Software Passport · public repository

pac4j/jax-rs-pac4j

Observed by SPR on 2026-09-25 at commit 216f5f66bdea2731213a859e75f73f3448a38b02 (master). Source: github.com/pac4j/jax-rs-pac4j.

SBOM components42
Open findings28
Critical / high0 / 0
Evidence items45

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 28)

SeverityFindingComponentFixed in
MEDIUMLicense not observedweld-servlet-core
MEDIUMLicense not observedundertow-servlet
MEDIUMLicense not observedslf4j-simple
MEDIUMLicense not observedresteasy-undertow
MEDIUMLicense not observedresteasy-core
MEDIUMLicense not observedresteasy-cdi
MEDIUMLicense not observedpac4j-http
MEDIUMLicense not observedpac4j-core
MEDIUMLicense not observedobjenesis
MEDIUMLicense not observedmockito-core
MEDIUMLicense not observedjunit-vintage-engine
MEDIUMLicense not observedjunit
MEDIUMLicense not observedjul-to-slf4j
MEDIUMLicense not observedjersey-test-framework-provider-inmemory
MEDIUMLicense not observedjersey-test-framework-provider-grizzly2
MEDIUMLicense not observedjersey-server
MEDIUMLicense not observedjersey-hk2
MEDIUMLicense not observedjersey-client
MEDIUMLicense not observedjavassist
MEDIUMLicense not observedjakarta.ws.rs-api
MEDIUMLicense not observedjakarta.servlet-api
MEDIUMLicense not observedjakarta.inject-api
MEDIUMLicense not observedjakarta.annotation-api
MEDIUMLicense not observedhamcrest-core
MEDIUMLicense not observedgrizzly-http-server

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy