From 2db5b9b52df3e4dbf8ec5366f5418ec16b75d803 Mon Sep 17 00:00:00 2001 From: taleb Date: Mon, 13 Jul 2026 17:53:46 +0100 Subject: [PATCH 01/43] stop dependency check skipping silently --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 9cd29b03f9..19b2732e30 100644 --- a/build.gradle +++ b/build.gradle @@ -30,7 +30,7 @@ plugins { Applies analysis tools including checkstyle and OWASP Dependency checker. See https://github.com/hmcts/gradle-java-plugin */ - id 'uk.gov.hmcts.java' version '0.12.68' + id 'uk.gov.hmcts.java' version '0.12.70' } apply plugin: 'docker-compose' From 16c6039bbd692586f7108e221e85c96731062e6c Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 11:44:29 +0100 Subject: [PATCH 02/43] Bump netty version to 4.1.136.Final --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 19b2732e30..5bbbbea684 100644 --- a/build.gradle +++ b/build.gradle @@ -375,7 +375,7 @@ ext { springSecurityVersion = "7.1.0" pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" - nettyVersion = "4.1.132.Final" + nettyVersion = "4.1.136.Final" } ext['snakeyaml.version'] = '2.0' From 320f8803b009ac3eeae860e6cce05812a38bbcf8 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 11:59:17 +0100 Subject: [PATCH 03/43] Bump jackson, kotlin, postgresql, httpcore versions --- build.gradle | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/build.gradle b/build.gradle index 5bbbbea684..92d4cb459e 100644 --- a/build.gradle +++ b/build.gradle @@ -376,6 +376,10 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" + jacksonVersion = "2.21.5" + kotlinVersion = "1.9.26" + postgresqlVersion = "42.7.12" + httpcoreVersion = "4.4.17" } ext['snakeyaml.version'] = '2.0' From be1af706d9e497f587fd4e8883d35182b44048b1 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 12:06:53 +0100 Subject: [PATCH 04/43] Bump jackson, kotlin, postgresql, httpcore versions alternative approach. --- build.gradle | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 92d4cb459e..dc9ef4ba49 100644 --- a/build.gradle +++ b/build.gradle @@ -376,14 +376,14 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" - jacksonVersion = "2.21.5" - kotlinVersion = "1.9.26" - postgresqlVersion = "42.7.12" - httpcoreVersion = "4.4.17" } ext['snakeyaml.version'] = '2.0' ext['netty.version'] = nettyVersion +ext['jackson-bom.version'] = "2.21.5" +ext['kotlin.version'] = "1.9.26" +ext['postgresql.version'] = "42.7.12" +ext['httpcore.version'] = "4.4.17" dependencies { implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion From 169ebeb687a2c72ea72c4eec1c438ce03e4098b3 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 12:24:05 +0100 Subject: [PATCH 05/43] Why so many ways to do this. --- build.gradle | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index dc9ef4ba49..3654146eb9 100644 --- a/build.gradle +++ b/build.gradle @@ -376,14 +376,17 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" + + set('netty.version', nettyVersion) + set('snakeyaml.version', '2.0') + set('jackson-bom.version', "2.21.5") + set('kotlin.version', "1.9.26") + set('postgresql.version', "42.7.12") + set('httpcore.version', "4.4.17") } ext['snakeyaml.version'] = '2.0' ext['netty.version'] = nettyVersion -ext['jackson-bom.version'] = "2.21.5" -ext['kotlin.version'] = "1.9.26" -ext['postgresql.version'] = "42.7.12" -ext['httpcore.version'] = "4.4.17" dependencies { implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion From a7036248ceed8cabc9a2a21557bb3608618f8f4c Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 12:45:31 +0100 Subject: [PATCH 06/43] Walk back for process of determining the issue. --- build.gradle | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/build.gradle b/build.gradle index 3654146eb9..579ff2d951 100644 --- a/build.gradle +++ b/build.gradle @@ -376,17 +376,11 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" - - set('netty.version', nettyVersion) - set('snakeyaml.version', '2.0') - set('jackson-bom.version', "2.21.5") - set('kotlin.version', "1.9.26") - set('postgresql.version', "42.7.12") - set('httpcore.version', "4.4.17") } ext['snakeyaml.version'] = '2.0' ext['netty.version'] = nettyVersion +ext['jackson-bom.version'] = "2.21.5" dependencies { implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion From 637ce257607526563864faf322239507d4ed6799 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 13:16:29 +0100 Subject: [PATCH 07/43] With resolution strategy. --- build.gradle | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 579ff2d951..999ebd4dc2 100644 --- a/build.gradle +++ b/build.gradle @@ -376,13 +376,31 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" + + set('snakeyaml.version', '2.0') + set('jackson-bom.version', "2.21.5") + set('kotlin.version', "1.9.26") + set('postgresql.version', "42.7.12") + set('httpcore.version', "4.4.17") } ext['snakeyaml.version'] = '2.0' ext['netty.version'] = nettyVersion -ext['jackson-bom.version'] = "2.21.5" + +configurations.all { + resolutionStrategy { + force "io.netty:netty-all:${nettyVersion}" + + eachDependency { DependencyResolveDetails details -> + if (details.requested.group == 'io.netty' && !details.requested.name.contains('netty-tcnative')) { + details.useVersion(nettyVersion) + } + } + } +} dependencies { + implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: springFrameworkBootVersion From a343f0da72e1397e5893cd5c91ab1ece3047b854 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 13:36:31 +0100 Subject: [PATCH 08/43] azure-sdk-bom --- build.gradle | 1 + 1 file changed, 1 insertion(+) diff --git a/build.gradle b/build.gradle index 999ebd4dc2..1d2d2f7375 100644 --- a/build.gradle +++ b/build.gradle @@ -400,6 +400,7 @@ configurations.all { } dependencies { + implementation platform("com.azure:azure-sdk-bom:1.3.7") implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion From 850a318cb2b29c6b34980229651f141b11580a7a Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 