Merge pull request #174 from cinovo/dependencyupdate

siglocpp · web-flow · commit b52314bdb4dc · 2025-11-17T08:53:51.000+01:00
updated dependencies, fixing vulnerabilities
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,4 +1,25 @@
 # current master
+* Update dependencies
+    * ActiveMQ 5.16.8
+    * Apache CXF 3.5.11
+    * AWS 1.12.793
+    * Bouncycastle Provider 1.81
+    * Guava 33.4.2-jre
+    * Jetty 9.4.58.v20250814
+    * Joda-Time 2.14.0
+    * JSON Small and Fast Parser 2.5.2
+    * Junit 5.11.4
+    * Liquibase 4.32.0
+    * Log4J 2.25.2
+    * Mongo Java Driver 4.11.5
+    * Mongock 5.5.1
+    * Nimbus JOSE+JWT 10.3
+    * Swagger 2.2.40
+    * Velocity Engine 2.4.1
+* Fixing DaemonExceptionMapper 
+* Fixed vulnerabilities: CVE-2024-13009(Jetty), CVE-2025-23184(Apache CXF), CVE-2024-57699 (Json-smart),CVE-2025-27533 (ActiveMQ)
+
+# 1.37
 * Major bug in interconnect core: DaemonScanner causes IllegalArgumentException due to wrong path of TimeoutException
 
 # 1.36
diff --git a/jaxrs-jwtauth/pom.xml b/jaxrs-jwtauth/pom.xml
@@ -20,7 +20,7 @@
         <dependency>
             <groupId>com.nimbusds</groupId>
             <artifactId>nimbus-jose-jwt</artifactId>
-            <version>9.41</version>
+            <version>10.3</version>
         </dependency>
 
 
@@ -33,7 +33,7 @@
         <dependency>
             <groupId>net.minidev</groupId>
             <artifactId>json-smart</artifactId>
-            <version>2.5.1</version>
+            <version>2.5.2</version>
             <scope>compile</scope>
         </dependency>
     </dependencies>
diff --git a/jaxrs-swagger/pom.xml b/jaxrs-swagger/pom.xml
@@ -24,7 +24,7 @@
         <dependency>
             <groupId>io.swagger.core.v3</groupId>
             <artifactId>swagger-jaxrs2</artifactId>
-            <version>2.2.22</version>
+            <version>2.2.40</version>
         </dependency>
 
         <dependency>
diff --git a/jaxrs/pom.xml b/jaxrs/pom.xml
@@ -25,13 +25,13 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk18on</artifactId>
-            <version>1.78.1</version>
+            <version>1.81</version>
         </dependency>
 
         <dependency>
             <groupId>io.swagger.core.v3</groupId>
             <artifactId>swagger-jaxrs2</artifactId>
-            <version>2.2.22</version>
+            <version>2.2.40</version>
         </dependency>
 
         <dependency>
diff --git a/jpa/pom.xml b/jpa/pom.xml
@@ -34,7 +34,7 @@
         <dependency>
             <groupId>org.liquibase</groupId>
             <artifactId>liquibase-core</artifactId>
-            <version>4.28.0</version>
+            <version>4.32.0</version>
         </dependency>
         <dependency>
             <groupId>com.mattbertolini</groupId>
diff --git a/mongodb-legacy/src/main/java/de/taimos/dvalin/mongo/config/MongoDBConfig.java b/mongodb-legacy/src/main/java/de/taimos/dvalin/mongo/config/MongoDBConfig.java
@@ -65,7 +65,7 @@ public RunnerStandaloneBuilder mongockRunner(com.mongodb.client.MongoClient mong
         driver.setReadPreference(ReadPreference.primary());
         driver.disableTransaction();
 
