Update dependency org.eclipse.jgit:org.eclipse.jgit to v6.10.1.202505221210-r#39
Update dependency org.eclipse.jgit:org.eclipse.jgit to v6.10.1.202505221210-r#39dev-mend-for-github-com[bot] wants to merge 1 commit into
Security Report
❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Vulnerable Library | Direct Library | Suggested Fix | Issue |
|---|---|---|---|---|---|---|
CVE-2025-4949Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-framework/pom.xml Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-framework/pom.xml,/nifi-registry/nifi-registry-core/nifi-registry-web-api/pom.xml,/nifi-registry/nifi-registry-toolkit/nifi-registry-toolkit-persistence/pom.xml Dependency Hierarchy: -> ❌ org.eclipse.jgit-6.10.1.202505221210-r.jar (Vulnerable Library) |
 Critical |
9.8 | Direct org.eclipse.jgit-6.10.1.202505221210-r.jar |
org.eclipse.jgit-6.10.1.202505221210-r.jar | https://github.com/eclipse-jgit/jgit.git - v7.2.1.202505142326-r,org.eclipse.jgit:org.eclipse.jgit:7.2.1.202505142326-r,org.eclipse.jgit:org.eclipse.jgit:7.0.1.202505221510-r,org.eclipse.jgit:org.eclipse.jgit:6.10.1.202505221210-r,https://github.com/eclipse-jgit/jgit.git - v6.10.1.202505221210-r,https://github.com/eclipse-jgit/jgit.git - v7.0.1.202505221510-r,org.eclipse.jgit:org.eclipse.jgit:7.1.1.202505221757-r | None |
CVE-2024-8309Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Critical |
9.8 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain - 0.2.0,langchain-community - 0.2.19,langchain - 0.2.0,langchain-community - 0.2.19 | None |
CVE-2024-7042Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Critical |
9.8 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | https://github.com/langchain-ai/langchainjs.git - no_fix | None |
CVE-2014-9390Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-framework/pom.xml Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-framework/pom.xml,/nifi-registry/nifi-registry-core/nifi-registry-web-api/pom.xml,/nifi-registry/nifi-registry-toolkit/nifi-registry-toolkit-persistence/pom.xml Dependency Hierarchy: -> ❌ org.eclipse.jgit-6.10.1.202505221210-r.jar (Vulnerable Library) |
Critical |
9.8 | Direct org.eclipse.jgit-6.10.1.202505221210-r.jar |
org.eclipse.jgit-6.10.1.202505221210-r.jar | mercurial - 3.2.3 | None |
CVE-2021-41496Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/numpy-1.26.4.dist-info Dependency Hierarchy: -> langchain-0.0.331-py3-none-any.whl (Root Library) -> ❌ numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library) |
 Medium |
5.5 | Transitive numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
langchain-0.0.331-py3-none-any.whl | Transitive https://github.com/numpy/numpy.git - no_fix |
None |
CVE-2021-41496Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/numpy-1.26.4.dist-info Dependency Hierarchy: -> chromadb-0.4.14-py3-none-any.whl (Root Library) -> ❌ numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library) |
Medium |
5.5 | Transitive numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
chromadb-0.4.14-py3-none-any.whl | Transitive https://github.com/numpy/numpy.git - no_fix |
None |
CVE-2021-41496Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/numpy-1.26.4.dist-info Dependency Hierarchy: -> onnxruntime-1.19.2-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl (Root Library) -> ❌ numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library) |
Medium |
5.5 | Transitive numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
onnxruntime-1.19.2-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl | Transitive https://github.com/numpy/numpy.git - no_fix |
None |
CVE-2021-41495Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/numpy-1.26.4.dist-info Dependency Hierarchy: -> langchain-0.0.331-py3-none-any.whl (Root Library) -> ❌ numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library) |
Medium |
5.3 | Transitive numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
langchain-0.0.331-py3-none-any.whl | Transitive https://github.com/numpy/numpy.git - no_fix |
None |
CVE-2021-41495Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/numpy-1.26.4.dist-info Dependency Hierarchy: -> chromadb-0.4.14-py3-none-any.whl (Root Library) -> ❌ numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library) |
Medium |
5.3 | Transitive numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
chromadb-0.4.14-py3-none-any.whl | Transitive https://github.com/numpy/numpy.git - no_fix |
None |
CVE-2021-41495Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20251127191155_OSIOVH/python_PITXIB/202511271911561/env/lib/python3.9/site-packages/numpy-1.26.4.dist-info Dependency Hierarchy: -> onnxruntime-1.19.2-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl (Root Library) -> ❌ numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library) |
Medium |
5.3 | Transitive numpy-1.26.4-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
onnxruntime-1.19.2-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl | Transitive https://github.com/numpy/numpy.git - no_fix |
None |
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2025-62727 | starlette-0.27.0-py3-none-any.whl |
| CVE-2021-41495 | numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl |
| CVE-2025-54121 | starlette-0.27.0-py3-none-any.whl |
| CVE-2021-22134 | elasticsearch-7.10.2.jar |
| CVE-2021-41496 | numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl |
| CVE-2025-4949 | org.eclipse.jgit-6.7.0.202309050840-r.jar |
| CVE-2025-50181 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2025-50182 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-24762 | fastapi-0.103.2-py3-none-any.whl |
| CVE-2014-9390 | org.eclipse.jgit-6.7.0.202309050840-r.jar |
| CVE-2025-4565 | protobuf-4.24.4-cp37-abi3-manylinux2014_x86_64.whl |
Base branch total remaining vulnerabilities: 122
Base branch commit: null
Total libraries scanned: 2192
Scan token: b9e7cf97eef34fd58e9432525fc8b33a