fix: P4ADEV-3829 CVE fix (#28)

Author: antonioT90

Dockerfile

@@ -8,7 +8,7 @@ ARG IMAGE_VERSION="21-alpine-3.21"
 ARG IMAGE_SHA="cafcfad1d9d3b6e7dd983fa367f085ca1c846ce792da59bcb420ac4424296d56"
 ARG GRADLE_VERSION="8.10.2"
 ARG GRADLE_DOWNLOAD_SHA256="31c55713e40233a8303827ceb42ca48a47267a0ad4bab9177123121e71524c26"
-ARG APPINSIGHTS_VERSION="3.7.3"
+ARG APPINSIGHTS_VERSION="3.7.4"
 
 # 🌍 Timezone Configuration
 ARG TZ="Europe/Rome"

build.gradle.kts

@@ -3,10 +3,10 @@ plugins {
   id("org.springframework.boot") version "3.5.3"
   id("io.spring.dependency-management") version "1.1.7"
   jacoco
-  id("org.sonarqube") version "6.2.0.5505"
+  id("org.sonarqube") version "6.3.1.5724"
   id("com.github.ben-manes.versions") version "0.52.0"
-  id("org.openapi.generator") version "7.13.0"
-  id("com.gorylenko.gradle-git-properties") version "2.5.0"
+  id("org.openapi.generator") version "7.15.0"
+  id("com.gorylenko.gradle-git-properties") version "2.5.3"
 }
 
 group = "it.gov.pagopa.payhub"
@@ -29,9 +29,10 @@ repositories {
   mavenCentral()
 }
 
-val springDocOpenApiVersion = "2.8.9"
-val openApiToolsVersion = "0.2.6"
-val micrometerVersion = "1.5.1"
+val springDocOpenApiVersion = "2.8.13"
+val janinoVersion = "3.1.12"
+val openApiToolsVersion = "0.2.7"
+val micrometerVersion = "1.5.4"
 val httpClientVersion = "5.5"
 
 dependencies {
@@ -40,6 +41,7 @@ dependencies {
   implementation("org.springframework.boot:spring-boot-starter-validation")
   implementation("org.springframework.boot:spring-boot-starter-actuator")
   implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:$springDocOpenApiVersion")
+  implementation("org.codehaus.janino:janino:$janinoVersion")
   implementation("io.micrometer:micrometer-tracing-bridge-otel:$micrometerVersion")
   implementation("io.micrometer:micrometer-registry-prometheus")
   implementation("com.fasterxml.jackson.datatype:jackson-datatype-jsr310")

gradle.lockfile

@@ -19,7 +19,7 @@ io.micrometer:micrometer-core:1.15.1=compileClasspath
 io.micrometer:micrometer-jakarta9:1.15.1=compileClasspath
 io.micrometer:micrometer-observation:1.15.1=compileClasspath
 io.micrometer:micrometer-registry-prometheus:1.15.1=compileClasspath
-io.micrometer:micrometer-tracing-bridge-otel:1.5.1=compileClasspath
+io.micrometer:micrometer-tracing-bridge-otel:1.5.4=compileClasspath
 io.micrometer:micrometer-tracing:1.5.1=compileClasspath
 io.opentelemetry.semconv:opentelemetry-semconv:1.32.0=compileClasspath
 io.opentelemetry:opentelemetry-api:1.49.0=compileClasspath
@@ -34,9 +34,9 @@ io.prometheus:prometheus-metrics-config:1.3.8=compileClasspath
 io.prometheus:prometheus-metrics-core:1.3.8=compileClasspath
 io.prometheus:prometheus-metrics-model:1.3.8=compileClasspath
 io.prometheus:prometheus-metrics-tracer-common:1.3.8=compileClasspath
-io.swagger.core.v3:swagger-annotations-jakarta:2.2.30=compileClasspath
-io.swagger.core.v3:swagger-core-jakarta:2.2.30=compileClasspath
-io.swagger.core.v3:swagger-models-jakarta:2.2.30=compileClasspath
+io.swagger.core.v3:swagger-annotations-jakarta:2.2.36=compileClasspath
+io.swagger.core.v3:swagger-core-jakarta:2.2.36=compileClasspath
+io.swagger.core.v3:swagger-models-jakarta:2.2.36=compileClasspath
 jakarta.activation:jakarta.activation-api:2.1.3=compileClasspath
 jakarta.annotation:jakarta.annotation-api:2.1.1=compileClasspath
 jakarta.validation:jakarta.validation-api:3.0.2=compileClasspath
@@ -50,16 +50,18 @@ org.apache.logging.log4j:log4j-to-slf4j:2.24.3=compileClasspath
 org.apache.tomcat.embed:tomcat-embed-core:10.1.42=compileClasspath
 org.apache.tomcat.embed:tomcat-embed-el:10.1.42=compileClasspath
 org.apache.tomcat.embed:tomcat-embed-websocket:10.1.42=compileClasspath
+org.codehaus.janino:commons-compiler:3.1.12=compileClasspath
+org.codehaus.janino:janino:3.1.12=compileClasspath
 org.hibernate.validator:hibernate-validator:8.0.2.Final=compileClasspath
 org.jboss.logging:jboss-logging:3.6.1.Final=compileClasspath
 org.jspecify:jspecify:1.0.0=compileClasspath
-org.openapitools:jackson-databind-nullable:0.2.6=compileClasspath
+org.openapitools:jackson-databind-nullable:0.2.7=compileClasspath
 org.projectlombok:lombok:1.18.38=compileClasspath
 org.slf4j:jul-to-slf4j:2.0.17=compileClasspath
 org.slf4j:slf4j-api:2.0.17=compileClasspath
-org.springdoc:springdoc-openapi-starter-common:2.8.9=compileClasspath
-org.springdoc:springdoc-openapi-starter-webmvc-api:2.8.9=compileClasspath
-org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.9=compileClasspath
+org.springdoc:springdoc-openapi-starter-common:2.8.13=compileClasspath
+org.springdoc:springdoc-openapi-starter-webmvc-api:2.8.13=compileClasspath
+org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.13=compileClasspath
 org.springframework.boot:spring-boot-actuator-autoconfigure:3.5.3=compileClasspath
 org.springframework.boot:spring-boot-actuator:3.5.3=compileClasspath
 org.springframework.boot:spring-boot-autoconfigure:3.5.3=compileClasspath
@@ -79,7 +81,7 @@ org.springframework:spring-expression:6.2.8=compileClasspath
 org.springframework:spring-jcl:6.2.8=compileClasspath
 org.springframework:spring-web:6.2.8=compileClasspath
 org.springframework:spring-webmvc:6.2.8=compileClasspath
-org.webjars:swagger-ui:5.21.0=compileClasspath
+org.webjars:swagger-ui:5.28.1=compileClasspath
 org.webjars:webjars-locator-lite:1.1.0=compileClasspath
 org.yaml:snakeyaml:2.4=compileClasspath
 empty=