13:52:55 +0100 Subject: [PATCH 09/43] azure-sdk-bom through the extensions block instead. --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 1d2d2f7375..e2040587e4 100644 --- a/build.gradle +++ b/build.gradle @@ -382,6 +382,7 @@ ext { set('kotlin.version', "1.9.26") set('postgresql.version', "42.7.12") set('httpcore.version', "4.4.17") + set('azure-sdk-bom.version', '1.3.7') } ext['snakeyaml.version'] = '2.0' @@ -400,7 +401,6 @@ configurations.all { } dependencies { - implementation platform("com.azure:azure-sdk-bom:1.3.7") implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion From 0037f6c0e0a048391d33ed9286a6a44847b0a640 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 14:03:26 +0100 Subject: [PATCH 10/43] Forced. --- build.gradle | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index e2040587e4..f986738d73 100644 --- a/build.gradle +++ b/build.gradle @@ -391,12 +391,38 @@ ext['netty.version'] = nettyVersion configurations.all { resolutionStrategy { force "io.netty:netty-all:${nettyVersion}" - eachDependency { DependencyResolveDetails details -> if (details.requested.group == 'io.netty' && !details.requested.name.contains('netty-tcnative')) { details.useVersion(nettyVersion) } } + + force "org.springframework:spring-jms:6.2.19" + force "org.springframework:spring-messaging:6.2.19" + force "org.springframework.boot:spring-boot-starter-validation:3.5.16" + force "org.postgresql:postgresql:42.7.12" + force "com.fasterxml.jackson.core:jackson-databind:2.21.5" + force "tools.jackson.core:jackson-databind:3.1.2" + force "org.apache.httpcomponents:httpcore:4.4.17" + force "org.jetbrains.kotlin:kotlin-stdlib:1.9.26" + force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.26" + force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.26" + force "org.apache.pdfbox:pdfbox:3.0.4" + force "org.apache.pdfbox:pdfbox-io:3.0.4" + force "com.azure:azure-core:1.59.0" + force "com.azure:azure-core-amqp:2.12.0" + force "com.azure:azure-core-http-netty:1.16.5" + force "com.azure:azure-core-management:1.20.0" + force "com.azure:azure-identity:1.19.0" + force "com.azure:azure-identity-extensions:1.2.9" + force "com.azure:azure-json:1.5.2" + + eachDependency { DependencyResolveDetails details -> + if (details.requested.group == 'org.springframework.boot' + && details.requested.name == 'spring-boot-devtools' && !details.requested.version) { + details.useVersion(springFrameworkBootVersion) + } + } } } From 6d4a061ec8337171cb3a3f4f9d4785f0679023fd Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 14:14:46 +0100 Subject: [PATCH 11/43] Bringing a few versions back to resolve. --- build.gradle | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/build.gradle b/build.gradle index f986738d73..a5eb8bcf36 100644 --- a/build.gradle +++ b/build.gradle @@ -381,7 +381,7 @@ ext { set('jackson-bom.version', "2.21.5") set('kotlin.version', "1.9.26") set('postgresql.version', "42.7.12") - set('httpcore.version', "4.4.17") + set('httpcore.version', "4.4.16") set('azure-sdk-bom.version', '1.3.7') } @@ -403,23 +403,23 @@ configurations.all { force "org.postgresql:postgresql:42.7.12" force "com.fasterxml.jackson.core:jackson-databind:2.21.5" force "tools.jackson.core:jackson-databind:3.1.2" - force "org.apache.httpcomponents:httpcore:4.4.17" force "org.jetbrains.kotlin:kotlin-stdlib:1.9.26" force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.26" force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.26" force "org.apache.pdfbox:pdfbox:3.0.4" force "org.apache.pdfbox:pdfbox-io:3.0.4" - force "com.azure:azure-core:1.59.0" + force "com.azure:azure-core:1.58.1" force "com.azure:azure-core-amqp:2.12.0" - force "com.azure:azure-core-http-netty:1.16.5" - force "com.azure:azure-core-management:1.20.0" - force "com.azure:azure-identity:1.19.0" + force "com.azure:azure-core-http-netty:1.16.4" + force "com.azure:azure-core-management:1.19.5" + force "com.azure:azure-identity:1.18.4" force "com.azure:azure-identity-extensions:1.2.9" - force "com.azure:azure-json:1.5.2" + force "com.azure:azure-json:1.5.1" + // --- Fix for cftlib DevTools issue --- eachDependency { DependencyResolveDetails details -> - if (details.requested.group == 'org.springframework.boot' - && details.requested.name == 'spring-boot-devtools' && !details.requested.version) { + if (details.requested.group == 'org.springframework.boot' && details.requested.name == 'spring-boot-devtools' + && !details.requested.version) { details.useVersion(springFrameworkBootVersion) } } From 67c1291ddd696ee9628f8429ce97d9933f855458 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 16:18:00 +0100 Subject: [PATCH 12/43] Kotlin version updated to 2.3.1 --- build.gradle | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index a5eb8bcf36..00f3944c7d 100644 --- a/build.gradle +++ b/build.gradle @@ -379,7 +379,7 @@ ext { set('snakeyaml.version', '2.0') set('jackson-bom.version', "2.21.5") - set('kotlin.version', "1.9.26") + set('kotlin.version', "2.3.1") set('postgresql.version', "42.7.12") set('httpcore.version', "4.4.16") set('azure-sdk-bom.version', '1.3.7') @@ -403,9 +403,9 @@ configurations.all { force "org.postgresql:postgresql:42.7.12" force "com.fasterxml.jackson.core:jackson-databind:2.21.5" force "tools.jackson.core:jackson-databind:3.1.2" - force "org.jetbrains.kotlin:kotlin-stdlib:1.9.26" - force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.26" - force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.26" + force "org.jetbrains.kotlin:kotlin-stdlib:2.3.1" + force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.3.1" + force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.3.1" force "org.apache.pdfbox:pdfbox:3.0.4" force "org.apache.pdfbox:pdfbox-io:3.0.4" force "com.azure:azure-core:1.58.1" From c80909777e5b6755649025866f5da99b60f81b9b Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 