[dependabot]

Bumps the gha group with 1 update: gradle/actions/setup-gradle.

Updates gradle/actions/setup-gradle from 6.4.0 to 6.4.1

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.4.1

Security fix

This release fixes a security vulnerability in the dependency-submission action: GHSA-chpw-2mqm-95cc. All users should upgrade.

What's Changed

• Combined dependency updates by @​bigdaz in gradle/actions#1105
• Update to latest Dependency Graph plugin by @​bigdaz in gradle/actions#1106

Full Changelog: gradle/actions@v6.4.0...v6.4.1

Commits

• 8da46b5 [bot] Update dist directory
• dcf6f72 Merge commit from fork
• bf74269 Update to latest Dependency Graph plugin (#1106)
• 65a6ba9 [bot] Update dist directory
• 35eba4f Combined dependency updates (#1105)
• 1cff18a Update known wrapper checksums (#1075)
• 399f0d3 Update known wrapper checksums
• ecf8cf2 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0 (#1080)
• d740e82 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0
• f9f39a9 Bump references to Develocity Gradle plugin from 4.5.0 to 4.5.1 (#1072)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[psiinon]

Checkmarx One – Scan Summary & Details – fd112cd2-44fa-4b45-9db1-42343339ecf7

---

New Issues (5 out of 5)

Checkmarx found the following issues in this Pull Request

Severity: 4 High · 1 Medium

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Improper_Restriction_of_Stored_XXE_Ref	subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApiMain.java: 214	Attack Vector
2		Improper_Restriction_of_XXE_Ref	subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java: 465	details The loads and parses XML using parse, at line 416 of /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java. This ... Attack Vector
3		Improper_Restriction_of_XXE_Ref	subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java: 447	details The loads and parses XML using parse, at line 416 of /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java. This ... Attack Vector
4		SSRF	subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java: 447	details The application sends a request to a remote server, for some resource, using connect in /subprojects/zap-clientapi/src/main/java/org/zaproxy/clien... Attack Vector
5		Use_Of_Hardcoded_Password	subprojects/zap-clientapi/src/examples/java/org/zaproxy/clientapi/examples/authentication/FormBasedAuthentication.java: 169	details The application uses the hard-coded password password for authentication purposes, either using it to verify users' identities, or to access anoth... Attack Vector

---

Use @Checkmarx to take action directly from this PR:

• Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR