Skip to content

Merge pull request #67 from uhafner/dependabot/github_actions/release… #248

Merge pull request #67 from uhafner/dependabot/github_actions/release…

Merge pull request #67 from uhafner/dependabot/github_actions/release… #248

Triggered via push February 26, 2025 09:48
Status Success
Total duration 2m 59s
Artifacts

codeql.yml

on: push
Matrix: Analyze code
Fit to window
Zoom out
Zoom in

Annotations

30 warnings
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L105
Lines 105-107 are not covered by tests
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L116
Lines 116-158 are not covered by tests
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L177
Lines 177-178 are not covered by tests
Partially covered line: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L104
Line 104 is only partially covered, one branch is missing
Partially covered line: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L110
Line 110 is only partially covered, one branch is missing
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L72
Lines 72-184 are not covered by tests
Analyze code (java)
Failed to save: Failed to CreateCacheEntry: Received non-retryable error: Failed request: (409) Conflict: cache entry with the same key, version, and scope already exists
Analyze code (java)
Cache not found for keys: setup-java-Linux-x64-maven-3f8ab86cd666b27ef213f87059866778201d4805aa9c5aeb204af8b659550fc0
OWASP Dependency Check: CVE-2024-57699: json-smart-2.5.1.jar#L0
A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.
OWASP Dependency Check: CVE-2025-23215: pmd-core-7.7.0.jar#L0
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid.
OWASP Dependency Check: CVE-2017-10355: xercesImpl-2.12.2.jar#L0
sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS) The software contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L105
Lines 105-107 are not covered by tests
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L116
Lines 116-158 are not covered by tests
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L177
Lines 177-178 are not covered by tests
Partially covered line: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L104
Line 104 is only partially covered, one branch is missing
Partially covered line: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L110
Line 110 is only partially covered, one branch is missing
Not covered lines: src/main/java/edu/hm/hafner/grading/github/QualityMonitor.java#L72
Lines 72-184 are not covered by tests