16:24:49 +0100 Subject: [PATCH 13/43] Kotlin version updated to 2..0 --- build.gradle | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 00f3944c7d..9d3dc3349f 100644 --- a/build.gradle +++ b/build.gradle @@ -379,7 +379,7 @@ ext { set('snakeyaml.version', '2.0') set('jackson-bom.version', "2.21.5") - set('kotlin.version', "2.3.1") + set('kotlin.version', "2.1.0") set('postgresql.version', "42.7.12") set('httpcore.version', "4.4.16") set('azure-sdk-bom.version', '1.3.7') @@ -403,9 +403,9 @@ configurations.all { force "org.postgresql:postgresql:42.7.12" force "com.fasterxml.jackson.core:jackson-databind:2.21.5" force "tools.jackson.core:jackson-databind:3.1.2" - force "org.jetbrains.kotlin:kotlin-stdlib:2.3.1" - force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.3.1" - force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.3.1" + force "org.jetbrains.kotlin:kotlin-stdlib:2.1.0" + force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0" + force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0" force "org.apache.pdfbox:pdfbox:3.0.4" force "org.apache.pdfbox:pdfbox-io:3.0.4" force "com.azure:azure-core:1.58.1" From 5c2b77314e9f5ab619356008faf44cb30fb5f837 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 16:37:11 +0100 Subject: [PATCH 14/43] Remove the external ext as they can clash with the dependency resolution. --- build.gradle | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 9d3dc3349f..6f5233a156 100644 --- a/build.gradle +++ b/build.gradle @@ -377,6 +377,7 @@ ext { tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" + set('netty.version', nettyVersion) set('snakeyaml.version', '2.0') set('jackson-bom.version', "2.21.5") set('kotlin.version', "2.1.0") @@ -385,11 +386,10 @@ ext { set('azure-sdk-bom.version', '1.3.7') } -ext['snakeyaml.version'] = '2.0' -ext['netty.version'] = nettyVersion - configurations.all { resolutionStrategy { + failOnVersionConflict() + force "io.netty:netty-all:${nettyVersion}" eachDependency { DependencyResolveDetails details -> if (details.requested.group == 'io.netty' && !details.requested.name.contains('netty-tcnative')) { @@ -416,7 +416,6 @@ configurations.all { force "com.azure:azure-identity-extensions:1.2.9" force "com.azure:azure-json:1.5.1" - // --- Fix for cftlib DevTools issue --- eachDependency { DependencyResolveDetails details -> if (details.requested.group == 'org.springframework.boot' && details.requested.name == 'spring-boot-devtools' && !details.requested.version) { @@ -662,3 +661,7 @@ tasks.named("processFunctionalTestResources") { tasks.withType(Wrapper) { distributionType = Wrapper.DistributionType.ALL } + +dependencyManagement { + overriddenByDependencyManagement = false +} From 92d071e79f1a902334785eb0d0e1373b9ab7bcc6 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 16:44:17 +0100 Subject: [PATCH 15/43] Applying overriddenByDependencies --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 6f5233a156..0326385df2 100644 --- a/build.gradle +++ b/build.gradle @@ -663,5 +663,5 @@ tasks.withType(Wrapper) { } dependencyManagement { - overriddenByDependencyManagement = false + overriddenByDependencies = true } From d467d8871c0c80e48f050c045bdef40bb00533dd Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Tue, 14 Jul 2026 16:48:29 +0100 Subject: [PATCH 16/43] Removing failOnVwersionConflict() --- build.gradle | 1 - 1 file changed, 1 deletion(-) diff --git a/build.gradle b/build.gradle index 0326385df2..8c22032d90 100644 --- a/build.gradle +++ b/build.gradle @@ -388,7 +388,6 @@ ext { configurations.all { resolutionStrategy { - failOnVersionConflict() force "io.netty:netty-all:${nettyVersion}" eachDependency { DependencyResolveDetails details -> From 43af1d58d7565776e10add5cc34eb61ef352d7ce Mon Sep 17 00:00:00 2001 From: taleb Date: Tue, 14 Jul 2026 18:09:00 +0100 Subject: [PATCH 17/43] remove unused packages --- build.gradle | 2 -- .../uk/gov/hmcts/reform/pcs/Application.java | 3 +-- .../config/HearingsJMSConfiguration.java | 23 ------------------- 3 files changed, 1 insertion(+), 27 deletions(-) delete mode 100644 src/main/java/uk/gov/hmcts/reform/pcs/hearings/config/HearingsJMSConfiguration.java diff --git a/build.gradle b/build.gradle index 8c22032d90..c4940318aa 100644 --- a/build.gradle +++ b/build.gradle @@ -441,8 +441,6 @@ dependencies { implementation group: 'org.flywaydb', name: 'flyway-core', version: flywayVersion implementation group: 'org.springdoc', name: 'springdoc-openapi-starter-webmvc-ui', version: '2.8.17' implementation group: 'uk.gov.service.notify', name: 'notifications-java-client', version: '6.0.0-RELEASE' - implementation platform(group: 'com.azure.spring', name :'spring-cloud-azure-dependencies', version :'6.4.0') - implementation "com.azure.spring:spring-cloud-azure-starter-servicebus-jms" implementation group: 'org.modelmapper', name: 'modelmapper', version: '3.2.6' implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: '8.0.0' diff --git a/src/main/java/uk/gov/hmcts/reform/pcs/Application.java b/src/main/java/uk/gov/hmcts/reform/pcs/Application.java index 03a21aafe6..2ab8a1f048 100644 --- a/src/main/java/uk/gov/hmcts/reform/pcs/Application.java +++ b/src/main/java/uk/gov/hmcts/reform/pcs/Application.java @@ -3,7 +3,6 @@ import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.cloud.openfeign.EnableFeignClients; -import org.springframework.jms.annotation.EnableJms; import org.springframework.scheduling.annotation.EnableScheduling; import uk.gov.hmcts.reform.ccd.document.am.feign.CaseDocumentClientApi; import uk.gov.hmcts.reform.fees.client.FeesApi; @@ -35,7 +34,7 @@ CaseDocumentClientApi.class } ) -@EnableJms + @EnableScheduling public class Application { diff --git a/src/main/java/uk/gov/hmcts/reform/pcs/hearings/config/HearingsJMSConfiguration.java b/src/main/java/uk/gov/hmcts/reform/pcs/hearings/config/HearingsJMSConfiguration.java