Floor vulnerable transitive dependencies (Dependabot alerts)

[wolpert]

Problem

The Security tab shows 17 open Dependabot alerts, all against transitive dependencies (they cite settings.gradle.kts, nothing we declare directly):

Package	Arrives via	Was	Patched floor	Severity
io.netty:* (handler, resolver-dns, …)	Lettuce (redis)	4.2.13.Final	4.2.15.Final	high ×5
jackson-databind (2.x)	Dropwizard	2.21.4	2.21.5	medium
logback-core	Dropwizard	1.5.33	1.5.34 (→1.5.38)	low
commons-compress	Testcontainers (test)	1.24.0	1.26.0	medium
rhino	swagger-parser (test)	1.7.7.2	1.7.14.1	low

A few alerts (commons-lang3 3.20.0, jackson-core 2.x) were already above their patched version and just needed a re-scan.

Fix — floors, not pins

Version-catalog-driven Gradle dependency constraints in velocity.java-conventions (inherited by every module):

• BOM platforms (platform(netty-bom), platform(jackson2-bom)) keep each ~9–12-artifact family version-aligned — you can't run netty-handler 4.2.15 next to netty-buffer 4.2.13.
• A constraints { } block floors the standalone libs.
• Uses platform(...) / plain require semantics — not enforcedPlatform / strictly — so a higher version reached by any other path still wins. Future upgrades are never blocked. Proven live: commons-lang3 floors at 3.18.0 but resolution still selects the higher transitive 3.20.0.
• All versions live in libs.versions.toml, so the existing weekly Dependabot gradle job bumps these floors forward automatically.

Verification

• ./gradlew clean build test green, incl. jacocoTestCoverageVerification (re-run fresh with --rerun-tasks, no skipped gates).
• dependencyInsight confirms every flagged artifact resolves at/above its patched release.
• No source or velocity-spi / velocity-api contract changes — NFR-17 (frozen SPI, additive-only) unaffected.
• Independently reviewed by the change-validator sub-agent → APPROVE.

Once merged, the transitive graph GitHub resolves will meet the floors and the alerts close on the next scan.

🤖 Generated with Claude Code