-        RunnerStandaloneBuilder runnerStandaloneBuilder = MongockStandalone.builder().setDriver(driver).setTransactionEnabled(false);
+        RunnerStandaloneBuilder runnerStandaloneBuilder = MongockStandalone.builder().setDriver(driver).setTransactional(false);
         if (this.basePackage == null || this.basePackage.isEmpty()){
             throw new RuntimeException("LegacyMigration basePackage must be set!");
         }
diff --git a/mongodb-legacy/src/test/java/de/taimos/dvalin/mongo/BaseTest.java b/mongodb-legacy/src/test/java/de/taimos/dvalin/mongo/BaseTest.java
@@ -68,7 +68,7 @@ public static void init() {
             MongoSync4Driver driver = MongoSync4Driver.withDefaultLock(ABaseTest.mongo, ABaseTest.dbName);
             driver.disableTransaction();
             MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog")
-                .setTransactionEnabled(false).setEnabled(true).buildRunner().execute();
+                .setTransactional(false).setEnabled(true).buildRunner().execute();
             BaseTest.dao.init();
         } catch (Exception e) {
             System.out.println("Initialization failure");
diff --git a/mongodb-legacy/src/test/java/de/taimos/dvalin/mongo/LinkTest.java b/mongodb-legacy/src/test/java/de/taimos/dvalin/mongo/LinkTest.java
@@ -61,7 +61,7 @@ public static void init() {
 
             MongoSync4Driver driver = MongoSync4Driver.withDefaultLock(ABaseTest.mongo, ABaseTest.dbName);
             driver.disableTransaction();
-            MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog").setTransactionEnabled(false).setEnabled(true).buildRunner().execute();
+            MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog").setTransactional(false).setEnabled(true).buildRunner().execute();
             LinkTest.dao.init();
             LinkTest.ldao.init();
         } catch (Exception e) {
diff --git a/mongodb/src/main/java/de/taimos/dvalin/mongo/config/MongoDBConfig.java b/mongodb/src/main/java/de/taimos/dvalin/mongo/config/MongoDBConfig.java
@@ -96,7 +96,7 @@ public RunnerStandaloneBuilder mongockRunner(MongoClient mongoClient, MongoDatab
         RunnerStandaloneBuilder runnerStandaloneBuilder = MongockStandalone.builder() //
             .setDriver(this.createMongoSyncDriver(mongoClient)) //
             .setEnabled(this.mongockEnabled) //
-            .setTransactionEnabled(false) //
+            .setTransactional(false) //
             .addMigrationScanPackage(this.basePackage)
             .setLegacyMigration(this.mongockLegacyMigrationEnabled ? this.getLegacyMigration() : null) //
             .addDependency(mongoDatabase);
diff --git a/mongodb/src/test/java/de/taimos/dvalin/mongo/LinkTest.java b/mongodb/src/test/java/de/taimos/dvalin/mongo/LinkTest.java
@@ -64,7 +64,7 @@ public static void init() {
 
