[Snyk] Security upgrade org.wildfly.arquillian:wildfly-arquillian-container-managed from 3.0.1.Final to 5.1.0.Final by ISGA · Pull Request #555 · ISGA/keycloak

ISGA · 2026-02-06T06:07:06Z

User description

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

testsuite/integration-arquillian/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IOUNDERTOW-15166617	124	org.wildfly.arquillian:wildfly-arquillian-container-managed: `3.0.1.Final` -> `5.1.0.Final` `Major version upgrade` `No Known Exploit`

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

CodeAnt-AI Description

Update WildFly Arquillian container to 5.1.0.Final to address a high-severity resource allocation vulnerability

What Changed

The integration-arquillian test suite now uses org.wildfly.arquillian:wildfly-arquillian-container version 5.1.0.Final instead of 3.0.1.Final
This upgrade removes a high-severity vulnerability related to uncontrolled resource allocation in the Undertow-based container used by tests

Impact

✅ Fewer security alerts from dependency scans
✅ Reduced risk of uncontrolled resource allocation during integration tests
✅ Safer test execution environment for CI runs

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-IOUNDERTOW-15166617

codeant-ai · 2026-02-06T06:07:11Z

CodeAnt AI is reviewing your PR.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

amplify-security · 2026-02-06T06:07:51Z

🔍 Amplify code check status:

⚠️ 0 issues detected in 📄 1 file and ❇️ 2 lines of code 🛠️ using Opengrep

Last updated by commit cdef05c at 2026-02-06 06:16:08 UTC.

codeant-ai · 2026-02-06T06:08:15Z

Sequence Diagram

This PR updates the arquillian-wildfly-container dependency version in the integration-arquillian POM to address a high-severity Undertow vulnerability. The diagram shows the automated Snyk PR change and the resulting upgrade + verification build flow.

sequenceDiagram
    participant Snyk
    participant Repository
    participant CI
    participant Dependency

    Snyk->>Repository: Create PR updating arquillian-wildfly-container version (3.0.1.Final -> 5.1.0.Final)
    Repository-->>CI: Trigger CI build for PR
    CI->>Dependency: Resolve new dependency version from pom.xml
    Dependency-->>CI: Provide upgraded wildfly-arquillian-container 5.1.0.Final
    CI->>Repository: Run tests/build verification
    CI-->>Repository: Build succeeds -> Vulnerability fixed (SNYK-JAVA-IOUNDERTOW-15166617)

Generated by CodeAnt AI

socket-security · 2026-02-06T06:08:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint-config-prettier@9.1.0
	npm/file-saver@2.0.5
	npm/file-selector@0.6.0
	npm/eslint-plugin-react@7.36.1
	npm/eslint-plugin-lodash@8.0.0
	npm/flat@6.0.1
	npm/eslint-plugin-mocha@10.5.0
	npm/fs-extra@11.2.0
	npm/eslint@9.10.0
	npm/eslint-plugin-cypress@3.5.0
	npm/eslint-plugin-playwright@1.6.2
	npm/eslint-plugin-react-hooks@4.6.2
	npm/eslint-plugin-prettier@5.2.1

View full report

socket-security · 2026-02-06T06:08:38Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `form-data` uses unsafe random function in form-data for choosing boundary CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 2.5.4 From: pnpm-lock.yaml → `npm/cypress@13.14.2` → `npm/form-data@2.3.3` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@2.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: npm `form-data` uses unsafe random function in form-data for choosing boundary CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From: pnpm-lock.yaml → `npm/form-data@4.0.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

codeant-ai · 2026-02-06T06:09:32Z

Nitpicks 🔍

🔒 No security issues identified
⚡ Recommended areas for review Transitive Dependency Mismatch Upgrading the wildfly-arquillian container may pull newer transitive dependencies (WildFly libs, Undertow, Jakarta artifacts) that conflict with existing properties (e.g., `undertow.version`, `version.org.wildfly.extras.creaper`). Ensure transitive versions are pinned or managed to avoid classpath/runtime conflicts. Compatibility Risk Bumping `arquillian-wildfly-container.version` to 5.1.0.Final is a major version change for the wildfly-arquillian container. This can introduce API and behavior changes that may be incompatible with the current `arquillian-core.version` (1.8.0.Final) or other test-suite expectations — validate compatibility and review release notes/changelogs before merging. Integration/Test Breakage Tests or CI jobs may fail after this upgrade (different container startup behavior, new defaults). Run the full integration suite and CI profiles (db profiles, migration profiles) and be ready to adjust test fixtures or container configurations.

codeant-ai · 2026-02-06T06:09:35Z

CodeAnt AI finished reviewing your PR.

zeropath-ai · 2026-02-06T06:12:29Z

✅ No security or compliance issues detected. Reviewed everything up to cdef05c.

Security Overview

🔎 Scanned files: 1 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/0e111b51-ae74-4faa-8067-84c4c8db1568?scanId=779f8ceb-f0a2-4327-b85a-a5c9f6e1191b&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Configuration changes	► pom.xml Update Arquillian WildFly container version

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-IOUNDERTOW-15166617

fix: testsuite/integration-arquillian/pom.xml to reduce vulnerabilities

b1f06db

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-IOUNDERTOW-15166617

codeant-ai bot added the size:XS This PR changes 0-9 lines, ignoring generated files label Feb 6, 2026

fix: testsuite/integration-arquillian/pom.xml to reduce vulnerabilities

cdef05c

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-IOUNDERTOW-15166617

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade org.wildfly.arquillian:wildfly-arquillian-container-managed from 3.0.1.Final to 5.1.0.Final#555

[Snyk] Security upgrade org.wildfly.arquillian:wildfly-arquillian-container-managed from 3.0.1.Final to 5.1.0.Final#555
ISGA wants to merge 2 commits intomainfrom
snyk-fix-bedb203754037cd6aab104d2c916f5a8

ISGA commented Feb 6, 2026 •

edited by codeant-ai bot

Loading

Uh oh!

codeant-ai bot commented Feb 6, 2026

Uh oh!

amplify-security bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

codeant-ai bot commented Feb 6, 2026

Uh oh!

socket-security bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

codeant-ai bot commented Feb 6, 2026

Uh oh!

codeant-ai bot commented Feb 6, 2026

Uh oh!

zeropath-ai bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ISGA commented Feb 6, 2026 • edited by codeant-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

codeant-ai bot commented Feb 6, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

amplify-security bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Amplify code check status:

Uh oh!

codeant-ai bot commented Feb 6, 2026

Sequence Diagram

Uh oh!

socket-security bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codeant-ai bot commented Feb 6, 2026

Nitpicks 🔍

Uh oh!

codeant-ai bot commented Feb 6, 2026

Uh oh!

zeropath-ai bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ISGA commented Feb 6, 2026 •

edited by codeant-ai bot

Loading

amplify-security bot commented Feb 6, 2026 •

edited

Loading

socket-security bot commented Feb 6, 2026 •

edited

Loading

socket-security bot commented Feb 6, 2026 •

edited

Loading

zeropath-ai bot commented Feb 6, 2026 •

edited

Loading