Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• Update dependency org.assertj:assertj-core to v3.27.7
• Update dependency org.postgresql:postgresql to v42.7.9
• Update dependency org.testcontainers:postgresql to v1.21.4
• Update Gradle to v8.14.4
• Update plugin io.freefair.lombok to v8.14.4
• Update spring cloud to v4.3.1 (org.springframework.cloud:spring-cloud-openfeign-core, org.springframework.cloud:spring-cloud-starter-openfeign)
• Update versions.restAssured to v5.5.7 (io.rest-assured:json-path, io.rest-assured:xml-path, io.rest-assured:rest-assured)
• Update dependency com.github.hmcts:auth-checker-lib to v3.2.0
• Update dependency com.launchdarkly:launchdarkly-java-server-sdk to v7.11.0
• Update dependency com.nimbusds:nimbus-jose-jwt to v10.7
• Update dependency commons-io:commons-io to v2.21.0
• Update dependency hashicorp/terraform to v1.14.4
• Update dependency io.hypersistence:hypersistence-utils-hibernate-63 to v3.15.1
• Update dependency microsoft/ApplicationInsights-Java to v3.7.7
• Update dependency net.serenity-bdd:serenity-cucumber to v4.3.4
• Update dependency net.serenity-bdd:serenity-single-page-report to v4.3.4
• Update dependency org.apache.commons:commons-lang3 to v3.20.0
• Update dependency org.testng:testng to v7.12.0
• Update plugin net.serenity-bdd.serenity-gradle-plugin to v4.3.2
• Update Terraform azuread to v3.7.0
• Update Terraform azurerm to ~> 4.59.0
• Update versions.serenity to v4.3.4 (net.serenity-bdd:serenity-screenplay, net.serenity-bdd:serenity-spring, net.serenity-bdd:serenity-rest-assured, net.serenity-bdd:serenity-junit, net.serenity-bdd:serenity-core)
• Update actions/checkout action to v6
• Update dependency checkstyle to v13
• Update dependency com.github.hmcts.java-logging:logging to v7
• Update dependency net.logstash.logback:logstash-logback-encoder to v9
• Update dependency net.serenity-bdd:serenity-cucumber to v5
• Update dependency net.serenity-bdd:serenity-single-page-report to v5
• Update dependency org.junit.vintage:junit-vintage-engine to v6
• Update dependency org.liquibase.ext:liquibase-hibernate6 to v5
• Update dependency org.springdoc:springdoc-openapi-starter-webmvc-ui to v3
• Update dependency uk.gov.service.notify:notifications-java-client to v6
• Update plugin io.freefair.lombok to v9
• Update plugin net.serenity-bdd.serenity-gradle-plugin to v5
• Update plugin org.sonarqube to v7
• Update plugin org.springframework.boot to v4
• Update postgres Docker tag to v18
• Update versions.restAssured to v6 (major) (io.rest-assured:json-path, io.rest-assured:xml-path, io.rest-assured:rest-assured)
• Update versions.serenity to v5 (major) (net.serenity-bdd:serenity-screenplay, net.serenity-bdd:serenity-spring, net.serenity-bdd:serenity-rest-assured, net.serenity-bdd:serenity-junit, net.serenity-bdd:serenity-core)
• 🔐 Create all rate-limited PRs at once 🔐

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• Update dependency org.apache.logging.log4j:log4j-bom to v2.25.3
• Update dependency org.junit.vintage:junit-vintage-engine to v5.14.2
• Update dependency org.springdoc:springdoc-openapi-starter-webmvc-ui to v2.8.15
• Update jackson monorepo (com.fasterxml.jackson.core:jackson-databind, com.fasterxml.jackson.core:jackson-core, com.fasterxml.jackson.core:jackson-annotations)
• Update plugin org.owasp.dependencycheck to v12.2.0
• Update plugin org.springframework.boot to v3.5.10
• Update dependency org.hibernate.validator:hibernate-validator to v9
• Update dependency pmd to v7
• Update Gradle to v9
• Update spring cloud (major) (org.springframework.cloud:spring-cloud-openfeign-core, org.springframework.cloud:spring-cloud-starter-openfeign, org.springframework.cloud:spring-cloud-dependencies)
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

docker-compose (1)

docker-compose.yml (1)

