Dtscci-217 - test springboot3

.github/workflows/codeql-analysis.yml

@@ -24,15 +24,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+
+      - name: Setup Java JDK
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v1
+        uses: github/codeql-action/autobuild@v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v3

build.gradle

@@ -5,7 +5,7 @@ plugins {
   id 'uk.gov.hmcts.java' version '0.12.43'
   id 'checkstyle'
   id 'io.spring.dependency-management' version '1.1.0'
-  id 'org.springframework.boot' version '2.7.18'
+  id 'org.springframework.boot' version '3.2.7'
   id 'org.owasp.dependencycheck' version '8.0.1'
   id 'org.sonarqube' version '5.0.0.4638'
   id 'com.github.ben-manes.versions' version '0.51.0'
@@ -28,15 +28,15 @@ dependencyUpdates.resolutionStrategy = {
 }
 
 def springBootVersion = plugins.getPlugin('org.springframework.boot').class.package.implementationVersion
-def springCloudVersion = '2021.0.9'
+def springCloudVersion = '2023.0.1'
 
 def versions = [
-  logback           : '1.2.13',
-  springBoot        : springBootVersion,
-  restAssuredVersion: '4.2.0',
-  jackson           : '2.17.0',
-  junit             : '5.10.1',
-  junitPlatform     : '1.10.2',
+  logback            : '1.5.6',
+  springBoot         : springBootVersion,
+  restAssured        : '5.4.0',
+  jackson            : '2.17.1',
+  junit              : '5.10.1',
+  junitPlatform      : '1.10.2',
   pact_version    : '4.1.7',
   serviceAuthVersion : '4.0.3',
   idamJavaClient : '2.0.1',
@@ -148,41 +148,41 @@ allprojects {
     }
     jcenter()
   }
+  configurations.all {
+    exclude group: 'com.vaadin.external.google', module: 'android-json'
+    exclude group: 'jakarta.activation', module: 'jakarta.activation-api'
+  }
 
   dependencyManagement {
     imports {
       mavenBom "org.springframework.boot:spring-boot-dependencies:${springBootVersion}"
       mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
     }
     dependencies {
-      // checkstyle needs a certain version and so does spring fox swagger, so can't use latest
-      // fun times...
-      dependency group: 'com.google.guava', name: 'guava', version: '33.1.0-jre'
-
-      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: versions.jackson
-      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: versions.jackson
-      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: versions.jackson
-
-      dependency group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.77'
-
       dependencySet(
-        group: 'org.yaml',
-        version: '2.0'
+        group: 'org.hibernate',
+        version: '8.0.1.Final'
       ) {
-        entry 'snakeyaml'
+        entry 'hibernate-validator'
       }
 
-      dependencySet(group: 'ch.qos.logback', version: '1.2.13') {
-        entry 'logback-core'
-        entry 'logback-classic'
+      //Solves CVE-2023-35116
+      dependencySet(group: 'com.fasterxml.jackson.core', version: versions.jackson) {
+        entry 'jackson-core'
+        entry 'jackson-annotations'
+        entry 'jackson-databind'
       }
 
-      dependencySet(
-        group: 'org.hibernate',
-        version: '8.0.1.Final'
-      ) {
-        entry 'hibernate-validator'
+      dependencySet(group: 'ch.qos.logback', version: '1.5.6') {
+        entry 'logback-classic'
+        entry 'logback-core'
       }
+
+      //Solves  CVE-2023-2976, CVE-2018-10237, CVE-2020-8908
+      dependency group: 'com.google.guava', name: 'guava', version: '33.1.0-jre'
+
+      //Solves  CVE-2023-33201
+      dependency group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.77'
     }
   }
 }
@@ -217,14 +217,12 @@ dependencies {
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-quartz'
 
-  implementation group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.20.0'
-  implementation group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.20.0'
-
-  implementation group: 'org.flywaydb', name: 'flyway-core', version: '5.2.4'
 
+  implementation group: 'org.flywaydb', name: 'flyway-core', version: '10.14.0'
+  runtimeOnly group: 'org.flywaydb', name: 'flyway-database-postgresql', version: '10.14.0'
 
