ARCPOC-1559

build.gradle

@@ -242,7 +242,7 @@ tasks.register('bootRunLocalDev', BootRun) {
 
   def activeProfiles = providers.gradleProperty('springProfiles')
     .orElse(providers.systemProperty('spring.profiles.active'))
-    .orElse('nosecurity')
+    .orElse('nosecurity,p6spy')
 
   systemProperty 'spring.profiles.active', activeProfiles.get()
   systemProperty 'logging.level.root', 'INFO'
@@ -454,9 +454,9 @@ dependencies {
 
   // Future Jackson 2 overrides for CVE-2026-54515.
   // Leave commented until the FasterXML 2.x fixes are actually published to Maven Central.
-  // implementation 'com.fasterxml.jackson.core:jackson-core:2.21.5'
-  // implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.5'
-  // implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21.5'
+  implementation 'com.fasterxml.jackson.core:jackson-core:2.21.5'
+  implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.5'
+  implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21.5'
 
   implementation 'org.flywaydb:flyway-database-postgresql:12.11.0'
 

config/owasp/suppressions.xml

@@ -8,23 +8,13 @@
     <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
     <cve>CVE-2023-35116</cve>
   </suppress>
+
   <suppress>
     <notes>We do not expose a SMTP interface
     </notes>
     <cve>CVE-2025-7962</cve>
   </suppress>
 
-  <suppress>
-    <notes>
-      Temporary suppression: CVE-2026-54515 affects Jackson 2.21.4, but the advisory's fixed
-      FasterXML 2.x versions were not published to Maven Central when investigated on 2026-07-01.
-      Review when a published Jackson 2.x fix is available to replace this suppression with a real
-      upgrade.
-    </notes>
-    <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@2\.21\.4$</packageUrl>
-    <cve>CVE-2026-54515</cve>
-  </suppress>
-
   <!-- We do not use the nu html checker library -->
   <suppress>
     <notes>

openapi.yaml

@@ -3473,6 +3473,100 @@ paths:
       tags:
       - application-list-entry-results
   /application-lists/entries/results:
+    delete:
+      description: |
+        Atomically deletes the specified Application List Entry Results. Each item is validated using the same rules as the single delete endpoint. If any item cannot be deleted, no Results are removed.
+      operationId: bulkDeleteResultEntries
+      requestBody:
+        content:
+          application/vnd.hmcts.appreg.v1+json:
+            schema:
+              $ref: "#/components/schemas/bulk-delete-results-dto"
+        required: true
+      responses:
+        "204":
+          description: Results deleted for all supplied items.
+          headers:
+            Vary:
+              description: Response varies by Accept for media-type versioning.
+              schema:
+                example: Accept
+                type: string
+        "400":
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/problem"
+          description: Invalid request parameters.
+        "401":
+          content:
+            application/problem+json:
+              examples:
+                unauthenticated:
+                  value:
+                    type: https://errors.hmcts.net/common/unauthorized
+                    title: Unauthorized
+                    status: 401
+                    detail: Missing or invalid credentials
+              schema:
+                $ref: "#/components/schemas/problem"
+          description: Authentication required or token invalid.
+        "403":
+          content:
+            application/problem+json:
+              examples:
+                forbidden:
+                  value:
+                    type: https://errors.hmcts.net/common/forbidden
+                    title: Forbidden
+                    status: 403
+                    detail: You do not have permission to access this resource
+              schema:
+                $ref: "#/components/schemas/problem"
+          description: Authenticated but not permitted to perform this action.
+        "404":
+          content:
+            application/problem+json:
+              examples:
+                missing:
+                  value:
+                    type: https://errors.hmcts.net/appreg/not-found
+                    title: Not Found
+                    status: 404
+                    detail: Result code with id=123 was not found
+              schema:
+                $ref: "#/components/schemas/problem"
+          description: The requested resource was not found.
+        "409":
+          content:
+            application/problem+json:
+              examples:
+                generic:
+                  value:
+                    type: https://errors.hmcts.net/common/conflict
+                    title: Conflict
+                    status: 409
+                    detail: The Application List could not be modified due to a conflict
+                      with its current state
+              schema:
+                $ref: "#/components/schemas/problem"
+          description: Conflict with the current state of the resource.
+        "500":
+          content:
+            application/problem+json:
+              examples:
+                generic:
+                  value:
+                    type: https://errors.hmcts.net/common/internal-error
+                    title: Internal Server Error
+                    status: 500
+                    detail: An unexpected error occurred
+              schema:
+                $ref: "#/components/schemas/problem"
+          description: Unexpected server error.
+      summary: Delete multiple Application List Entry Results.
+      tags:
+      - application-list-entry-results
     post:
       description: |
         Atomically creates a **separate Result** for each specified entry in the **source** list (path `listId`), using the same Result payload for all entries. If any entry cannot be resulted, **no Results are created**.
@@ -6156,6 +6250,7 @@ components:
         feeReference:
           description: A short reference code that identifies a Fee.
           example: CO5.2
+          maxLength: 12
           nullable: true
           type: string
         feeAmount:
@@ -6167,6 +6262,7 @@ components:
         offsiteFeeReference:
           description: A short reference code that identifies a offsite Fee.
           example: CO1.1
+          maxLength: 12
           nullable: true
           type: string
         offsiteFeeAmount:
@@ -6305,6 +6401,7 @@ components:
         feeReference:
           description: A short reference code that identifies a Fee.
           example: CO5.2
+          maxLength: 12
           nullable: true
           type: string
         feeAmount:
@@ -6317,6 +6414,7 @@ components:
         offsiteFeeReference:
           description: A short reference code that identifies a offsite Fee.
           example: CO5.2
+          maxLength: 12
           nullable: true
           type: string
         offsiteFeeAmount:
@@ -7384,6 +7482,20 @@ components:
       - id
       - resultCode
       type: object
+    bulk-delete-results-dto:
+      additionalProperties: false
+      description: Delete multiple Application List Entry Results atomically.
+      properties:
+        results:
+          description: |
+            Result delete requests to execute. Each item is validated using the same rules as the single-result delete endpoint. If any item is invalid, no results are deleted.
+          items:
+            $ref: "#/components/schemas/bulk-delete-result-item-dto"
+          minItems: 1
+          type: array
+      required:
+      - results
+      type: object
     result-page:
       allOf:
       - $ref: "#/components/schemas/page"
@@ -8234,7 +8346,7 @@ components:
         paymentReference:
           description: Optional reference used to identify the payment.
           example: PAY-001
-          maxLength: 100
+          maxLength: 15
           minLength: 1
           type: string
       required:
@@ -8264,6 +8376,29 @@ components:
       - COMPLETED
       example: RECEIVED
       type: string
+    bulk-delete-result-item-dto:
+      additionalProperties: false
+      properties:
+        listId:
+          description: Public identifier of the Application List.
+          example: 123e4567-e89b-12d3-a456-426655440000
+          format: uuid
+          type: string
+        entryId:
+          description: Public identifier of the Application List Entry.
+          example: 123e4567-e89b-12d3-a456-426655440100
+          format: uuid
+          type: string
+        resultId:
+          description: Public identifier of the Application List Entry Result.
+          example: 123e4567-e89b-12d3-a456-426655440200
+          format: uuid
+          type: string
+      required:
+      - entryId
+      - listId
+      - resultId
+      type: object
     court-location-get-summary-dto:
       description: "Lightweight DTO for Court Locations, used in list/search views."
       properties:

src/integrationTest/java/uk/gov/hmcts/appregister/controller/applicationentry/ApplicationEntryControllerBulkFeesTest.java

@@ -515,20 +515,20 @@ private void assertSuccessfulBulkUpdateAudited() {
         differenceLogAsserter.assertNoErrors();
         differenceLogAsserter.assertDataAuditChange(
                 DataAuditLogAsserter.getDataAuditAssertion(
-                        TableNames.APPLICATION_LISTS_FEE_STATUS,
-                        "alefs_fee_status",
-                        null,
-                        "REMITTED",
-                        AppListEntryAuditOperation.CREATE_FEE_STATUS_ENTRY.getType().name(),
-                        AppListEntryAuditOperation.CREATE_FEE_STATUS_ENTRY.getEventName()));
+                        TableNames.APPLICATION_LISTS_ENTRY,
+                        "bulk_fees_fee_details",
+                        "",
+                        "",
+                        AppListEntryAuditOperation.BULK_UPDATE_FEES.getType().name(),
+                        AppListEntryAuditOperation.BULK_UPDATE_FEES.getEventName()));
         differenceLogAsserter.assertDataAuditChange(
                 DataAuditLogAsserter.getDataAuditAssertion(
-                        TableNames.APPLCATION_LISTS_ENTRY_FEE_ID,
-                        "fee_fee_id",
-                        null,
+                        TableNames.APPLICATION_LISTS_ENTRY,
+                        "bulk_fees_offsite_entry_ids",
+                        "",
                         "",
-                        AppListEntryAuditOperation.CREATE_FEE_ENTRY.getType().name(),
-                        AppListEntryAuditOperation.CREATE_FEE_ENTRY.getEventName()));
+                        AppListEntryAuditOperation.BULK_UPDATE_FEES.getType().name(),
+                        AppListEntryAuditOperation.BULK_UPDATE_FEES.getEventName()));
     }
 
     private void assertNoBulkFeeAuditWritten() {