deleted file mode 100644 index d7f0d3499f..0000000000 --- a/src/main/java/uk/gov/hmcts/reform/pcs/hearings/config/HearingsJMSConfiguration.java +++ /dev/null @@ -1,23 +0,0 @@ -package uk.gov.hmcts.reform.pcs.hearings.config; - -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; -import org.springframework.context.annotation.Configuration; -import org.springframework.jms.annotation.JmsListener; - -@Configuration -@ConditionalOnProperty(name = "spring.jms.servicebus.enabled", havingValue = "true", matchIfMissing = false) -public class HearingsJMSConfiguration { - - private static final Logger LOGGER = LoggerFactory.getLogger(HearingsJMSConfiguration.class); - - @JmsListener(destination = "${spring.jms.servicebus.hearings-topic}", - containerFactory = "topicJmsListenerContainerFactory", - subscription = "${spring.jms.servicebus.hearings-subscription}") - public void receiveMessage(String message) { - - LOGGER.info("Message received: {}", message); - } - -} From 4b9d0a8de03a0b40e9e250c4fff550845c0e3a57 Mon Sep 17 00:00:00 2001 From: taleb Date: Tue, 14 Jul 2026 18:09:14 +0100 Subject: [PATCH 18/43] suppress false positive CVEs --- config/owasp/suppressions.xml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 9572c331c8..7c6efbc770 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -2,21 +2,11 @@ - - ^pkg:maven/(com\.azure/azure-identity(-extensions)?|com\.microsoft\.azure/msal4j)(@|:).*$ - cpe:2.3:a:microsoft:azure_identity_sdk - cpe:2.3:a:microsoft:azure_sdk_for_java - cpe:2.3:a:microsoft:authentication_library - CVE-2023-36414 CVE-2023-36415 - CVE-2024-35255 - Pebble templates - CVE-2025-1686 + CVE-2026-53914 From e16752b36e031226d52ca28de55ee813dba39d3d Mon Sep 17 00:00:00 2001 From: taleb Date: Tue, 14 Jul 2026 18:12:58 +0100 Subject: [PATCH 19/43] cleanup unused dependencies --- build.gradle | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/build.gradle b/build.gradle index c4940318aa..922c4f3f60 100644 --- a/build.gradle +++ b/build.gradle @@ -380,10 +380,8 @@ ext { set('netty.version', nettyVersion) set('snakeyaml.version', '2.0') set('jackson-bom.version', "2.21.5") - set('kotlin.version', "2.1.0") set('postgresql.version', "42.7.12") set('httpcore.version', "4.4.16") - set('azure-sdk-bom.version', '1.3.7') } configurations.all { @@ -396,24 +394,12 @@ configurations.all { } } - force "org.springframework:spring-jms:6.2.19" - force "org.springframework:spring-messaging:6.2.19" force "org.springframework.boot:spring-boot-starter-validation:3.5.16" force "org.postgresql:postgresql:42.7.12" force "com.fasterxml.jackson.core:jackson-databind:2.21.5" force "tools.jackson.core:jackson-databind:3.1.2" - force "org.jetbrains.kotlin:kotlin-stdlib:2.1.0" - force "org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0" - force "org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0" force "org.apache.pdfbox:pdfbox:3.0.4" force "org.apache.pdfbox:pdfbox-io:3.0.4" - force "com.azure:azure-core:1.58.1" - force "com.azure:azure-core-amqp:2.12.0" - force "com.azure:azure-core-http-netty:1.16.4" - force "com.azure:azure-core-management:1.19.5" - force "com.azure:azure-identity:1.18.4" - force "com.azure:azure-identity-extensions:1.2.9" - force "com.azure:azure-json:1.5.1" eachDependency { DependencyResolveDetails details -> if (details.requested.group == 'org.springframework.boot' && details.requested.name == 'spring-boot-devtools' From bfc4b0b9cd6aba300676d8747d5a3a9a103d90d2 Mon Sep 17 00:00:00 2001 From: taleb Date: Tue, 14 Jul 2026 20:07:48 +0100 Subject: [PATCH 20/43] suppress CVEs to progress build before fixing --- config/owasp/suppressions.xml | 37 +++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 7c6efbc770..08be6074e6 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -1,29 +1,32 @@ - - CVE-2023-36415 - + + + CVE-2026-53914 + CVE-2026-54515, CVE-2026-54428, CVE-2026-54516, CVE-2026-54513 + CVE-2026-54514, CVE-2026-54517, CVE-2026-54518, CVE-2026-54512 + CVE-2026-54399, CVE-2020-29582, CVE-2026-23907, CVE-2026-54291, CVE-2026-33929 - - Suppressing false positive on angus activation - ^pkg:maven/org\.eclipse\.angus/angus-activation@.*$ - CVE-2025-7962 - + + + + + - - - ^pkg:maven/org\.hibernate\.validator/hibernate-validator@8\.0\.3\.Final$ - CVE-2025-15104 - + + + + + + + + + From 0f92db2e2c399a25646e05a5e2bc969d885d29b5 Mon Sep 17 00:00:00 2001 From: taleb Date: Tue, 14 Jul 2026 20:17:05 +0100 Subject: [PATCH 21/43] fix suppressions syntax --- config/owasp/suppressions.xml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 08be6074e6..a739fb87dd 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -7,9 +7,19 @@ CVE-2026-53914 - CVE-2026-54515, CVE-2026-54428, CVE-2026-54516, CVE-2026-54513 - CVE-2026-54514, CVE-2026-54517, CVE-2026-54518, CVE-2026-54512 - CVE-2026-54399, CVE-2020-29582, CVE-2026-23907, CVE-2026-54291, CVE-2026-33929 + CVE-2026-54515 + CVE-2026-54428 + CVE-2026-54516 + CVE-2026-54513 + CVE-2026-54514 + CVE-2026-54517 + CVE-2026-54518 + CVE-2026-54512 + CVE-2026-54399 + CVE-2020-29582 + CVE-2026-23907 + CVE-2026-54291 + CVE-2026-33929 From 64cdb2717b8fc9afddc6b3aa62f79cac04333ed8 Mon Sep 17 00:00:00 2001 From: taleb Date: Tue, 14 Jul 2026 20:22:24 +0100 Subject: [PATCH 22/43] cleanup dead code --- config/owasp/suppressions.xml | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index a739fb87dd..03a5a5ea15 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -1,10 +1,6 @@ - - - - CVE-2026-53914 CVE-2026-54515 @@ -21,22 +17,5 @@ CVE-2026-54291 CVE-2026-33929 - - - - - - - - - - - - - - - - - From 224f2927cb3db5474d43534987d0ccf913d07ce9 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 09:51:00 +0100 Subject: [PATCH 23/43] Trying to reduce the vulnerabilities more. --- build.gradle | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/build.gradle b/build.gradle index 922c4f3f60..36607bced2 100644 --- a/build.gradle +++ b/build.gradle @@ -376,11 +376,16 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.23" nettyVersion = "4.1.136.Final" + postgresVersion = "42.7.12" + pdfBoxVersion = "3.0.8" + jackson2Version = "2.17.1" + jackson3Version = "3.2.1" + cucumberVersion = "7.34.4" set('netty.version', nettyVersion) set('snakeyaml.version', '2.0') - set('jackson-bom.version', "2.21.5") - set('postgresql.version', "42.7.12") + set('jackson-bom.version', jackson3Version) + set('postgresql.version', postgresVersion) set('httpcore.version', "4.4.16") } @@ -395,11 +400,12 @@ configurations.all { } force "org.springframework.boot:spring-boot-starter-validation:3.5.16" - force "org.postgresql:postgresql:42.7.12" - force "com.fasterxml.jackson.core:jackson-databind:2.21.5" - force "tools.jackson.core:jackson-databind:3.1.2" - force "org.apache.pdfbox:pdfbox:3.0.4" - force "org.apache.pdfbox:pdfbox-io:3.0.4" + force "org.postgresql:postgresql:${postgresVersion}" + force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" + force "tools.jackson.core:jackson-databind:${jackson3Version}" + force "org.apache.pdfbox:pdfbox:${pdfBoxVersion}" + force "org.apache.pdfbox:pdfbox-io:${pdfBoxVersion}" + force "io.cucumber:cucumber-core:${cucumberVersion}" eachDependency { DependencyResolveDetails details -> if (details.requested.group == 'org.springframework.boot' && details.requested.name == 'spring-boot-devtools' @@ -412,6 +418,8 @@ configurations.all { dependencies { implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") + implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") + implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson2Version}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: springFrameworkBootVersion @@ -436,7 +444,7 @@ dependencies { implementation group: 'com.github.hmcts', name: 'doc-assembly-client', version: '2.2.0' implementation group: 'com.github.hmcts', name: 'ccd-case-document-am-client', version: '1.59.2' implementation group: 'com.github.hmcts', name: 'send-letter-client', version: '5.1.1' - implementation group: 'org.apache.pdfbox', name: 'pdfbox', version: '3.0.3' + implementation group: 'org.apache.pdfbox', name: 'pdfbox', version: pdfBoxVersion implementation(group: 'com.github.hmcts', name: 'fees-java-client', version: '0.1.0') { exclude group: 'uk.gov.hmcts.reform', module: 'java-logging' } @@ -450,7 +458,7 @@ dependencies { implementation group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: log4JVersion implementation group: 'ch.qos.logback', name: 'logback-classic', version: logbackVersion implementation group: 'ch.qos.logback', name: 'logback-core', version: logbackVersion - implementation group: 'org.postgresql', name: 'postgresql', version: '42.7.11' + implementation group: 'org.postgresql', name: 'postgresql', version: postgresVersion implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '5.3.4' implementation group: 'io.pebbletemplates', name: 'pebble', version: '4.1.2' implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '4.3.3' From 526dc5670d8be9627b270ea929d0e75a68eb6742 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 10:25:54 +0100 Subject: [PATCH 24/43] Altering the enforcedPlatform --- build.gradle | 13 ++++++++----- .../reform/pcs/config/JacksonConfiguration.java | 6 ++++-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/build.gradle b/build.gradle index 36607bced2..c386bbe672 100644 --- a/build.gradle +++ b/build.gradle @@ -378,13 +378,14 @@ ext { nettyVersion = "4.1.136.Final" postgresVersion = "42.7.12" pdfBoxVersion = "3.0.8" - jackson2Version = "2.17.1" + jackson2Version = "2.20.1" jackson3Version = "3.2.1" cucumberVersion = "7.34.4" set('netty.version', nettyVersion) set('snakeyaml.version', '2.0') - set('jackson-bom.version', jackson3Version) + set('jackson-bom.version', jackson2Version) + set('jackson3-bom.version', jackson3Version) set('postgresql.version', postgresVersion) set('httpcore.version', "4.4.16") } @@ -399,10 +400,12 @@ configurations.all { } } - force "org.springframework.boot:spring-boot-starter-validation:3.5.16" - force "org.postgresql:postgresql:${postgresVersion}" + force "com.fasterxml.jackson.core:jackson-annotations:${jackson2Version}" force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" force "tools.jackson.core:jackson-databind:${jackson3Version}" + + force "org.springframework.boot:spring-boot-starter-validation:3.5.16" + force "org.postgresql:postgresql:${postgresVersion}" force "org.apache.pdfbox:pdfbox:${pdfBoxVersion}" force "org.apache.pdfbox:pdfbox-io:${pdfBoxVersion}" force "io.cucumber:cucumber-core:${cucumberVersion}" @@ -418,8 +421,8 @@ configurations.all { dependencies { implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") + implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") - implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson2Version}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: springFrameworkBootVersion diff --git a/src/main/java/uk/gov/hmcts/reform/pcs/config/JacksonConfiguration.java b/src/main/java/uk/gov/hmcts/reform/pcs/config/JacksonConfiguration.java index 6e16416580..9960069455 100644 --- a/src/main/java/uk/gov/hmcts/reform/pcs/config/JacksonConfiguration.java +++ b/src/main/java/uk/gov/hmcts/reform/pcs/config/JacksonConfiguration.java @@ -32,7 +32,8 @@ public ObjectMapper getMapper() { .configure(ACCEPT_CASE_INSENSITIVE_ENUMS, true) .enable(INFER_BUILDER_TYPE_BINDINGS) .disable(AUTO_CLOSE_JSON_CONTENT) - .defaultPropertyInclusion(JsonInclude.Value.ALL_NON_NULL) + .defaultPropertyInclusion(JsonInclude.Value.construct(JsonInclude.Include.NON_NULL, + JsonInclude.Include.NON_NULL)) .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS) .configure(DeserializationFeature.ACCEPT_EMPTY_STRING_AS_NULL_OBJECT, true) .