026-55833, CVE-2026-56819, CVE-2026-59902, CVE-2026-59903, CVE-2026-73507, CVE-2026-73508, CVE-2026-56821, CVE-2026-56822, CVE-2026-42586, CVE-2026-50560, CVE-2026-59899, CVE-2026-59900, CVE-2026-45673, CVE-2025-67735, CVE-2026-42580, CVE-2026-56746, CVE-2026-56818, CVE-2026-59920, CVE-2026-59921, CVE-2026-59898, CVE-2026-62380, CVE-2026-59919, CVE-2026-41417, CVE-2026-47244, CVE-2026-50020, CVE-2026-45536, CVE-2026-42578] (owasp)
  · cpe:2.3:a:netty:netty::::::::
- Vulnerabilities in: pkg:maven/io.netty/netty-transport@4.1.125.Final [CVE-2026-45674, CVE-2026-47691, CVE-2026-42581, CVE-2026-42579, CVE-2026-42584, CVE-2026-56820, CVE-2026-75595, CVE-2026-33871, CVE-2026-48006, CVE-2026-48059, CVE-2026-55851, CVE-2026-56745, CVE-2026-59901, CVE-2026-75596, CVE-2026-56817, CVE-2026-44249, CVE-2026-33870, CVE-2026-42583, CVE-2026-42585, CVE-2026-42587, CVE-2026-44248, CVE-2026-44250, CVE-2026-44890, CVE-2026-44891, CVE-2026-44893, CVE-2026-45416, CVE-2026-46340, CVE-2026-48043, CVE-2026-50010, CVE-2026-50011, CVE-2026-55831, CVE-2026-55833, CVE-2026-56819, CVE-2026-59902, CVE-2026-59903, CVE-2026-73507, CVE-2026-73508, CVE-2026-56821, CVE-2026-56822, CVE-2026-42586, CVE-2026-50560, CVE-2026-59899, CVE-2026-59900, CVE-2026-45673, CVE-2025-67735, CVE-2026-42580, CVE-2026-56746, CVE-2026-56818, CVE-2026-59920, CVE-2026-59921, CVE-2026-59898, CVE-2026-62380, CVE-2026-59919, CVE-2026-41417, CVE-2026-47244, CVE-2026-50020, CVE-2026-45536, CVE-2026-42578] (owasp)
  · cpe:2.3:a:netty:netty::::::::
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-api-incubator@1.44.1-alpha [CVE-2026-54285] (owasp)
  · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-context@1.51.0 [CVE-2026-54285] (owasp)
  · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
- Vulnerabilities in: pkg:maven/io.projectreactor.netty/reactor-netty-core@1.2.9 [CVE-2026-47874] (owasp)
  · cpe:2.3:a:pivotal:reactor_netty::::::::
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.7 [CVE-2026-40974, CVE-2026-22731, CVE-2026-22733, CVE-2026-40972, CVE-2026-40975, CVE-2026-40973, CVE-2026-40977, CVE-2026-41001, CVE-2026-40992] (owasp)
  · cpe:2.3:a:vmware:spring_boot::::::::
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot-starter@3.4.9 [CVE-2026-40974, CVE-2026-22731, CVE-2026-22733, CVE-2026-40972, CVE-2026-40975, CVE-2026-40973, CVE-2026-40977, CVE-2026-41001, CVE-2026-40992] (owasp)
  · cpe:2.3:a:vmware:spring_boot::::::::
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot-starter-aop@3.4.3 [CVE-2026-40974, CVE-2026-22731, CVE-2026-22733, CVE-2026-40972, CVE-2026-40975, CVE-2026-40973, CVE-2026-40977, CVE-2026-41001, CVE-2026-40992] (owasp)
  · cpe:2.3:a:vmware:spring_boot::::::::
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-config@6.4.5 [CVE-2026-22732, CVE-2026-59270, CVE-2026-47838, CVE-2026-40988, CVE-2026-47841, CVE-2026-22748, CVE-2026-47842, CVE-2026-41706, CVE-2026-59276, CVE-2026-41003, CVE-2026-41694, CVE-2026-22751, CVE-2026-22746] (owasp)
  · cpe:2.3:a:vmware:spring_security::::::::
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.5 [CVE-2026-22732, CVE-2026-59270, CVE-2026-47838, CVE-2026-40988, CVE-2026-47841, CVE-2026-22748, CVE-2026-47842, CVE-2026-41706, CVE-2026-59276, CVE-2026-41003, CVE-2026-41694, CVE-2026-22751, CVE-2026-22746] (owasp)
  · cpe:2.3:a:vmware:spring_security::::::::
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-core@24.7-SNAPSHOT [CVE-2026-2742, CVE-2026-2741] (owasp)
  · cpe:2.3:a:vaadin:vaadin::::::::
- Vulnerabilities in: pkg:javascript/quill@1.3.7 [CVE-2021-3163] (owasp)
  · cpe:2.3:a:slab:quill:4.8.0:::::node.js::
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-swing-kit-flow@2.4.1 [CVE-2021-33604] (owasp)
  · cpe:2.3:a:vaadin:flow-server::::::::
  · cpe:2.3:a:vaadin:vaadin::::::::
🟠 Known Vulnerabilities:
- Vulnerabilities in: pkg:maven/me.friwi/jcef-api@jcef-99c2f7a%2Bcef-127.3.1%2Bg6cbb30e%2Bchromium-127.0.6533.100 [CVE-2024-21639, CVE-2024-21640] (owasp)
  👌 Wait for the update from the jcefmaven community. Meanwhile the swing-kit is supposed to be used with fixed websites and not to browse the internet, we have a check for that, so the only possible attacker would be the same person that created the swing application, aka our customer devs. so this vulnerability is not classified by us as critical issue
  · cpe:2.3:a:chromiumembedded:chromium_embedded_framework::::::::
📔 No Core License Issues
📔 No License Issues
🟠 Changes in 24.7-SNAPSHOT since V24.7.15
- 6 packages removed (6 external, 0 vaadin)
- 4 packages added (4 external, 0 vaadin)
- 231 packages modified (158 external, 73 vaadin)
- 729 packages same (575 external, 154 vaadin)

[Click for more Details]

ZheSun88 added 4 commits October 1, 2026 13:59

use snapshot version for 24.7 flow-components

8c01d26

Change javaVersion to '{{version}}' in versions.json

0f87fc8

Updated javaVersion to use a placeholder for dynamic versioning.

Update javaVersion to use template variable

1672196

Update flow/hilla to 24.7-SNAPSHOT in versions.json

873d6f0

Navigation Menu

chore: use snapshot version for 24.7 flow-components - #9550

chore: use snapshot version for 24.7 flow-components#9550
ZheSun88 wants to merge 5 commits into
24.7from
ZheSun88-patch-20

ZheSun88 commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ZheSun88 commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependencies Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Oct 1, 2026 •

edited

Loading