• postgres 17-alpine → [Updates: 18-alpine]

dockerfile (1)

Dockerfile (1)

• hmctspublic.azurecr.io/base/java 21-distroless

github-actions (2)

.github/workflows/ci.yml (2)

• actions/checkout v5 → [Updates: v6]
• actions/setup-java v5

.github/workflows/stale.yml (1)

• actions/stale v10

gradle (3)

build.gradle (66)

• net.serenity-bdd:serenity-single-page-report 4.2.34 → [Updates: 4.3.4, 5.2.2]
• io.spring.dependency-management 1.1.7
• org.springframework.boot 3.3.13 → [Updates: 3.5.10, 4.0.2]
• org.owasp.dependencycheck 12.1.6 → [Updates: 12.2.0]
• com.github.ben-manes.versions 0.53.0
• org.sonarqube 6.3.1.5724 → [Updates: 7.2.2.6593]
• uk.gov.hmcts.java 0.12.67
• info.solidsoft.pitest 1.15.0
• io.freefair.lombok 8.14.2 → [Updates: 8.14.4, 9.2.0]
• net.serenity-bdd.serenity-gradle-plugin 4.2.34 → [Updates: 4.3.2, 5.2.2]
• pmd 6.55.0 → [Updates: 7.21.0]
• org.springframework.cloud:spring-cloud-dependencies 2023.0.6 → [Updates: 2025.1.1]
• org.apache.logging.log4j:log4j-bom 2.25.2 → [Updates: 2.25.3]
• com.google.guava:guava 33.5.0-jre
• org.springframework.cloud:spring-cloud-starter-openfeign 4.3.0 → [Updates: 4.3.1, 5.0.1]
• org.springframework.cloud:spring-cloud-openfeign-core 4.3.0 → [Updates: 4.3.1, 5.0.1]
• com.fasterxml.jackson.core:jackson-annotations 2.19.2 → [Updates: 2.21]
• com.fasterxml.jackson.core:jackson-core 2.19.2 → [Updates: 2.21.0]
• com.fasterxml.jackson.core:jackson-databind 2.19.2 → [Updates: 2.21.0]
• com.github.hmcts.java-logging:logging 6.1.9 → [Updates: 7.0.0]
• com.github.hmcts:auth-checker-lib 3.1.2 → [Updates: 3.2.0]
• com.github.hmcts:idam-java-client 3.0.5
• com.github.hmcts:service-auth-provider-java-client 5.3.3
• com.launchdarkly:launchdarkly-java-server-sdk 7.10.2 → [Updates: 7.11.0]
• com.nimbusds:nimbus-jose-jwt 10.5 → [Updates: 10.7]
• commons-io:commons-io 2.20.0 → [Updates: 2.21.0]
• commons-validator:commons-validator 1.10.1
• info.solidsoft.gradle.pitest:gradle-pitest-plugin 1.15.0
• io.github.openfeign:feign-httpclient 13.6
• io.jsonwebtoken:jjwt 0.13.0
• jakarta.inject:jakarta.inject-api 2.0.1
• jakarta.servlet:jakarta.servlet-api 6.1.0
• joda-time:joda-time 2.14.0
• net.logstash.logback:logstash-logback-encoder 8.1 → [Updates: 9.0]
• org.apache.commons:commons-lang3 3.19.0 → [Updates: 3.20.0]
• org.codehaus.sonar-plugins:sonar-pitest-plugin 0.5
• org.eclipse.collections:eclipse-collections-api 13.0.0
• org.eclipse.collections:eclipse-collections 13.0.0
• org.hibernate.validator:hibernate-validator 8.0.3.Final → [Updates: 9.1.0.Final]
• org.postgresql:postgresql 42.7.8 → [Updates: 42.7.9]
• org.springdoc:springdoc-openapi-starter-webmvc-ui 2.6.0 → [Updates: 2.8.15, 3.0.1]
• org.testng:testng 7.11.0 → [Updates: 7.12.0]
• io.hypersistence:hypersistence-utils-hibernate-63 3.11.0 → [Updates: 3.15.1]
• uk.gov.service.notify:notifications-java-client 5.2.1-RELEASE → [Updates: 6.0.0-RELEASE]
• net.sourceforge.findbugs:annotations 1.3.2
• org.projectlombok:lombok 1.18.42
• com.github.hmcts:fortify-client 1.4.10
• io.rest-assured:rest-assured 5.5.6 → [Updates: 5.5.7, 6.0.0]
• org.testcontainers:postgresql 1.21.3 → [Updates: 1.21.4]
• org.assertj:assertj-core 3.27.6 → [Updates: 3.27.7]
• org.apiguardian:apiguardian-api 1.1.2
• org.projectlombok:lombok 1.18.42
• org.projectlombok:lombok 1.18.42
• org.jboss.aerogear:aerogear-otp-java 1.0.0
• junit:junit 4.13.2
• org.junit.vintage:junit-vintage-engine 5.11.4 → [Updates: 5.14.2, 6.0.2]
• net.serenity-bdd:serenity-core 4.2.34 → [Updates: 4.3.4, 5.2.2]
• net.serenity-bdd:serenity-cucumber 4.2.34 → [Updates: 4.3.4, 5.2.2]
• net.serenity-bdd:serenity-junit 4.2.34 → [Updates: 4.3.4, 5.2.2]
• net.serenity-bdd:serenity-rest-assured 4.2.34 → [Updates: 4.3.4, 5.2.2]
• net.serenity-bdd:serenity-spring 4.2.34 → [Updates: 4.3.4, 5.2.2]
• net.serenity-bdd:serenity-screenplay 4.2.34 → [Updates: 4.3.4, 5.2.2]
• io.rest-assured:xml-path 5.5.6 → [Updates: 5.5.7, 6.0.0]
• io.rest-assured:json-path 5.5.6 → [Updates: 5.5.7, 6.0.0]
• org.jboss.aerogear:aerogear-otp-java 1.0.0
• checkstyle 7.8.2 → [Updates: 13.2.0]