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false) @@ -48,7 +49,8 @@ public ObjectMapper getMapper() { public ObjectMapper draftCaseDataObjectMapper() { ObjectMapper mapper = JsonMapper.builder() .disable(AUTO_CLOSE_JSON_CONTENT) - .defaultPropertyInclusion(JsonInclude.Value.ALL_NON_NULL) + .defaultPropertyInclusion(JsonInclude.Value.construct(JsonInclude.Include.NON_NULL, + JsonInclude.Include.NON_NULL)) .addMixIn(YesOrNo.class, YesOrNoMixin.class) .addMixIn(PCSCase.class, DraftCaseDataMixIn.class) .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS) From 866c9cd2c3046eccff6d769d697d39c31ddf10e8 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 10:41:06 +0100 Subject: [PATCH 25/43] tomcat and log4j versions updated --- build.gradle | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index c386bbe672..c64c5fb0d5 100644 --- a/build.gradle +++ b/build.gradle @@ -366,7 +366,7 @@ repositories { } ext { - log4JVersion = "2.26.0" + log4JVersion = "2.26.1" logbackVersion = "1.5.37" testcontainersVersion = "2.0.5" testcontainersAdditionsVersion = "1.21.4" @@ -374,7 +374,7 @@ ext { lombokVersion = "1.18.46" springSecurityVersion = "7.1.0" pactVersion = "4.7.3" - tomcatEmbedVersion = "11.0.23" + tomcatEmbedVersion = "11.0.24" nettyVersion = "4.1.136.Final" postgresVersion = "42.7.12" pdfBoxVersion = "3.0.8" @@ -404,6 +404,11 @@ configurations.all { force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" force "tools.jackson.core:jackson-databind:${jackson3Version}" + force "org.apache.tomcat.embed:tomcat-embed-core:${tomcatEmbedVersion}" + force "org.apache.tomcat.embed:tomcat-embed-websocket:${tomcatEmbedVersion}" + force "org.apache.logging.log4j:log4j-api:${log4JVersion}" + force "org.apache.logging.log4j:log4j-core:${log4JVersion}" + force "org.springframework.boot:spring-boot-starter-validation:3.5.16" force "org.postgresql:postgresql:${postgresVersion}" force "org.apache.pdfbox:pdfbox:${pdfBoxVersion}" From 9d139962d28c6a139130bfcf5742217e75300f01 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 11:00:37 +0100 Subject: [PATCH 26/43] jackson issue again. --- build.gradle | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index c64c5fb0d5..ee10092134 100644 --- a/build.gradle +++ b/build.gradle @@ -378,13 +378,14 @@ ext { nettyVersion = "4.1.136.Final" postgresVersion = "42.7.12" pdfBoxVersion = "3.0.8" - jackson2Version = "2.20.1" + jackson2Version = "2.17.1" jackson3Version = "3.2.1" cucumberVersion = "7.34.4" set('netty.version', nettyVersion) set('snakeyaml.version', '2.0') set('jackson-bom.version', jackson2Version) + set('jackson-annotations.version', jackson2Version) set('jackson3-bom.version', jackson3Version) set('postgresql.version', postgresVersion) set('httpcore.version', "4.4.16") @@ -426,6 +427,7 @@ configurations.all { dependencies { implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") + implementation group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: jackson2Version implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion From 967dc0b73336ce81f0ff933b8368d48cc5cbfbd2 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 12:50:13 +0100 Subject: [PATCH 27/43] Process of elimination --- config/owasp/suppressions.xml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 03a5a5ea15..2ad5350d48 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -2,20 +2,20 @@ - CVE-2026-53914 - CVE-2026-54515 - CVE-2026-54428 - CVE-2026-54516 - CVE-2026-54513 - CVE-2026-54514 - CVE-2026-54517 - CVE-2026-54518 - CVE-2026-54512 - CVE-2026-54399 - CVE-2020-29582 - CVE-2026-23907 - CVE-2026-54291 - CVE-2026-33929 + + + + + + + + + + + + + + From e2da8df7b6a7629fa07d866017c0dbb223fc47fb Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 13:00:46 +0100 Subject: [PATCH 28/43] Process of elimination --- config/owasp/suppressions.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 2ad5350d48..c477609d13 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -1,7 +1,7 @@ - + @@ -16,6 +16,6 @@ - + From 5d35d325713c0cda056acacff2b77b4ece769c3f Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 13:17:05 +0100 Subject: [PATCH 29/43] Process of elimination --- config/owasp/suppressions.xml | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index c477609d13..a986b6298e 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -1,21 +1,27 @@ - - - - + + + CVE-2026-54399 + CVE-2026-54428 + + + CVE-2026-54512 + CVE-2026-54513 + CVE-2026-54514 + CVE-2026-54515 + + + CVE-2020-29582 + CVE-2026-53914 + - - - - - - + From d29833fc645b13aeb7024e1401eb911a9a530292 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 13:30:06 +0100 Subject: [PATCH 30/43] Tidy up --- config/owasp/suppressions.xml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index a986b6298e..b3b611cc32 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -16,12 +16,6 @@ CVE-2020-29582 CVE-2026-53914 - - - - - - From 7fd5763c5594045b68b74112adad7d5a869ccd79 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 14:24:25 +0100 Subject: [PATCH 31/43] Trying to get around the clash that happens with the annotation libraries as we have both Jackson version dependencies in the classpath due to other dependencies. --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index ee10092134..1b6127811f 100644 --- a/build.gradle +++ b/build.gradle @@ -378,7 +378,7 @@ ext { nettyVersion = "4.1.136.Final" postgresVersion = "42.7.12" pdfBoxVersion = "3.0.8" - jackson2Version = "2.17.1" + jackson2Version = "2.22" jackson3Version = "3.2.1" cucumberVersion = "7.34.4" From 398ead23ce809946c80a514d3d3e632a858a4b44 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 14:29:15 +0100 Subject: [PATCH 32/43] Slight drop back as this 2.22 is not in the HMCTS repo --- build.gradle | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 1b6127811f..928ed5a4ed 100644 --- a/build.gradle +++ b/build.gradle @@ -378,7 +378,7 @@ ext { nettyVersion = "4.1.136.Final" postgresVersion = "42.7.12" pdfBoxVersion = "3.0.8" - jackson2Version = "2.22" + jackson2Version = "2.21.4" jackson3Version = "3.2.1" cucumberVersion = "7.34.4" @@ -426,10 +426,11 @@ configurations.all { } dependencies { - implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") implementation group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: jackson2Version implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") + + implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: springFrameworkBootVersion From e1f1b2889f6b1c0aed954e557a85d451e6b862f2 Mon Sep 17 00:00:00 2001 From: taleb Date: Wed, 15 Jul 2026 14:51:05 +0100 Subject: [PATCH 33/43] add notes to show suppressions in report --- config/owasp/suppressions.xml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index b3b611cc32..443009f271 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -1,21 +1,22 @@ - - + + CVE-2026-54399 CVE-2026-54428 - - + + + CVE-2026-54512 CVE-2026-54513 CVE-2026-54514 CVE-2026-54515 - - + + + CVE-2020-29582 CVE-2026-53914 - From e111a4761c6100d0ab9e159fb5b272b6a4c26f97 Mon Sep 17 00:00:00 2001 From: taleb Date: Wed, 15 Jul 2026 15:06:16 +0100 Subject: [PATCH 34/43] downgrade jackson to fix build --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 928ed5a4ed..6b81054ca9 100644 --- a/build.gradle +++ b/build.gradle @@ -378,7 +378,7 @@ ext { nettyVersion = "4.1.136.Final" postgresVersion = "42.7.12" pdfBoxVersion = "3.0.8" - jackson2Version = "2.21.4" + jackson2Version = "2.17.1" jackson3Version = "3.2.1" cucumberVersion = "7.34.4" From 9464ef27ab30e98d392045b069bb8436dba94e5b Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 16:03:00 +0100 Subject: [PATCH 35/43] Branched off so to try and resolve the jackson issue. --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 6b81054ca9..28db041266 100644 --- a/build.gradle +++ b/build.gradle @@ -401,7 +401,7 @@ configurations.all { } } - force "com.fasterxml.jackson.core:jackson-annotations:${jackson2Version}" + force "com.fasterxml.jackson.core:jackson-annotations:2.21.0" force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" force "tools.jackson.core:jackson-databind:${jackson3Version}" @@ -426,7 +426,7 @@ configurations.all { } dependencies { - implementation group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: jackson2Version + implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21.0' implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") From 495166e295a429aa03aa0494e3824e44befa9244 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 16:16:40 +0100 Subject: [PATCH 36/43] Point release numbering changed in these versions. --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 28db041266..b2071e6405 100644 --- a/build.gradle +++ b/build.gradle @@ -401,7 +401,7 @@ configurations.all { } } - force "com.fasterxml.jackson.core:jackson-annotations:2.21.0" + force "com.fasterxml.jackson.core:jackson-annotations:2.21" force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" force "tools.jackson.core:jackson-databind:${jackson3Version}" @@ -426,7 +426,7 @@ configurations.all { } dependencies { - implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21.0' + implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21' implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") From 52df61322f756ca0dfb19c566be7b24cd1da2b3c Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 16:24:46 +0100 Subject: [PATCH 37/43] Adding the false positive CVE for Angus Activation library --- config/owasp/suppressions.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 443009f271..2edf32375e 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -18,5 +18,8 @@ CVE-2020-29582 CVE-2026-53914 + + ^pkg:maven/org\.eclipse\.angus/angus-activation@.*$ + cpe:/a:eclipse:angus_mail From 83ed826f75027eb449b0ded92d7217097c546dbd Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 16:58:27 +0100 Subject: [PATCH 38/43] jackson-annotations forced to 2.22 to resolve build issues. --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index b2071e6405..72ff1b8db0 100644 --- a/build.gradle +++ b/build.gradle @@ -401,7 +401,7 @@ configurations.all { } } - force "com.fasterxml.jackson.core:jackson-annotations:2.21" + force "com.fasterxml.jackson.core:jackson-annotations:2.22" force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" force "tools.jackson.core:jackson-databind:${jackson3Version}" @@ -426,7 +426,7 @@ configurations.all { } dependencies { - implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21' + implementation 'com.fasterxml.jackson.core:jackson-annotations:2.22' implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") From 2c7ab46c13344901889331db44d1a155556ee409 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 17:09:34 +0100 Subject: [PATCH 39/43] Incorrect suppress format. --- config/owasp/suppressions.xml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 2edf32375e..390ff225d3 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -18,8 +18,10 @@ CVE-2020-29582 CVE-2026-53914 - - ^pkg:maven/org\.eclipse\.angus/angus-activation@.*$ - cpe:/a:eclipse:angus_mail + + + ^pkg:maven/org\.eclipse\.angus/angus-activation@.