-  implementation group: 'ch.qos.logback', name: 'logback-classic', version: versions.logback
-  implementation group: 'ch.qos.logback', name: 'logback-core', version: versions.logback
+  implementation group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.20.0'
+  implementation group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.20.0'
 
   implementation group: 'com.mitchellbosecke', name: 'pebble', version: '2.4.0'
 
@@ -237,24 +235,26 @@ dependencies {
 
   implementation group: 'uk.gov.service.notify', name: 'notifications-java-client', version: '5.0.1-RELEASE'
 
-  implementation group: 'uk.gov.hmcts.reform', name: 'logging', version: '5.1.7'
-  implementation group: 'uk.gov.hmcts.reform', name: 'logging-appinsights', version: '5.1.7'
-  implementation group: 'com.microsoft.azure', name: 'applicationinsights-web', version: '2.6.4'
+  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: '6.1.4'
+  implementation group: 'com.github.hmcts.java-logging', name: 'logging-appinsights', version: '6.1.2'
+  implementation group: 'com.microsoft.azure', name: 'applicationinsights-web', version: '3.5.1'
 
   implementation group: 'com.github.hmcts', name: 'java-logging', version: '6.1.4'
 
   implementation('com.github.hmcts:cmc-pdf-service-client:7.0.0') {
     exclude group: 'java-logging', module: ' java-logging'
   }
-  implementation group: 'uk.gov.hmcts.reform', name: 'document-management-client', version: '7.0.0'
+
+  implementation group: 'com.github.hmcts', name: 'document-management-client', version: '7.0.1'
   implementation group: 'com.launchdarkly', name: 'launchdarkly-java-server-sdk', version: '6.3.0'
-  implementation group: 'uk.gov.hmcts.reform', name: 'core-case-data-store-client', version: '4.7.6'
+  implementation group: 'com.github.hmcts', name: 'core-case-data-store-client', version: '4.9.2'
+
   implementation group: 'com.github.hmcts', name: 'ccd-case-document-am-client', version: '1.7.1'
   implementation group: 'com.github.hmcts', name: 'doc-assembly-client', version: '1.2.2'
   implementation('com.github.hmcts:payments-java-client:0.0.7') {
     exclude group: 'java-logging', module: ' java-logging'
   }
-  implementation group: 'uk.gov.hmcts.reform', name: 'service-auth-provider-client', version: '4.0.0'
+  implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '5.1.2'
   implementation group: 'com.github.hmcts', name: 'send-letter-client', version: '3.0.16'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation', version: versions.springBoot
 
@@ -268,33 +268,40 @@ dependencies {
   implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '9.37.3'
   implementation group: 'io.jsonwebtoken', name: 'jjwt', version: '0.9.1'
 
+  implementation group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.3.1'
+
   implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.14.0'
   implementation group: 'org.apache.commons', name: 'commons-csv', version: '1.8'
 
   implementation group: 'org.jdbi', name: 'jdbi', version: '2.78'
 
   implementation group: 'org.springframework', name: 'spring-context-support'
-  implementation group: 'org.springframework.retry', name: 'spring-retry'
-  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign'
+  implementation group: 'org.springframework.retry', name: 'spring-retry', version: '2.0.6'
+  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '4.1.2'
+  implementation group: 'org.springframework.cloud', name: 'spring-cloud-openfeign-core', version: '4.1.2'
 
   implementation group: 'io.github.openfeign', name: 'feign-httpclient', version: '13.2.1'
 
-  implementation group: 'org.springframework.cloud',name : 'spring-cloud-starter-bootstrap'
+  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-bootstrap', version: '4.0.1'
 
-  implementation group: 'org.json', name: 'json', version: '20240303'
+  implementation group: 'jakarta.json', name: 'jakarta.json-api', version: '2.1.3'
+  implementation group: 'jakarta.inject', name: 'jakarta.inject-api', version: '2.0.1'
 
