Spring Boot 3 Upgrade

build.gradle

@@ -1,11 +1,11 @@
 plugins {
   id 'application'
   id 'jacoco'
-  id 'io.spring.dependency-management' version '1.0.10.RELEASE'
-  id 'org.springframework.boot' version '2.7.18'
-  id 'com.github.ben-manes.versions' version '0.20.0'
-  id 'org.sonarqube' version '4.4.0.3356'
-  id 'uk.gov.hmcts.java' version '0.12.40'
+  id 'io.spring.dependency-management' version '1.1.5'
+  id 'org.springframework.boot' version '3.1.12'
+  id 'com.github.ben-manes.versions' version '0.51.0'
+  id 'org.sonarqube' version '5.0.0.4638'
+  id 'uk.gov.hmcts.java' version '0.12.63'
 }
 
 group = 'uk.gov.hmcts.reform.ccd'
@@ -90,9 +90,9 @@ task functional(type: Test) {
 jacocoTestReport {
   executionData(test, integration)
   reports {
-    xml.enabled = true
-    csv.enabled = false
-    xml.destination file("${buildDir}/reports/jacoco/test/jacocoTestReport.xml")
+    xml.required = true
+    csv.required = false
+    xml.outputLocation = file("${buildDir}/reports/jacoco/test/jacocoTestReport.xml")
   }
 }
 
@@ -107,7 +107,7 @@ sonarqube {
     property "sonar.jacoco.reportPaths", "${project.buildDir}/jacoco/test.exec"
     property "sonar.jacoco.itReportPath", "${project.buildDir}/jacoco/integration.exec"
     property "sonar.junit.reportPaths", "${project.buildDir}/test-results/junit-platform"
-    property "sonar.coverage.jacoco.xmlReportPaths", "${jacocoTestReport.reports.xml.destination.path}"
+    property "sonar.coverage.jacoco.xmlReportPaths", "${jacocoTestReport.reports.xml.outputLocation}"
   }
 }
 
@@ -138,110 +138,114 @@ repositories {
 }
 
 ext {
-  groovyVersion = '3.0.7'
-  tomcatVersion = '9.0.83'
-  jettyVersion = '9.4.53.v20231009'
+  junitVersion = '5.3.2'
+  groovyVersion = '4.0.21'
+  restAssuredVersion = '5.3.2'
+  tomcatVersion = '10.1.25'
+  reformLogging = '6.0.1'
+  jettyVersion = '11.0.20'
+  springCloudVersion = '2022.0.5'
 }
 
-ext['spring-framework.version'] = '5.3.27'
-ext['spring-security.version'] = '5.8.10'
-ext['log4j2.version'] = '2.17.1'
+ext['spring-framework.version'] = '6.0.21'
+ext['spring-security.version'] = '6.0.8'
+ext['log4j2.version'] = '2.23.1'
 ext['jackson.version'] = '2.16.0'
-ext['snakeyaml.version'] = '2.0'
+ext['snakeyaml.version'] = '2.2'
 
-// it is important to specify logback classic and core packages explicitly as libraries like spring boot
-// enforces it's own (older) version which is not recommended.
-def versions = [
-  junit           : '5.3.2',
-  reformLogging   : '6.0.1',
-  springBoot      : '3.0',
-  springfoxSwagger: '3.0.0',
-]
+dependencyManagement {
+  imports {
+    mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
+  }
+}
 
+configurations.all {
+  exclude group: 'ch.qos.logback', module: 'logback-core'
+  exclude group: 'ch.qos.logback', module: 'logback-classic'
+}
 
 dependencies {
-  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-bootstrap', version: '3.1.8'
-  implementation group: 'com.google.guava', name: 'guava', version:'32.1.2-jre'
-  implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13'
-
-  implementation "org.apache.tomcat.embed:tomcat-embed-core:${tomcatVersion}"
-  implementation "org.apache.tomcat.embed:tomcat-embed-el:${tomcatVersion}"
-  implementation "org.apache.tomcat.embed:tomcat-embed-websocket:${tomcatVersion}"
-
-  // CVE-2021-28170
-  implementation group: 'org.glassfish', name: 'jakarta.el', version: '4.0.1'
-  // CVE-2021-42550
-  implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.13'
-  implementation group: 'ch.qos.logback', name: 'logback-core', version: '1.2.13'
 
