PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit fcc039d.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit d85fd1b.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 0 | Medium: 1 | Low: 0

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit d85fd1b.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 0 | Medium: 1 | Low: 0

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit d85fd1b.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 0 | Medium: 1 | Low: 0

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit d85fd1b.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 0 | Medium: 1 | Low: 0

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

@andrross @cwperks

Can't get the gradle check to run because of:

Run PROMPT=$(cat <<-EOF
Processing AI results
-------------------------------------------------------
{
  "counts": {
    "total": 1,
    "critical": 0,
    "high": 0,
    "medium": 1,
    "low": 0
  },
  "truncated": false,
  "issues": [
    {
      "path": ".github/workflows/gradle-check.yml",
      "line": 27,
      "severity": "medium",
      "description": "The `tj-actions/changed-files` action is pinned by a mutable tag (`v47.0.5`) rather than an immutable commit SHA. This action was previously compromised in a well-documented supply chain attack (CVE-2025-30066), making it a higher-risk dependency. A tag can be silently repointed to a different, potentially malicious commit without any visible change in the workflow file. Best practice is to pin to a full commit SHA (e.g., `tj-actions/changed-files@<sha>`) to guarantee immutability."
    }
  ]
}
-------------------------------------------------------
Start issue count
Issue Count: Total(1), Critical(0), High(0), Medium(1), Low(0)
-------------------------------------------------------
Diff analyzer found issues, generating report
0s
Run echo "DIFF_ANALYZER_LEVELS=2" >> $GITHUB_OUTPUT
Diff analyzer has found issues in the code changes per AI Analysis
Hard fail diff analyzer at level 2
Error: Process completed with exit code 1.

So I have added skip-diff-analyzer for now.
This is a minor version bump which I think should be safe to merge without full gradle check. Also, we are pretty far away from next release date to take a calculated risk - if things break, we'll revert. Not an advocate on this practice, but should be fine for this instance.

If you'd refer to tagged version section in GHSA-mrrh-fwg8-r2c3:

If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.

Please feel free to approve/merge if you don't have any thoughts otherwise.

@sandeshkr419 The Gradle check jenkins job is skipped in certain cases, such as the only changes being in .github/*: