[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.tomcat.embed:tomcat-embed-jasper	9.0.123 → 9.0.124

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7348

[gitar-bot]

Renovate update safety: Low risk (CI pending)

Update: org.apache.tomcat.embed:tomcat-embed-jasper 9.0.123 → 9.0.124 (patch), only in java-jsp/pom.xml.

Usage impact: The module uses Jasper only as a JSP parser (the ecj dependency is excluded). The 9.0.124 changelog contains Jasper fixes (jspc argument handling, whitespace in jsp:attribute, JSTL tag plugin tweaks, a tag-file JAR handle leak). The behavior changes I found (c:out/c:set tag plugins, SSI, JNDIRealm, rewrite valve, JSON parser) affect runtime servlet-container features, not the parse-only use here. No licensing change (Apache-2.0).

CI: verify-sca and the other quick checks pass; Build and Build and Unit Test on Windows are still pending, so the low-risk verdict assumes they pass.

Uncertainties: The changelog fetch was truncated partway through the 9.0.124 section, so later entries were not reviewed.

[gitar-bot]

CI failed: The Maven build failed in the scanner integration tests (it-java-scanner-integration-tests) with Surefire test failures, but the log excerpt omits the individual test results, so the specific failing test and its link to the tomcat-embed-jasper 9.0.123→9.0.124 bump remain unclear.

Overview

One unique error template was found across 1 analyzed log (commit cc2cdc3). The build failed in SonarQube Java :: ITs :: Scanner Integration Tests (it-java-scanner-integration-tests) because Surefire reported test failures or errors. The other reactor modules shown (Surefire, Java Extension Plugin, custom rules example) passed.

Failures

Surefire test failure in scanner integration tests (confidence: medium)

• Type: test
• Affected jobs: 132649244157 (Test Analyze)
• Related to change: unclear
• Root cause: Maven reports maven-surefire-plugin:test (default-test) failed on it-java-scanner-integration-tests. The excerpt does not include the individual test results, so the failing test and cause cannot be identified. The PR only changes tomcat-embed-jasper from 9.0.123 to 9.0.124 in java-jsp/pom.xml; the log does not connect the failure to that dependency update.
• Suggested fix: Inspect the Surefire reports under its/scanner-integration-tests/target/surefire-reports and any dump files to identify the failing test, then fix that test or its setup. The excerpt does not support a specific code change.

Summary

• Change-related failures: None confirmed. The single failure is marked unclear relative to the PR.
• Infrastructure/flaky failures: None identified. The flakiness status of the failing test is unknown.
• Recommended action: Open the Surefire reports for it-java-scanner-integration-tests to identify the failing test. If it is unrelated to the Tomcat Jasper bump, triage it separately from this Renovate update. If it involves JSP compilation, investigate the dependency change.

Code Review ✅ Approved 🟡 Medium risk

Upgrading embedded Tomcat Jasper may alter JSP compilation or rendering behavior, potentially causing application compatibility issues.

Bumps the org.apache.tomcat.embed:tomcat-embed-jasper dependency from 9.0.123 to 9.0.124 via a Renovate update. No issues found.

Verification Rules 1/2 met PRs 1 inspected

Rules 1 failed 1 passed 1 action taken 1 not applicable

❌ Repository license compliance - Central policy lists sonar-java as LICENSE.txt with LGPL-3.0, but LICENSE.txt contains the SONAR Source-Available License v1.0 and no approved extra.license override exists in .github/sonarsource.yml; this is pre-existing and not caused by the PR.
✅ Internal artifact registries
🎸 Review major and minor Renovate updates - Posted advisory summary with a Low risk verdict (CI pending) for tomcat-embed-jasper 9.0.123 to 9.0.124.

Functional validation No results

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 6500: SONARJAVA-7320 Cache safe Maven module results in PR checks Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Build | Test Analyze

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: cc2cdc3 | Docs | View more details | Give us feedback!}