build(deps): bump com.sun.xml.bind:jaxb-impl from 2.3.9 to 4.0.9 in /app/core#6494
build(deps): bump com.sun.xml.bind:jaxb-impl from 2.3.9 to 4.0.9 in /app/core#6494dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dosubot
Bot
added
the
size:XS
stirlingbot
Bot
added
Gradle
✅ Backend License Check PassedAll backend dependencies have valid and allowed licenses. The backend license report has been updated successfully. |
|
A newer version of com.sun.xml.bind:jaxb-impl exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
|
@dependabot recreate |
Bumps com.sun.xml.bind:jaxb-impl from 2.3.9 to 4.0.9. --- updated-dependencies: - dependency-name: com.sun.xml.bind:jaxb-impl dependency-version: 4.0.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/gradle/app/core/com.sun.xml.bind-jaxb-impl-4.0.8
branch
from
91d9d81 to
dd019a6
Compare
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| implementation 'com.sun.xml.bind:jaxb-impl:4.0.9' | ||
| implementation 'com.sun.xml.bind:jaxb-core:4.0.7' |
There was a problem hiding this comment.
The new com.sun.xml.bind:jaxb-impl:4.0.9 conflicts with the nearby javax.xml.bind:jaxb-api:2.3.1 and comment about javax-only usage, creating an inconsistent JAXB namespace setup.
| implementation 'com.sun.xml.bind:jaxb-impl:4.0.9' | |
| implementation 'com.sun.xml.bind:jaxb-core:4.0.7' | |
| implementation 'com.sun.xml.bind:jaxb-impl:2.3.9' | |
| implementation 'com.sun.xml.bind:jaxb-core:2.3.0.1' |
Details
✨ AI Reasoning
The dependency block states that this area is for components still using the old javax.xml.bind namespace, and it keeps the API pinned to javax.xml.bind:jaxb-api:2.3.1. The updated implementation artifact is now from the JAXB 4.x line, which corresponds to the Jakarta-era namespace expectations. That creates a contradiction between the stated assumption and the selected implementation, making the configuration internally inconsistent and likely to behave incorrectly at runtime.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
|
Superseded by #6835. |
dependabot
Bot
deleted the
dependabot/gradle/app/core/com.sun.xml.bind-jaxb-impl-4.0.8
branch
1 participant
Bumps com.sun.xml.bind:jaxb-impl from 2.3.9 to 4.0.9.