-  implementation group: 'javax.json', name: 'javax.json-api', version: '1.1.4'
-  implementation group: 'javax.inject', name: 'javax.inject', version: '1'
+  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-loadbalancer', version: '4.1.2'
+
+  implementation group: 'org.json', name: 'json', version: '20240303'
+  implementation group: 'org.eclipse.parsson', name: 'parsson', version: '1.1.5'
 
   annotationProcessor group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
   compileOnly group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
 
   testImplementation project(':domain-sample-data')
   testImplementation project(path: ":ccd-adapter", configuration: 'testArtifacts')
-  testImplementation group: 'io.rest-assured', name: 'rest-assured', version: versions.restAssuredVersion
-  testImplementation group: 'io.rest-assured', name: 'json-path', version: versions.restAssuredVersion
-  testImplementation group: 'io.rest-assured', name: 'rest-assured-common', version: versions.restAssuredVersion
-  testImplementation group: 'io.rest-assured', name: 'xml-path', version: versions.restAssuredVersion
+  testImplementation group: 'io.rest-assured', name: 'rest-assured', version: versions.restAssured
+  testImplementation group: 'io.rest-assured', name: 'json-path', version: versions.restAssured
+  testImplementation group: 'io.rest-assured', name: 'rest-assured-common', version: versions.restAssured
+  testImplementation group: 'io.rest-assured', name: 'xml-path', version: versions.restAssured
+
 
   testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'
   testImplementation group: 'org.springframework.cloud', name: 'spring-cloud-contract-wiremock'
@@ -316,7 +323,7 @@ dependencies {
   testImplementation group: 'net.jodah', name: 'failsafe', version: '2.4.0'
   testImplementation group: 'org.xmlunit', name: 'xmlunit-core', version: '2.8.2'
   testImplementation group: 'org.xmlunit', name: 'xmlunit-matchers', version: '2.8.2'
-  testImplementation 'com.github.hmcts:fortify-client:1.2.1:all'
+  testImplementation 'com.github.hmcts:fortify-client:1.4.1:all'
 
   integrationTestImplementation sourceSets.main.runtimeClasspath
   integrationTestImplementation sourceSets.test.runtimeClasspath
@@ -340,9 +347,6 @@ dependencies {
   contractTestImplementation sourceSets.main.runtimeClasspath
   contractTestImplementation sourceSets.test.runtimeClasspath
 }
-configurations.all {
-  exclude group: 'com.vaadin.external.google', module: 'android-json'
-}
 
 dependencies {
   testImplementation project(path: ':domain-model')
@@ -353,8 +357,6 @@ dependencies {
   integrationTestImplementation project(':domain-model')
 }
 
-
-
 task contract(type: Test) {
   description = 'Runs the consumer Pact tests'
   useJUnitPlatform()
@@ -412,6 +414,10 @@ task migrateClaims() {
 
 tasks.withType(Test) {
   useJUnitPlatform()
+
+  testLogging {
+    exceptionFormat = 'full'
+  }
 }
 
 task functional(type: Test) {
@@ -422,7 +428,6 @@ task functional(type: Test) {
   include "uk/gov/hmcts/cmc/claimstore/tests/functional/**"
   testLogging.showStandardStreams = true
 
-
   environment("APPINSIGHTS_INSTRUMENTATIONKEY", "test-key")
 }
 
@@ -490,6 +495,7 @@ sonarqube {
         "**/cmc/claimstore/services/ccd/callbacks/ioc/FeesAndPaymentsConfiguration.java",
         "**/cmc/claimstore/services/ccd/callbacks/HWFMiscellaneousCallbackHandler.java",
         "**/cmc/claimstore/services/ccd/callbacks/HWFFullAndPartRemissionCallbackHandler.java",
+        "**/cmc/claimstore/services/UserService.java",
         "**/cmc/claimstore/courtfinder/models/**",
         "**/ccd/migration/**",
         "**/EmailData.java",

config/owasp/suppressions.xml

@@ -3,9 +3,7 @@
     <suppress>
         <cve>CVE-2023-39017</cve>
         <cve>CVE-2022-45688</cve>
-        <cve>CVE-2024-23446</cve>
-        <cve>CVE-2024-22257</cve>
+        <cve>CVE-2023-6378</cve>
         <cve>CVE-2023-5072</cve>
-        <cve>CVE-2023-33202</cve>
     </suppress>
 </suppressions>

domain-model/build.gradle

@@ -9,28 +9,26 @@ repositories {
 
 dependencies {
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-json'
+
   implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.14.0'
   implementation group: 'cz.jirutka.validator', name: 'validator-collection', version: '2.2.0'
 
