Phoenix Security Bot: Partial remediation was applied, updating four direct dependencies, but manual review is required for several other findings. (9aef6233-f640-4e64-81e3-9a9791945813)

[demo-agent-remediator]

Automated fix proposed by Phoenix's remediation agent.

Partial remediation was applied, updating four direct dependencies, but manual review is required for several other findings.

• Status: partial_remediation
• Confidence: low
• Breaking change risk: medium
• Manual review required

Parent/managed resolution

The agent could not find the exact build-file entry controlling some dependency versions. They may be transitive, property-managed, or parent/BOM/dependency-management controlled, but this was not verified.

Stale finding assessment

The remediation selected dependency changes for the scanner findings.

Dependency changes (4)

• {package=org.dom4j:dom4j, from_version=2.1.0, to_version=2.1.3, changed_declaration=org.dom4j:dom4j, changed_declaration_from_version=2.1.0, changed_declaration_to_version=2.1.3, resolution_source=direct, manifest_path=pom.xml, line=null}
• {package=com.thoughtworks.xstream:xstream, from_version=1.4.10, to_version=1.4.20, changed_declaration=com.thoughtworks.xstream:xstream, changed_declaration_from_version=1.4.10, changed_declaration_to_version=1.4.20, resolution_source=direct, manifest_path=pom.xml, line=null}
• {package=com.alibaba:fastjson, from_version=1.2.24, to_version=1.2.83, changed_declaration=com.alibaba:fastjson, changed_declaration_from_version=1.2.24, changed_declaration_to_version=1.2.83, resolution_source=direct, manifest_path=pom.xml, line=null}
• {package=com.monitorjbl:xlsx-streamer, from_version=2.0.0, to_version=2.1.0, changed_declaration=com.monitorjbl:xlsx-streamer, changed_declaration_from_version=2.0.0, changed_declaration_to_version=2.1.0, resolution_source=direct, manifest_path=pom.xml, line=null}

Finding statuses (19)