+  // SPRING
+  implementation group: 'org.springframework.boot', name: 'spring-boot-starter'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-json'
+  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter'
+  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-bootstrap'
+  implementation group: 'org.springframework.security', name: 'spring-security-crypto'
+  implementation group: 'org.springframework.security', name: 'spring-security-rsa'
+
+  implementation group: 'com.google.guava', name: 'guava', version:'32.1.2-jre'
+  implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13'
 
-  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: versions.reformLogging
-  implementation(group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-hystrix', version: '2.2.10.RELEASE') {
-    exclude group: 'org.springframework.security', module: 'spring-security-rsa'
-  }
+  implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: tomcatVersion
+  implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-el', version: tomcatVersion
+  implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-websocket', version: tomcatVersion
+
+  implementation group: 'jakarta.el', name: 'jakarta.el-api', version: '5.0.1'
+
+  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: '6.1.4'
 
-  // https://mvnrepository.com/artifact/com.github.tomakehurst/wiremock
-  implementation(group: 'com.github.tomakehurst', name: 'wiremock-jre8', version: '2.35.2')
-// https://mvnrepository.com/artifact/com.github.jknack/handlebars
+  implementation group: 'org.wiremock', name: 'wiremock-standalone', version: '3.0.3'
   implementation group: 'com.github.jknack', name: 'handlebars', version: '4.3.1'
 
+  // JETTY
   implementation group: 'org.eclipse.jetty', name: 'jetty-server', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-client', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-java-client', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-java-server', version: jettyVersion
-  implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-openjdk8-client', version: jettyVersion
-  implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-openjdk8-server', version: jettyVersion
-  implementation group: 'org.eclipse.jetty', name: 'jetty-continuation', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-util', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-util-ajax', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-xml', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-client', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-security', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-http', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-io', version: jettyVersion
-  implementation group: 'org.eclipse.jetty.http2', name: 'http2-server', version: jettyVersion
-  implementation group: 'org.eclipse.jetty.http2', name: 'http2-common', version: jettyVersion
-  implementation group: 'org.eclipse.jetty.http2', name: 'http2-hpack', version: jettyVersion
-
   implementation group: 'org.eclipse.jetty', name: 'jetty-servlet', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-servlets', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-webapp', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-proxy', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-server', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-conscrypt-server', version: jettyVersion
   implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-conscrypt-client', version: jettyVersion
+  implementation group: 'org.eclipse.jetty.http2', name: 'http2-server', version: jettyVersion
+  implementation group: 'org.eclipse.jetty.http2', name: 'http2-common', version: jettyVersion
+  implementation group: 'org.eclipse.jetty.http2', name: 'http2-hpack', version: jettyVersion
 
-  implementation group: 'org.codehaus.groovy', name: 'groovy-json', version: groovyVersion
-  implementation group: 'org.codehaus.groovy', name: 'groovy', version: groovyVersion
-  implementation group: 'org.codehaus.groovy', name: 'groovy-xml', version: groovyVersion
+  implementation group: 'org.apache.groovy', name: 'groovy-json', version: groovyVersion
+  implementation group: 'org.apache.groovy', name: 'groovy', version: groovyVersion
+  implementation group: 'org.apache.groovy', name: 'groovy-xml', version: groovyVersion
 
   implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '7.9'
-  implementation group: 'org.springframework.security', name: 'spring-security-crypto'
-
+  implementation group: 'net.minidev', name: 'json-smart', version: '2.4.11'
 
   implementation group: 'commons-fileupload', name: 'commons-fileupload', version: '1.5'
   implementation group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.4'
   implementation group: 'commons-io', name: 'commons-io', version: '2.8.0'
 
