Update flow to 23.6.5

[vaadin-bot]

No description provided.

[github-actions]

Dependencies Report

• 🟠 Known Vulnerabilities:

  • Vulnerabilities in: pkg:npm/[email protected] [CVE-2024-26467] (oss-bomber)
    👌 This is coming from the tools, @cyclonedx/cyclonedx-npm, we have used for sbom module, FP for us.
    ·
    • Vulnerabilities in: pkg:maven/com.fasterxml.jackson.core/[email protected] [CVE-2023-35116] (owasp)
      👌 based on the issue this is not a CVE Stack overflow error caused by serialization of Map with cyclic dependency -- NOT CVE FasterXML/jackson-databind#3972
      · cpe:2.3:a:fasterxml:jackson-databind::::::::

• 🚫 Vulnerabilities:

  • Vulnerabilities in: pkg:maven/com.fasterxml.jackson.core/[email protected] [CVE-2025-52999] (osv-bomber,osv-scan,owasp)
    · cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:::::::*
    • Vulnerabilities in: pkg:maven/com.nimbusds/[email protected] [CVE-2025-53864] (osv-bomber,osv-scan)
      ·
    • Vulnerabilities in: pkg:maven/org.apache.poi/[email protected] [CVE-2025-31672] (osv-bomber,osv-scan)
      ·
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2024-38809, CVE-2024-22262, CVE-2024-38820, CVE-2016-1000027, CVE-2024-22259, CVE-2025-41234, CVE-2024-38828, CVE-2024-38808] (osv-bomber,osv-scan,owasp)
      · cpe:2.3:a:org.springframework:spring-web:5.3.32:::::::*
      · cpe:2.3:a:vmware:spring_framework::::::::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
      · cpe:2.3:a:netapp:oncommand_insight:-:::::::*
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2024-38816, CVE-2024-38819, CVE-2025-41242, CVE-2024-38828, CVE-2024-22259, CVE-2024-38820, CVE-2024-38808] (osv-bomber,osv-scan,owasp)
      · cpe:2.3:a:org.springframework:spring-webmvc:5.3.32:::::::*
      ·
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
      · cpe:2.3:a:vmware:spring_framework::::::::
      · cpe:2.3:a:netapp:oncommand_insight:-:::::::*
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2024-38820, CVE-2025-22233, CVE-2024-22259, CVE-2024-38808] (osv-bomber,osv-scan,owasp)
      · cpe:2.3:a:vmware:spring_framework::::::::
      · cpe:2.3:a:org.springframework:spring-context:5.3.32:::::::*
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
      · cpe:2.3:a:netapp:oncommand_insight:-:::::::*
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2024-38808] (osv-bomber,osv-scan)
      ·
    • Vulnerabilities in: pkg:maven/org.apache.tomcat.embed/[email protected] [CVE-2025-48989, CVE-2025-46701, CVE-2025-48988, CVE-2025-49125, BIT-tomcat-2025-48989, BIT-tomcat-2025-46701, BIT-tomcat-2025-48988, BIT-tomcat-2025-49125, CVE-2025-49124, CVE-2025-52434, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668] (osv-bomber,osv-scan,owasp)
      · cpe:2.3:a:apache:tomcat::::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone2::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone3::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone4::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
      · cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
      ·
    • Vulnerabilities in: pkg:maven/ch.qos.logback/[email protected] [CVE-2024-12801, CVE-2024-12798] (osv-bomber,osv-scan,owasp)
      · cpe:2.3:a:ch.qos.logback:logback-core:1.2.13:::::::*
    • Vulnerabilities in: pkg:maven/org.springframework.boot/[email protected] [CVE-2025-22235] (osv-bomber,osv-scan)
      ·
    • Vulnerabilities in: pkg:npm/[email protected]#packages/vite [CVE-2025-24010, CVE-2025-30208, CVE-2025-31125, CVE-2025-31486, CVE-2025-32395, CVE-2025-46565] (osv-bomber)
      ·
    • Vulnerabilities in: pkg:npm/[email protected] [CVE-2024-45296] (osv-bomber,oss-bomber,osv-scan)
      ·
    • Vulnerabilities in: pkg:npm/[email protected] [GHSA-67mh-4wv8-2f99] (osv-bomber)
      ·
    • Vulnerabilities in: pkg:npm/[email protected] [CVE-2024-34393, CVE-2024-34394] (oss-bomber)
      ·
    • Vulnerabilities in: pkg:maven/org.apache.tomcat/[email protected] [BIT-tomcat-2025-48989, CVE-2025-48989] (osv-scan)
      ·
    • Vulnerabilities in: pkg:maven/org.apache.tomcat/[email protected] [BIT-tomcat-2025-46701, CVE-2025-46701, BIT-tomcat-2025-48988, CVE-2025-48988, BIT-tomcat-2025-49125, CVE-2025-49125] (osv-scan)
      ·
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2024-38816, CVE-2024-38819] (osv-scan)
      ·
    • Vulnerabilities in: pkg:npm/[email protected] [CVE-2025-24010, CVE-2025-30208, CVE-2025-31125, CVE-2025-31486, CVE-2025-32395, CVE-2025-46565] (osv-scan)
      ·
    • Vulnerabilities in: pkg:maven/com.google.code.gson/[email protected] [CVE-2025-53864] (owasp)
      · cpe:2.3:a:com.google.code.gson:gson:2.10.1:::::::*
    • Vulnerabilities in: pkg:maven/org.apache.poi/[email protected] [CVE-2025-31672] (owasp)
      · cpe:2.3:a:apache:poi::::::::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2024-22259, CVE-2024-38820, CVE-2024-38808] (owasp)
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
      · cpe:2.3:a:vmware:spring_framework::::::::
      · cpe:2.3:a:netapp:oncommand_insight:-:::::::*
    • Vulnerabilities in: pkg:maven/org.springframework/[email protected] [CVE-2025-41242, CVE-2024-22259, CVE-2024-38820, CVE-2024-38808] (owasp)
      · cpe:2.3:a:org.springframework:spring-core:5.3.32:::::::*
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
      · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
      · cpe:2.3:a:vmware:spring_framework::::::::
      · cpe:2.3:a:netapp:oncommand_insight:-:::::::*

• 📔 No License Issues

• 🟠 Changes in 23.6-SNAPSHOT since V23.6.2

  • 19 packages modified (9 external, 10 vaadin)
  • 786 packages same (620 external, 166 vaadin)

[Click for more Details]