Update vulnerable dependencies

build.gradle.kts

@@ -16,6 +16,7 @@
 
 // Can't use typed variable syntax due to Dependabot limitations
 extra.apply {
+    set("assertj.version", "3.27.7") // Temporary until next Spring Boot
     set("besuVersion", "25.2.2")
     set("blockNodeVersion", "0.24.2")
     set("consensusNodeVersion", "0.70.0-rc.2")

buildSrc/src/main/kotlin/java-conventions.gradle.kts

@@ -14,9 +14,10 @@ plugins {
 }
 
 configurations.all {
-    exclude(group = "com.nimbusds") // Unused and has a vulnerability
     exclude(group = "com.github.jnr") // Unused and has licensing issues
+    exclude(group = "com.nimbusds") // Unused and has a vulnerability
     exclude(group = "commons-logging", "commons-logging")
+    exclude(group = "io.swagger.parser.v3", module = "swagger-parser-v2-converter")
     exclude(group = "org.apache.logging.log4j", module = "log4j-core")
     exclude(group = "org.jetbrains", module = "annotations")
     exclude(group = "org.slf4j", module = "slf4j-nop")

charts/hedera-mirror-rest/values.yaml

@@ -311,7 +311,7 @@ test:
     pullPolicy: IfNotPresent
     pullSecrets: []
     repository: bats/bats
-    tag: 1.11.1
+    tag: 1.13.0
   priorityClassName: ""
 
 tolerations: []

charts/marketplace/gcp/release.sh

@@ -22,7 +22,7 @@ if [[ "$#" -eq 2 ]]; then
 fi
 
 annotation="com.googleapis.cloudmarketplace.product.service.name=services/hedera-mirror-node-mirror-node-public.cloudpartnerservices.goog"
-bats_tag="1.11.1"
+bats_tag="1.13.0"
 postgresql_tag="17.6.0-debian-12-r2"
 registry="gcr.io/mirror-node-public/hedera-mirror-node"
 target_tag="${target_tag#v}" # Strip v prefix if present

common/build.gradle.kts

@@ -4,6 +4,10 @@ description = "Hedera Mirror Node Common"
 
 plugins { id("java-conventions") }
 
+configurations.all {
+    exclude(group = "io.vertx") // Unused and frequently has vulnerabilities
+}
+
 dependencies {
     val testClasses by configurations.registering
     annotationProcessor("jakarta.persistence:jakarta.persistence-api")

importer/build.gradle.kts

@@ -9,6 +9,10 @@ plugins {
     id("spring-conventions")
 }
 
+configurations.all {
+    exclude(group = "io.vertx") // Unused and frequently has vulnerabilities
+}
+
 dependencies {
     val blockNodeVersion: String by rootProject.extra
 

rest/cache.js

@@ -124,7 +124,9 @@ export class Cache {
         }
       });
 
-      this.redis.mset(newValues).catch((err) => logger.warn(`Redis error during mset: ${err.message}`));
+      if (newValues.length > 0) {
+        this.redis.mset(newValues).catch((err) => logger.warn(`Redis error during mset: ${err.message}`));
+      }
     }
 
     if (logger.isDebugEnabled()) {

rest/package.json

@@ -17,7 +17,7 @@
   "author": "Mirror Node Team",
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/client-s3": "3.980.0",
+    "@aws-sdk/client-s3": "3.983.0",
     "@godaddy/terminus": "4.12.1",
     "@hiero-ledger/proto": "2.25.0",
     "@trufflesuite/bigint-buffer": "1.1.10",

web3/build.gradle.kts

@@ -12,14 +12,17 @@ plugins {
     id("spring-conventions")
 }
 
+configurations.all {
+    exclude(group = "io.vertx") // Unused and frequently has vulnerabilities
+}
+
 dependencies {
     implementation(project(":common"))
     implementation("com.bucket4j:bucket4j-core")
     implementation("com.hedera.hashgraph:app") {
         exclude(group = "io.netty")
         exclude(group = "io.opentelemetry")
         exclude(group = "io.prometheus")
-        exclude(group = "io.vertx")
         exclude(group = "org.assertj")
         exclude("org.junit")
     }