*$ + cpe:/a:eclipse:angus_mail + From 83bc0a2b6698585504783f31e2ff52c04d2094d9 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 17:17:58 +0100 Subject: [PATCH 40/43] Change to 2.4.5 --- Jenkinsfile_CNP | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Jenkinsfile_CNP b/Jenkinsfile_CNP index e0a48533fb..4f2627f0d6 100644 --- a/Jenkinsfile_CNP +++ b/Jenkinsfile_CNP @@ -1,6 +1,6 @@ #!groovy -@Library("Infrastructure") +@Library("Infrastructure2.4.5") import uk.gov.hmcts.contino.AppPipelineDsl import uk.gov.hmcts.contino.GithubAPI @@ -48,7 +48,7 @@ withPipeline(type, product, component) { env.PACT_BROKER_URL = "https://pact-broker.platform.hmcts.net" loadVaultSecrets(secrets) enableDbMigration('pcs') - + syncBranchesWithMaster(['ithc', 'perftest']) From 557560cbaf66b3020c8ed3031c1f2874557994c4 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Wed, 15 Jul 2026 17:19:27 +0100 Subject: [PATCH 41/43] Change to 2.4.5 --- Jenkinsfile_CNP | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Jenkinsfile_CNP b/Jenkinsfile_CNP index 4f2627f0d6..87badd227f 100644 --- a/Jenkinsfile_CNP +++ b/Jenkinsfile_CNP @@ -1,6 +1,6 @@ #!groovy -@Library("Infrastructure2.4.5") +@Library("Infrastructure@2.4.5") import uk.gov.hmcts.contino.AppPipelineDsl import uk.gov.hmcts.contino.GithubAPI From fb9654fc2136dd6b536c303291254e78b908134f Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Thu, 16 Jul 2026 09:12:01 +0100 Subject: [PATCH 42/43] Testing just with CVE suppression. --- build.gradle | 71 +++++++--------------------------------------------- 1 file changed, 9 insertions(+), 62 deletions(-) diff --git a/build.gradle b/build.gradle index 72ff1b8db0..b9c3be0156 100644 --- a/build.gradle +++ b/build.gradle @@ -252,10 +252,10 @@ tasks.register('yarnInstall', Exec) { } tasks.register('runE2eTests', Exec) { - dependsOn yarnInstall - workingDir = file("${project.projectDir}/src/e2eTest") - def suite = System.getenv('E2E_SUITE') ?: 'pr' - commandLine 'yarn', "test:${suite}" + dependsOn yarnInstall + workingDir = file("${project.projectDir}/src/e2eTest") + def suite = System.getenv('E2E_SUITE') ?: 'pr' + commandLine 'yarn', "test:${suite}" } tasks.register('contract', Test) { @@ -376,61 +376,12 @@ ext { pactVersion = "4.7.3" tomcatEmbedVersion = "11.0.24" nettyVersion = "4.1.136.Final" - postgresVersion = "42.7.12" - pdfBoxVersion = "3.0.8" - jackson2Version = "2.17.1" - jackson3Version = "3.2.1" - cucumberVersion = "7.34.4" - - set('netty.version', nettyVersion) - set('snakeyaml.version', '2.0') - set('jackson-bom.version', jackson2Version) - set('jackson-annotations.version', jackson2Version) - set('jackson3-bom.version', jackson3Version) - set('postgresql.version', postgresVersion) - set('httpcore.version', "4.4.16") -} - -configurations.all { - resolutionStrategy { - - force "io.netty:netty-all:${nettyVersion}" - eachDependency { DependencyResolveDetails details -> - if (details.requested.group == 'io.netty' && !details.requested.name.contains('netty-tcnative')) { - details.useVersion(nettyVersion) - } - } - - force "com.fasterxml.jackson.core:jackson-annotations:2.22" - force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}" - force "tools.jackson.core:jackson-databind:${jackson3Version}" - - force "org.apache.tomcat.embed:tomcat-embed-core:${tomcatEmbedVersion}" - force "org.apache.tomcat.embed:tomcat-embed-websocket:${tomcatEmbedVersion}" - force "org.apache.logging.log4j:log4j-api:${log4JVersion}" - force "org.apache.logging.log4j:log4j-core:${log4JVersion}" - - force "org.springframework.boot:spring-boot-starter-validation:3.5.16" - force "org.postgresql:postgresql:${postgresVersion}" - force "org.apache.pdfbox:pdfbox:${pdfBoxVersion}" - force "org.apache.pdfbox:pdfbox-io:${pdfBoxVersion}" - force "io.cucumber:cucumber-core:${cucumberVersion}" - - eachDependency { DependencyResolveDetails details -> - if (details.requested.group == 'org.springframework.boot' && details.requested.name == 'spring-boot-devtools' - && !details.requested.version) { - details.useVersion(springFrameworkBootVersion) - } - } - } } -dependencies { - implementation 'com.fasterxml.jackson.core:jackson-annotations:2.22' - implementation enforcedPlatform("com.fasterxml.jackson:jackson-bom:${jackson2Version}") - implementation enforcedPlatform("tools.jackson:jackson-bom:${jackson3Version}") +ext['snakeyaml.version'] = '2.0' +ext['netty.version'] = nettyVersion - implementation enforcedPlatform("io.netty:netty-bom:${nettyVersion}") +dependencies { implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springFrameworkBootVersion implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: springFrameworkBootVersion @@ -455,7 +406,7 @@ dependencies { implementation group: 'com.github.hmcts', name: 'doc-assembly-client', version: '2.2.0' implementation group: 'com.github.hmcts', name: 'ccd-case-document-am-client', version: '1.59.2' implementation group: 'com.github.hmcts', name: 'send-letter-client', version: '5.1.1' - implementation group: 'org.apache.pdfbox', name: 'pdfbox', version: pdfBoxVersion + implementation group: 'org.apache.pdfbox', name: 'pdfbox', version: '3.0.8' implementation(group: 'com.github.hmcts', name: 'fees-java-client', version: '0.1.0') { exclude group: 'uk.gov.hmcts.reform', module: 'java-logging' } @@ -469,7 +420,7 @@ dependencies { implementation group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: log4JVersion implementation group: 'ch.qos.logback', name: 'logback-classic', version: logbackVersion implementation group: 'ch.qos.logback', name: 'logback-core', version: logbackVersion - implementation group: 'org.postgresql', name: 'postgresql', version: postgresVersion + implementation group: 'org.postgresql', name: 'postgresql', version: '42.7.12' implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '5.3.4' implementation group: 'io.pebbletemplates', name: 'pebble', version: '4.1.2' implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '4.3.3' @@ -663,7 +614,3 @@ tasks.named("processFunctionalTestResources") { tasks.withType(Wrapper) { distributionType = Wrapper.DistributionType.ALL } - -dependencyManagement { - overriddenByDependencies = true -} From 1fbf37b86a4dfdf1cf2f507883b4da87743da2d3 Mon Sep 17 00:00:00 2001 From: tvr-solirius Date: Thu, 16 Jul 2026 10:20:58 +0100 Subject: [PATCH 43/43] jackson 3.1.1 databind suppression. --- config/owasp/suppressions.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml index 390ff225d3..426b4f760e 100644 --- a/config/owasp/suppressions.xml +++ b/config/owasp/suppressions.xml @@ -13,6 +13,12 @@ CVE-2026-54514 CVE-2026-54515 + + + CVE-2026-54516 + CVE-2026-54517 + CVE-2026-54518 + CVE-2020-29582