Add dependabot config and include lockfiles

[Liam Farrelly (lfarrel6)]

Why

Improving package hygiene - adding a dependabot config and lockfiles will give us better vis over transitive dependency vulns so we can patch them.

How

• Add dependabot config to track gradle and github actions dependencies
• Bump CI actions to modern versions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​com.google.code.gson/​gson@​2.8.9
	maven/​com.google.guava/​guava@​31.1-android
	maven/​org.apache.httpcomponents/​httpclient@​4.5.13
	maven/​org.bouncycastle/​bcprov-jdk15on@​1.70
	maven/​org.mockito/​mockito-core@​3.12.4
	maven/​org.junit.jupiter/​junit-jupiter@​5.7.2
	maven/​com.github.tomakehurst/​wiremock-jre8@​2.32.0
	maven/​com.fasterxml.jackson/​jackson-bom@​2.13.0
	maven/​org.eclipse.jetty/​jetty-bom@​9.4.44.v20210927
	maven/​org.junit/​junit-bom@​5.7.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: maven com.google.code.gson:gson is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/com.google.code.gson/gson@2.8.9 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.google.code.gson/gson@2.8.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.google.guava:guava is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/com.google.guava/guava@31.1-android ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.google.guava/guava@31.1-android. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.google.guava:guava is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/com.google.guava/guava@31.1-android ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.google.guava/guava@31.1-android. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven net.bytebuddy:byte-buddy-agent is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/org.mockito/mockito-core@3.12.4 → maven/net.bytebuddy/byte-buddy-agent@1.11.13 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/net.bytebuddy/byte-buddy-agent@1.11.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven net.minidev:accessors-smart is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/net.minidev/accessors-smart@2.4.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/net.minidev/accessors-smart@2.4.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.apache.httpcomponents.client5:httpclient5 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.apache.httpcomponents.client5/httpclient5@5.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents.client5/httpclient5@5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.apache.httpcomponents.client5:httpclient5 under MPL-2.0 License: MPL-2.0 - The applicable license policy does not permit this license (5) (mozilla/public-suffix-list.txt) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.apache.httpcomponents.client5/httpclient5@5.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents.client5/httpclient5@5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.apache.httpcomponents:httpclient is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/gradle.lockfile → maven/org.apache.httpcomponents/httpclient@4.5.13 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents/httpclient@4.5.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.apache.httpcomponents:httpclient under MPL-2.0 License: MPL-2.0 - The applicable license policy does not permit this license (5) (mozilla/public-suffix-list.txt) From: lib/gradle.lockfile → maven/org.apache.httpcomponents/httpclient@4.5.13 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents/httpclient@4.5.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty.http2:http2-common under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty.http2/http2-common@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty.http2/http2-common@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty.http2:http2-hpack under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty.http2/http2-hpack@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty.http2/http2-hpack@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty.http2:http2-server under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty.http2/http2-server@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty.http2/http2-server@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-alpn-client under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-alpn-client@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-alpn-client@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-alpn-java-client under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-alpn-java-client@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-alpn-java-client@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-alpn-java-server under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-alpn-openjdk8-client under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-alpn-openjdk8-server under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-alpn-openjdk8-server@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-alpn-openjdk8-server@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-alpn-server under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-alpn-server@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-alpn-server@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-client under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-client@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-client@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-continuation under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-continuation@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-continuation@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-http under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-http@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-http@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-io under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-io@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-io@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-proxy under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-proxy@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-proxy@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.eclipse.jetty:jetty-security under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (META-INF/NOTICE.txt) License: https://www.eclipse.org/org/documents/epl-v10.php - This license classifier is not allowed by the applicable policy (META-INF/MANIFEST.MF) License: EPL-1.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE) From: lib/gradle.lockfile → maven/com.github.tomakehurst/wiremock-jre8@2.32.0 → maven/org.eclipse.jetty/jetty-security@9.4.44.v20210927 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.eclipse.jetty/jetty-security@9.4.44.v20210927. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 18 more rows in the dashboard

View full report