• {finding_id=019ff0f6-f9be-72b4-b5d2-8752b9c3d8f5, scanner_package=jackson-databind, scanner_version=2.8.6, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=com.fasterxml.jackson.core:jackson-databind, matched_version=2.8.6, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-f9ca-7040-a03e-da94dc75dc5a, scanner_package=tomcat-embed-core, scanner_version=8.5.11, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.apache.tomcat.embed:tomcat-embed-core, matched_version=8.5.11, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-f9d6-7c71-bd73-c380d903a10d, scanner_package=logback-core, scanner_version=1.1.9, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=ch.qos.logback:logback-core, matched_version=1.1.9, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-f9e1-7b31-9d64-e4337c922771, scanner_package=xstream, scanner_version=1.4.10, reference_ids=[], status=patched, reason_code=finding.covered_by_dependency_change, reason=The finding is associated with a selected dependency change., matched_package=com.thoughtworks.xstream:xstream, matched_version=1.4.10, changed_declaration=com.thoughtworks.xstream:xstream, target_version=1.4.20, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-f9eb-710d-bd32-c8bcc75bce01, scanner_package=dom4j, scanner_version=2.1.0, reference_ids=[], status=patched, reason_code=finding.covered_by_dependency_change, reason=The finding is associated with a selected dependency change., matched_package=org.dom4j:dom4j, matched_version=2.1.0, changed_declaration=org.dom4j:dom4j, target_version=2.1.3, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-f9f5-7dd9-b8b0-005d64f3711d, scanner_package=fastjson, scanner_version=1.2.24, reference_ids=[], status=patched, reason_code=finding.covered_by_dependency_change, reason=The finding is associated with a selected dependency change., matched_package=com.alibaba:fastjson, matched_version=1.2.24, changed_declaration=com.alibaba:fastjson, target_version=1.2.83, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-f9ff-7ab9-abfc-3e4454c18912, scanner_package=spring-beans, scanner_version=4.3.6.RELEASE, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.springframework:spring-beans, matched_version=4.3.6.RELEASE, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa0a-772e-a3a6-c39efe7209f9, scanner_package=logback-classic, scanner_version=1.1.9, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=ch.qos.logback:logback-classic, matched_version=1.1.9, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa12-743c-b8e6-4ab7ac1f79e2, scanner_package=spring-core, scanner_version=4.3.6.RELEASE, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.springframework:spring-core, matched_version=4.3.6.RELEASE, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa1d-7883-b039-695ace44ff2d, scanner_package=spring-webmvc, scanner_version=4.3.6.RELEASE, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.springframework:spring-webmvc, matched_version=4.3.6.RELEASE, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa28-7a57-8e1c-202295215b7f, scanner_package=log4j-api, scanner_version=2.7, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.apache.logging.log4j:log4j-api, matched_version=2.7, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa33-7a96-92f9-3ee4d5a6d9a7, scanner_package=spring-security-core, scanner_version=4.2.1.RELEASE, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.springframework.security:spring-security-core, matched_version=4.2.1.RELEASE, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa3d-779a-b4a6-03a3e3ee2c0b, scanner_package=groovy, scanner_version=2.4.7, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.codehaus.groovy:groovy, matched_version=2.4.7, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa49-7204-9f5e-03cb2fa1b5f2, scanner_package=spring-boot-starter-web, scanner_version=1.5.1.RELEASE, reference_ids=[], status=manual_review, reason_code=finding.direct_package_not_selected_for_patch, reason=The package is present as a direct dependency, but no safe summary dependency change was selected for it., matched_package=org.springframework.boot:spring-boot-starter-web, matched_version=1.5.1.RELEASE, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa52-76b3-8071-375c8bbee322, scanner_package=commons-collections, scanner_version=3.1, reference_ids=[], status=manual_review, reason_code=finding.direct_package_not_selected_for_patch, reason=The package is present as a direct dependency, but no safe summary dependency change was selected for it., matched_package=commons-collections:commons-collections, matched_version=3.1, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa5d-7417-91ff-3c50d669bb78, scanner_package=xlsx-streamer, scanner_version=2.0.0, reference_ids=[], status=patched, reason_code=finding.covered_by_dependency_change, reason=The finding is associated with a selected dependency change., matched_package=com.monitorjbl:xlsx-streamer, matched_version=2.0.0, changed_declaration=com.monitorjbl:xlsx-streamer, target_version=2.1.0, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa69-7b10-9750-ff556f3cf80b, scanner_package=dom4j, scanner_version=1.6.1, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=dom4j:dom4j, matched_version=1.6.1, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa70-7602-b1b1-80d464114bd0, scanner_package=xmlbeans, scanner_version=2.3.0, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=org.apache.xmlbeans:xmlbeans, matched_version=2.3.0, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}
• {finding_id=019ff0f6-fa79-7b35-8a54-0c01b822c35f, scanner_package=netty-codec-http, scanner_version=4.0.27.Final, reference_ids=[], status=transitive_or_managed, reason_code=finding.transitive_or_managed_no_direct_edit, reason=The package is present in the resolved graph, but it was not selected as a direct build-file edit., matched_package=io.netty:netty-codec-http, matched_version=4.0.27.Final, changed_declaration=null, target_version=null, closest_resolved_candidates=[]}

Warnings (7)

• llm_summary_dependency_facts_corrected
• not_remediated_list_truncated
• pom.xml: parent_pom_may_manage_versions
• pom.xml: dependency_management_not_resolved_by_static_parser
• pom.xml: org.springframework.boot:spring-boot-starter-web: managed_version_not_resolved
• pom.xml: org.springframework.boot:spring-boot-starter-thymeleaf: managed_version_not_resolved
• pom.xml: org.springframework.boot:spring-boot-starter-actuator: managed_version_not_resolved