Skip to content

Bump actions/setup-java from 5.2.0 to 5.4.0 - #304

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-java-5.4.0
Closed

Bump actions/setup-java from 5.2.0 to 5.4.0#304
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-java-5.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-java from 5.2.0 to 5.4.0.

Release notes

Sourced from actions/setup-java's releases.

v5.4.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

What's Changed

... (truncated)

Commits
  • 1bcf9fb dist: Address Copilot review suggestions from PR #1042 (GraalVM Community) (#...
  • fa2c650 docs: note jdkfile approach for Early Access / unreleased JDK builds (#1058)
  • 1d56e31 dist: Add GraalVM Community distribution support (#1042)
  • 1d25252 chore: Harden workflows: least-privilege permissions + zizmor integration (#1...
  • 668c1ea docs: add post-install keytool import for the JDK cacerts trust store (#1051)
  • a9a46fb docs: document self-signed certificate / internal CA handling for GitHub Ente...
  • 5431e71 docs: add JavaFX Maven project configuration instructions (#1044)
  • 4baa9b4 docs: replace non-existent HelloWorldApp references with java --version (#1043)
  • eab4b08 Bump @​types/node from 25.9.3 to 26.0.0 (#1031)
  • bf0c0e6 Bump actions/checkout from 6 to 7 (#1032)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump actions/setup-java from 5.2.0 to 5.4.0
60afb02 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.2.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5.2.0...v5.4.0)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 14, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 14, 2026 09:33
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 14, 2026
@dependabot dependabot Bot mentioned this pull request Jul 14, 2026
Closed
@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

Code Review — Bump actions/setup-java from 5.2.0 to 5.4.0

This PR is a Dependabot-style dependency bump touching three CI workflow files (maven-darwin.yaml, maven-linux.yaml, maven-windows.yaml), updating the actions/setup-java pinned version. Purely a version string change, no logic changes.

Code Quality

  • ✅ Style conventions — Diff is a single-line version bump per file, consistent with existing YAML formatting (.github/workflows/maven-darwin.yaml:44, .github/workflows/maven-linux.yaml:45, .github/workflows/maven-windows.yaml:44).
  • ✅ No commented-out code
  • ✅ Meaningful variable names — N/A, no code identifiers changed.
  • ✅ DRY principle — The same bump is repeated identically across three workflow files, but that mirrors the existing per-OS workflow structure already in the repo (not introduced by this PR), so no new duplication concern.
  • ✅ Defects — No functional risk from this change; actions/setup-java@v5.4.0 is a maintained minor/patch upgrade over v5.2.0 on the same major version, applied consistently to all three OS matrix workflows. No behavioral or logic changes are involved.
  • ✅ CLAUDE.md consideration — .claude/CLAUDE.md is unaffected by this PR and contains no local-environment-specific content that this diff would exacerbate.

Testing

  • ✅ N/A — No new functions, endpoints, or logic; nothing to unit/integration test. Existing CI workflows will exercise the updated action automatically on the next run.

Documentation

  • ✅ README/API docs — not applicable, no user-facing behavior changed.
  • ✅ CHANGELOG.md — Not updated in this PR, but this is consistent with existing project convention: prior identical Dependabot bumps to GitHub Actions/build-plugin versions (e.g. ea2f574 bumping madrapps/jacoco-report, acf0018 bumping maven-surefire-plugin) also did not touch CHANGELOG.md — that file appears to be updated only at release time, aggregating dependency bumps. No action needed.
  • ✅ Inline comments — N/A.

Security

  • ✅ No hardcoded credentials
  • ✅ No input validation concerns — static CI config only
  • ✅ No error handling changes
  • ✅ No sensitive data in logs
  • ✅ No .lic files or AQAAAD-prefixed strings present in this diff

Summary

This is a low-risk, routine CI dependency bump with no defects found. Approve.

Automated code review analyzing defects and coding standards

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

Super-linter summary

Language Validation result
CHECKOV Pass ✅
GITHUB_ACTIONS Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

TRIVY 

Report Summary

┌─────────┬──────┬─────────────────┬───────────────────┬─────────┐
│ Target  │ Type │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────┼──────┼─────────────────┼───────────────────┼─────────┤
│ pom.xml │ pom  │        1        │         -         │    -    │
└─────────┴──────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


pom.xml (pom)
=============
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────────────────┬────────────────────────────────────────────────────────────┐
│                   Library                   │ Vulnerability  │ Severity │ Status │ Installed Version │         Fixed Version         │                           Title                            │
├─────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────────────────────┼────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind │ CVE-2026-54515 │ MEDIUM   │ fixed  │ 2.21.4            │ 3.1.4, 2.18.9, 2.21.5, 2.22.1 │ jackson-databind: jackson-databind: Ignored properties can │
│                                             │                │          │        │                   │                               │ be unexpectedly modified                                   │
│                                             │                │          │        │                   │                               │ https://avd.aquasec.com/nvd/cve-2026-54515                 │
└─────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────────────────────┴────────────────────────────────────────────────────────────┘

@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #306.

@dependabot dependabot Bot closed this Jul 28, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/setup-java-5.4.0 branch July 28, 2026 09:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@barrycaceres barrycaceres

@kernelsam kernelsam

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@barrycaceres @kernelsam @senzingdevops