cve-resolution-strategy.gradle

liquibase.gradle (1)

• org.liquibase.ext:liquibase-hibernate6 4.33.0 → [Updates: 5.0.1]

gradle-wrapper (1)

gradle/wrapper/gradle-wrapper.properties (1)

• gradle 8.14.3 → [Updates: 8.14.4, 9.3.1]

helm-values (1)

charts/ccpay-refunds-api/values.yaml

helmv3 (1)

charts/ccpay-refunds-api/Chart.yaml (4)

• java 5.3.0
• payment-api 2.3.70
• ccpay-bulkscanning-api 1.0.30
• ccpay-notifications-service 1.0.19

regex (2)

Dockerfile (1)

• microsoft/ApplicationInsights-Java 3.6.2 → [Updates: 3.7.7]

Dockerfile (1)

• microsoft/ApplicationInsights-Java 3.6.2 → [Updates: 3.7.7]

renovate-config-presets (1)

.github/renovate.json

terraform (4)

infrastructure/cft-api-mgmt.tf

infrastructure/main.tf

infrastructure/provider.tf

infrastructure/state.tf (2)

• azuread 3.6.0 → [Updates: 3.7.0]
• azurerm ~> 4.50.0 → [Updates: ~> 4.59.0]

terraform-version (1)

infrastructure/.terraform-version (1)

• hashicorp/terraform 1.13.4 → [Updates: 1.14.4]

---

• Check this box to trigger a request for Renovate to run again on this repository