             MongoSync4Driver driver = MongoSync4Driver.withDefaultLock(ABaseTest.mongo, ABaseTest.dbName);
             driver.disableTransaction();
-            MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog").setTransactionEnabled(false).setEnabled(true).buildRunner().execute();
+            MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog").setTransactional(false).setEnabled(true).buildRunner().execute();
             LinkTest.dao.init();
             LinkTest.ldao.init();
         } catch (Exception e) {
diff --git a/mongodb/src/test/java/de/taimos/dvalin/mongo/MongoAuditedDAOTest.java b/mongodb/src/test/java/de/taimos/dvalin/mongo/MongoAuditedDAOTest.java
@@ -57,7 +57,7 @@ static void init() {
             MongoSync4Driver driver = MongoSync4Driver.withDefaultLock(ABaseTest.mongo, ABaseTest.dbName);
             driver.disableTransaction();
             MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog")
-                .setTransactionEnabled(false).setEnabled(true).buildRunner().execute();
+                .setTransactional(false).setEnabled(true).buildRunner().execute();
             MongoAuditedDAOTest.dao.init();
         } catch (Exception e) {
             Assertions.fail(Arrays.toString(e.getStackTrace()));
diff --git a/mongodb/src/test/java/de/taimos/dvalin/mongo/MongoDataAccessTest.java b/mongodb/src/test/java/de/taimos/dvalin/mongo/MongoDataAccessTest.java
@@ -58,7 +58,7 @@ static void init() {
             MongoSync4Driver driver = MongoSync4Driver.withDefaultLock(ABaseTest.mongo, ABaseTest.dbName);
             driver.disableTransaction();
             MongockStandalone.builder().setDriver(driver).addMigrationScanPackage("de.taimos.dvalin.mongo.changelog")
-                .setTransactionEnabled(false).setEnabled(true).buildRunner().execute();
+                .setTransactional(false).setEnabled(true).buildRunner().execute();
             MongoDataAccessTest.dao.init();
         } catch (Exception e) {
             Assertions.fail(Arrays.toString(e.getStackTrace()));
diff --git a/pom.xml b/pom.xml
@@ -54,25 +54,25 @@
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <org.springframework.version>5.3.39</org.springframework.version>
-        <jackson.version>2.17.2</jackson.version>
-        <joda.time.version>2.12.7</joda.time.version>
-        <slf4j.version>1.7.36</slf4j.version>
-        <log4j.version>2.23.1</log4j.version>
-        <junit.version>5.10.3</junit.version>
-        <aws.version>1.12.772</aws.version>
-        <activemq.version>5.16.7</activemq.version>
-        <cxf.version>3.5.9</cxf.version>
-        <jetty.version>9.4.56.v20240826</jetty.version>
-        <guava.version>33.3.0-jre</guava.version>
+        <activemq.version>5.16.8</activemq.version>
+        <aws.version>1.12.793</aws.version>
+        <bson.version>2.15.1</bson.version>
+        <cxf.version>3.5.11</cxf.version>
+        <guava.version>33.4.2-jre</guava.version> <!-- newer guava removed jsr305 dependency-->
         <hibernate.version>5.6.14.Final</hibernate.version>
         <http.version>2.2</http.version>
-        <velocity.version>2.3</velocity.version>
-        <bson.version>2.15.1</bson.version>
-        <mongo.version>4.11.4</mongo.version>
-        <mongock.version>5.4.4</mongock.version>
+        <jackson.version>2.17.2</jackson.version>
+        <jetty.version>9.4.58.v20250814</jetty.version>
+        <joda.time.version>2.14.0</joda.time.version>
+        <junit.version>5.11.4</junit.version><!-- newer JUnit version not working with Mockito-->
+        <log4j.version>2.25.2</log4j.version>
+        <mockito-core.version>4.11.0</mockito-core.version>
+        <mongo.version>4.11.5</mongo.version>
+        <mongock.version>5.5.1</mongock.version>
         <mongo-java-server.version>1.43.0</mongo-java-server.version>
+        <slf4j.version>1.7.36</slf4j.version>
+        <velocity.version>2.4.1</velocity.version>
         <xdocreport.version>2.0.4</xdocreport.version>
-        <mockito-core.version>4.11.0</mockito-core.version>
     </properties>
     <scm>
         <connection>scm:git:https://github.com/taimos/dvalin.git</connection>
@@ -545,7 +545,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.3.0</version></plugin>
+                <version>3.5.3</version></plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-gpg-plugin</artifactId>

Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,7 @@ public RunnerStandaloneBuilder mongockRunner(com.mongodb.client.MongoClient mong`
`65`	`65`	`driver.setReadPreference(ReadPreference.primary());`
`66`	`66`	`driver.disableTransaction();`
`67`	`67`
`68`		`- RunnerStandaloneBuilder runnerStandaloneBuilder = MongockStandalone.builder().setDriver(driver).setTransactionEnabled(false);`
	`68`	`+ RunnerStandaloneBuilder runnerStandaloneBuilder = MongockStandalone.builder().setDriver(driver).setTransactional(false);`
`69`	`69`	`if (this.basePackage == null \|\| this.basePackage.isEmpty()){`
`70`	`70`	`throw new RuntimeException("LegacyMigration basePackage must be set!");`
`71`	`71`	`}`