-  //   The below fixes https://nvd.nist.gov/vuln/detail/CVE-2019-12384 while waiting for spring to pull new version
-  implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.17.0'
-
   annotationProcessor group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
   compileOnly group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
 
   testImplementation project(':domain-sample-data')
 
   testImplementation group: 'org.mockito', name: 'mockito-core', version: '5.11.0'
   testImplementation group: 'org.assertj', name: 'assertj-core', version: '3.25.3'
-  testImplementation group: 'javax.el', name: 'javax.el-api', version: '3.0.0'
-  testImplementation group: 'org.glassfish.web', name: 'javax.el', version: '2.2.6'
+  testImplementation group: 'jakarta.el', name: 'jakarta.el-api', version: '6.0.0'
+  testImplementation group: 'org.glassfish', name: 'jakarta.el', version: '4.0.2'
   testImplementation group: 'com.google.guava', name: 'guava', version: '32.0.1-jre'
   testImplementation group: 'org.mockito', name: 'mockito-junit-jupiter', version: '3.8.0'
   testImplementation group: 'org.junit.jupiter', name:'junit-jupiter-params', version:'5.10.1'
   testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: '5.10.1'
   testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-engine', version: '5.9.3'
   testImplementation group: 'org.junit.platform', name: 'junit-platform-commons', version: '1.10.2'
- 
+
 }
 
 test {

domain-model/src/main/java/uk/gov/hmcts/cmc/domain/constraints/AgeRangeConstraintValidator.java

@@ -1,9 +1,10 @@
 package uk.gov.hmcts.cmc.domain.constraints;
 
+import jakarta.validation.ConstraintValidator;
+import jakarta.validation.ConstraintValidatorContext;
+
 import java.time.LocalDate;
 import java.time.temporal.ChronoUnit;
-import javax.validation.ConstraintValidator;
-import javax.validation.ConstraintValidatorContext;
 
 public class AgeRangeConstraintValidator implements ConstraintValidator<AgeRangeValidator, LocalDate> {
 

domain-model/src/main/java/uk/gov/hmcts/cmc/domain/constraints/AgeRangeValidator.java

@@ -1,12 +1,13 @@
 package uk.gov.hmcts.cmc.domain.constraints;
 
+import jakarta.validation.Constraint;
+import jakarta.validation.Payload;
+
 import java.lang.annotation.Documented;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
-import javax.validation.Constraint;
-import javax.validation.Payload;
 
 @Documented
 @Constraint(validatedBy = AgeRangeConstraintValidator.class)

domain-model/src/main/java/uk/gov/hmcts/cmc/domain/constraints/BeanValidator.java

@@ -1,12 +1,12 @@
 package uk.gov.hmcts.cmc.domain.constraints;
 
+import jakarta.validation.ConstraintViolation;
+import jakarta.validation.Validation;
+import jakarta.validation.ValidatorFactory;
 import org.apache.commons.lang3.StringUtils;
 
 import java.util.Set;
 import java.util.stream.Collectors;
-import javax.validation.ConstraintViolation;
-import javax.validation.Validation;
-import javax.validation.ValidatorFactory;
 
 public class BeanValidator {
 

domain-model/src/main/java/uk/gov/hmcts/cmc/domain/constraints/ClaimantAmount.java

@@ -1,12 +1,13 @@
 package uk.gov.hmcts.cmc.domain.constraints;
 
+import jakarta.validation.Constraint;
+import jakarta.validation.Payload;
+
 import java.lang.annotation.Documented;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
-import javax.validation.Constraint;
-import javax.validation.Payload;
 
 @Documented
 @Constraint(validatedBy = ClaimantAmountConstraintValidator.class)

domain-model/src/main/java/uk/gov/hmcts/cmc/domain/constraints/ClaimantAmountConstraintValidator.java

@@ -1,10 +1,9 @@
 package uk.gov.hmcts.cmc.domain.constraints;
 
+import jakarta.validation.ConstraintValidator;
+import jakarta.validation.ConstraintValidatorContext;
 import uk.gov.hmcts.cmc.domain.models.AmountRow;
 
-import javax.validation.ConstraintValidator;
-import javax.validation.ConstraintValidatorContext;
-
 public class ClaimantAmountConstraintValidator implements ConstraintValidator<ClaimantAmount, AmountRow> {
 
     @Override