From e5720c7deea1b8469095f07b8a50bc79282220e5 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 25 Feb 2026 04:45:35 +0000 Subject: [PATCH 01/12] Update dependency com.fasterxml.jackson:jackson-bom to v2.21.1 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 1aa965a..35969da 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -56,7 +56,7 @@ com.fasterxml.jackson jackson-bom - 2.21.0 + 2.21.1 pom import From abb7db931cf85375eb7db205b828d0d0a27d10a7 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 25 Feb 2026 04:45:36 +0000 Subject: [PATCH 02/12] Update dependency org.openapitools:jackson-databind-nullable to v0.2.9 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 1aa965a..b8cfd15 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -91,7 +91,7 @@ org.openapitools jackson-databind-nullable - 0.2.8 + 0.2.9 From b3edd6655c83a42cda00471c597c54ff37211abc Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 25 Feb 2026 04:45:37 +0000 Subject: [PATCH 03/12] Update dependency software.xdev:find-and-replace-maven-plugin to v1.0.5 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 1aa965a..6086b01 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -377,7 +377,7 @@ software.xdev find-and-replace-maven-plugin - 1.0.4 + 1.0.5 From bd6498d2786d0178e3c54f7088af754bb0aafd90 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 26 Feb 2026 04:42:27 +0000 Subject: [PATCH 04/12] Update lycheeverse/lychee-action digest to 8646ba3 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index e6c3385..d768259 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -18,7 +18,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: fail: false # Don't fail on broken links, create an issue instead From 8b6624e632e759013ba7aa24ba6ec36f4951f500 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 26 Feb 2026 04:45:51 +0000 Subject: [PATCH 05/12] Update lycheeverse/lychee-action digest to 8646ba3 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 2675c8b..5b50d06 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -19,7 +19,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: fail: false # Don't fail on broken links, create an issue instead From a53730bb4a5a0765d9972d93dd5884253f67b619 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 27 Feb 2026 04:43:58 +0000 Subject: [PATCH 06/12] Update actions/upload-artifact action to v7 --- .github/workflows/check-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index b1a6d66..b5d7995 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -69,7 +69,7 @@ jobs: fi - name: Upload demo files - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: demo-files-java-${{ matrix.java }} path: ${{ env.DEMO_MAVEN_MODULE }}/target/${{ env.DEMO_MAVEN_MODULE }}.jar @@ -152,7 +152,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: pmd-report if-no-files-found: ignore From 0dcf9cfe57c8d8c8ace1253845b67afb8bd47bda Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 1 Mar 2026 04:48:23 +0000 Subject: [PATCH 07/12] Update dependency com.puppycrawl.tools:checkstyle to v13.3.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..e214afa 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.2.0 + 13.3.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..2547c6f 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.2.0 + 13.3.0 From 77e37f981ecf107f1ebb690beb75262b3314b38e Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 04:46:12 +0000 Subject: [PATCH 08/12] Update dependency net.sourceforge.pmd:pmd-core to v7.22.0 [SECURITY] --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..4cac133 100644 --- a/pom.xml +++ b/pom.xml @@ -83,7 +83,7 @@ net.sourceforge.pmd pmd-core - 7.21.0 + 7.22.0 net.sourceforge.pmd diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..4a20d6d 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,7 +253,7 @@ net.sourceforge.pmd pmd-core - 7.21.0 + 7.22.0 net.sourceforge.pmd From 961291c3795ca9f249ce028fe98fe1524da6b0fb Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 04:46:14 +0000 Subject: [PATCH 09/12] Update dependency net.sourceforge.pmd:pmd-java to v7.22.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..97f7b18 100644 --- a/pom.xml +++ b/pom.xml @@ -88,7 +88,7 @@ net.sourceforge.pmd pmd-java - 7.21.0 + 7.22.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..3831400 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -258,7 +258,7 @@ net.sourceforge.pmd pmd-java - 7.21.0 + 7.22.0 From 6f9b5b39e904c2167782591b14a645b1fd49b730 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 2 Mar 2026 12:00:46 +0100 Subject: [PATCH 10/12] Create report-gha-workflow-security-problems.yml Fixes https://github.com/xdev-software/base-template/issues/13 --- .../report-gha-workflow-security-problems.yml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/workflows/report-gha-workflow-security-problems.yml diff --git a/.github/workflows/report-gha-workflow-security-problems.yml b/.github/workflows/report-gha-workflow-security-problems.yml new file mode 100644 index 0000000..b17aa53 --- /dev/null +++ b/.github/workflows/report-gha-workflow-security-problems.yml @@ -0,0 +1,61 @@ +name: Report workflow security problems + +on: + workflow_dispatch: + push: + branches: [ develop ] + paths: + - '.github/workflows/**' + +permissions: + issues: write + +jobs: + prt: + runs-on: ubuntu-latest + timeout-minutes: 15 + # Only run this in our repos (Prevent notification spam by forks) + if: ${{ github.repository_owner == 'xdev-software' }} + steps: + - uses: actions/checkout@v6 + + - name: Check + id: check + run: | + grep -l 'pull_request_target:' --exclude report-gha-workflow-security-problems.yml *.yml > reported.txt && exit 1 || exit 0 + working-directory: .github/workflows + + - name: Find already existing issue + id: find-issue + if: ${{ !cancelled() }} + run: | + echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Incorrectly configure GHA workflow (prt)"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT + env: + GH_TOKEN: ${{ github.token }} + + - name: Close issue if everything is fine + if: ${{ success() && steps.find-issue.outputs.number != '' }} + run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }} + env: + GH_TOKEN: ${{ github.token }} + + - name: Create report + if: ${{ failure() && steps.check.conclusion == 'failure' }} + run: | + echo 'Detected usage of `pull_request_target`. This event is dangerous and MUST NOT BE USED AT ALL COST!' > reported.md + echo '' >> reported.md + echo '/cc @xdev-software/gha-workflow-security' >> reported.md + echo '' >> reported.md + echo '```' >> reported.md + cat .github/workflows/reported.txt >> reported.md + echo '```' >> reported.md + cat reported.md + + - name: Create Issue From File + if: ${{ failure() && steps.check.conclusion == 'failure' }} + uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6 + with: + issue-number: ${{ steps.find-issue.outputs.number }} + title: 'Incorrectly configure GHA workflow (prt)' + content-filepath: ./reported.md + labels: bug, automated From 86e56e149f9633845cedb995a3f18a617e2b3a48 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 12:11:31 +0000 Subject: [PATCH 11/12] Update dependency org.openapitools:openapi-generator-maven-plugin to v7.20.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 8ee8b0d..f518c4b 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -319,7 +319,7 @@ org.openapitools openapi-generator-maven-plugin - 7.18.0 + 7.20.0 From 42dc90b3195e1e69fa68bd4229ed033f43475ccb Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 6 Mar 2026 11:26:43 +0100 Subject: [PATCH 12/12] Ignore cancelled builds --- .github/workflows/check-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index b5d7995..daae7b2 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -151,7 +151,7 @@ jobs: run: ./mvnw -B pmd:aggregate-cpd pmd:cpd-check -P pmd -DskipTests -T2C - name: Upload report - if: always() + if: ${{ !cancelled() }} uses: actions/upload-artifact@v7 with: name: pmd-report