-  testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: versions.junit
-  testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-params', version: versions.junit
-  testRuntimeOnly group: 'org.junit.jupiter', name: 'junit-jupiter-engine', version: versions.junit
+  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: reformLogging
+
+  testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: junitVersion
+  testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-params', version: junitVersion
+  testRuntimeOnly group: 'org.junit.jupiter', name: 'junit-jupiter-engine', version: junitVersion
 
   testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'
-  testImplementation(group: 'io.rest-assured', name: 'rest-assured', version: '4.3.0') {
+  testImplementation group: 'io.rest-assured', name: 'rest-assured', version: restAssuredVersion, {
     exclude group: 'org.apache.sling', module: 'org.apache.sling.javax.activation'
+    exclude group: 'org.codehaus.grooy'
+  }
+  testImplementation group: 'io.rest-assured', name: 'json-path', version: restAssuredVersion, {
+    exclude group: 'org.codehaus.grooy'
   }
-  testImplementation group: 'io.rest-assured', name: 'json-path', version: '4.3.0'
-  testImplementation(group: 'io.rest-assured', name: 'xml-path', version: '4.3.0') {
+  testImplementation group: 'io.rest-assured', name: 'xml-path', version: restAssuredVersion, {
     exclude group: 'org.apache.sling', module: 'org.apache.sling.javax.activation'
+    exclude group: 'org.codehaus.grooy'
   }
 
   testImplementation group: 'org.hamcrest', name: 'hamcrest', version: '2.2'
-  testImplementation 'com.github.hmcts:fortify-client:1.3.0:all'
+  testImplementation group: 'com.github.hmcts', name: 'fortify-client', version: '1.4.1'
   integrationTestImplementation sourceSets.main.runtimeClasspath
   integrationTestImplementation sourceSets.test.runtimeClasspath
 
@@ -250,49 +254,19 @@ dependencies {
 
   functionalTestImplementation sourceSets.main.runtimeClasspath
   functionalTestImplementation sourceSets.test.runtimeClasspath
-
-  implementation group: 'junit', name: 'junit', version: '4.13.1'
-
-  implementation group: 'net.minidev', name: 'json-smart', version: '2.4.7'
-
-  // CCD-3511 CVE-2020-15522
-  implementation group: 'org.bouncycastle', name: 'bcpkix-jdk15to18', version: '1.77'
-
-  implementation 'org.springframework.cloud:spring-cloud-starter-bootstrap:3.1.8'
-  implementation('org.springframework.cloud:spring-cloud-starter'){
-    version {
-      strictly '3.1.8'
-    }
-  }
-
-  implementation('org.springframework.boot:spring-boot-starter'){
-    version {
-      strictly '3.1.8'
-    }
-  }
-
-  implementation('org.springframework.security:spring-security-rsa'){
-    version {
-      strictly '1.0.12.RELEASE'
-    }
-  }
-
-  implementation('org.bouncycastle:bcpkix-jdk18on') {
-    version {
-      strictly '1.77'
-    }
-  }
 }
 
 test {
   useJUnitPlatform()
   failFast = true
 }
 
-mainClassName = 'uk.gov.hmcts.reform.ccd.test.stubs.service.Application'
+application {
+  mainClass = 'uk.gov.hmcts.reform.ccd.test.stubs.service.Application'
+}
 
 bootJar {
-  archiveName = 'ccd-test-stubs-service.jar'
+  archiveFileName = 'ccd-test-stubs-service.jar'
 
   manifest {
     attributes('Implementation-Title': project.name)
@@ -303,17 +277,11 @@ bootJar {
   }
 }
 
-dependencyManagement {
-  imports {
-    mavenBom "org.springframework.cloud:spring-cloud-dependencies:2021.0.1"
-  }
-}
-
 // for cnp pipeline
 task dependencyCheck(dependsOn: dependencyCheckAnalyze)
 
 task fortifyScan(type: JavaExec)  {
-  main = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
+  mainClass = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
   classpath += sourceSets.test.runtimeClasspath
   jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
   // The line below prevents the build from failing if the Fortify scan detects issues

dependency-check-suppressions.xml

@@ -1,12 +1,2 @@
 <?xml version="1.0" encoding="UTF-8"?><suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-  <suppress>
-    <notes>Temporary Suppression
-        CVE-2022-45688 refer https://tools.hmcts.net/jira/browse/CCD-4373
-        CVE-2023-5072 refer [Ticket]
-        CVE-2023-41327 refer [Ticket]
-        CVE-2023-1370 refer [Ticket]</notes>
-    <cve>CVE-2022-45688</cve>
-    <cve>CVE-2023-5072</cve>
-    <cve>CVE-2023-1370</cve>
-  </suppress>
 </suppressions>

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists