Deploy Release version v2026.07.23.01 to Prod

acceptance-tests/pom.xml

@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
 	<artifactId>acceptance-tests</artifactId>
 	<groupId>gov.cms.qpp.conversion</groupId>
-	<version>2026.06.25.01-RELEASE</version>
+	<version>2026.07.23.01-RELEASE</version>
 	<name>conversion-tests</name>
 	<packaging>jar</packaging>
 	<properties>

commandline/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>gov.cms.qpp.conversion</groupId>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
-		<version>2026.06.25.01-RELEASE</version>
+		<version>2026.07.23.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 
@@ -71,7 +71,6 @@
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-core</artifactId>
-			<version>2.21.4</version>
 		</dependency>
 
 		<dependency>

commons/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>gov.cms.qpp.conversion</groupId>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
-		<version>2026.06.25.01-RELEASE</version>
+		<version>2026.07.23.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

converter/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>gov.cms.qpp.conversion</groupId>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
-		<version>2026.06.25.01-RELEASE</version>
+		<version>2026.07.23.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

generate-race-cpcplus/pom.xml

@@ -6,7 +6,7 @@
 
 	<groupId>gov.cms.qpp.conversion</groupId>
 	<artifactId>generateRaceCpcPlus</artifactId>
-	<version>2026.06.25.01-RELEASE</version>
+	<version>2026.07.23.01-RELEASE</version>
 	<name>generate-race-cpcplus</name>
 	<packaging>jar</packaging>
 

generate/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
 		<groupId>gov.cms.qpp.conversion</groupId>
-		<version>2026.06.25.01-RELEASE</version>
+		<version>2026.07.23.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -60,7 +60,6 @@
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-core</artifactId>
-			<version>2.21.4</version>
 		</dependency>
 
 		<!-- runtime/plugin deps -->

pom.xml

@@ -6,18 +6,18 @@
 	<groupId>gov.cms.qpp.conversion</groupId>
 	<artifactId>qpp-conversion-tool-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>2026.06.25.01-RELEASE</version>
+	<version>2026.07.23.01-RELEASE</version>
 	<name>QPP Conversion Tool</name>
 
 	<properties>
 		<java.version>21</java.version>
 		<aws.version>1.12.797</aws.version>
-		<junit.version>5.11.4</junit.version>
-		<junit.platform.version>1.11.4</junit.platform.version>
-		<jjwt.version>0.10.7</jjwt.version>
-		<spring.framework.version>6.2.19</spring.framework.version>
-		<spring.security.version>6.5.11</spring.security.version>
-		<tomcat.embed.version>10.1.55</tomcat.embed.version>
+		<junit.version>6.0.1</junit.version>
+		<junit.platform.version>6.0.1</junit.platform.version>
+		<jjwt.version>0.12.6</jjwt.version>
+<spring.framework.version>7.0.8</spring.framework.version>
+	<spring.security.version>7.0.5</spring.security.version>
+	<tomcat.embed.version>11.0.23</tomcat.embed.version>
 
 		<requiredCodeCoverage>0.90</requiredCodeCoverage>
 		<verificationsPhase>verify</verificationsPhase>
@@ -252,13 +252,7 @@
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
 				<artifactId>jackson-databind</artifactId>
-				<version>2.21.4</version>
-			</dependency>
-
-			<dependency>
-				<groupId>com.fasterxml.jackson.dataformat</groupId>
-				<artifactId>jackson-dataformat-xml</artifactId>
-				<version>2.21.4</version>
+			<version>2.21.5</version>
 			</dependency>
 
 			<dependency>
@@ -472,43 +466,19 @@
 			<dependency>
 				<groupId>ch.qos.logback</groupId>
 				<artifactId>logback-classic</artifactId>
-				<version>1.5.25</version>
+				<version>1.5.36</version>
 			</dependency>
 
 			<dependency>
 				<groupId>ch.qos.logback</groupId>
 				<artifactId>logback-core</artifactId>
-				<version>1.5.25</version>
+				<version>1.5.36</version>
 			</dependency>
 
 			<dependency>
 				<groupId>org.springdoc</groupId>
-				<artifactId>springdoc-openapi-ui</artifactId>
-				<version>1.7.0</version>
-			</dependency>
-
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-jwt</artifactId>
-				<version>1.1.0.RELEASE</version>
-				<exclusions>
-					<exclusion>
-						<groupId>org.springframework.security</groupId>
-						<artifactId>spring-security-web</artifactId>
-					</exclusion>
-					<exclusion>
-						<groupId>org.bouncycastle</groupId>
-						<artifactId>bcprov-jdk15on</artifactId>
-					</exclusion>
-					<exclusion>
-						<groupId>org.bouncycastle</groupId>
-						<artifactId>bcprov-jdk15to18</artifactId>
-					</exclusion>
-					<exclusion>
-						<groupId>org.bouncycastle</groupId>
-						<artifactId>bcprov-jdk18on</artifactId>
-					</exclusion>
-				</exclusions>
+				<artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
+				<version>2.8.3</version>
 			</dependency>
 
 			<dependency>
@@ -586,20 +556,31 @@
 			<dependency>
 				<groupId>net.logstash.logback</groupId>
 				<artifactId>logstash-logback-encoder</artifactId>
-				<version>8.1</version>
-			</dependency>
-
-			<dependency>
-				<groupId>com.jcabi</groupId>
-				<artifactId>jcabi-manifests</artifactId>
-				<version>1.1</version>
-			</dependency>
-
-			<dependency>
-				<groupId>org.junit.jupiter</groupId>
-				<artifactId>junit-jupiter-api</artifactId>
-				<version>${junit.version}</version>
-			</dependency>
+				<version>9.0</version>
+			</dependency>
+
+		<!-- Override tools.jackson.core (Jackson 3.x) transitive deps from logstash to fix CVEs -->
+		<dependency>
+			<groupId>tools.jackson.core</groupId>
+			<artifactId>jackson-core</artifactId>
+			<version>3.1.4</version>
+		</dependency>
+		<dependency>
+			<groupId>tools.jackson.core</groupId>
+			<artifactId>jackson-databind</artifactId>
+			<version>3.1.5</version>
+		</dependency>
+		<dependency>
+			<groupId>tools.jackson.core</groupId>
+			<artifactId>jackson-annotations</artifactId>
+			<version>3.1.4</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-api</artifactId>
+			<version>${junit.version}</version>
+		</dependency>
 
 			<dependency>
 				<groupId>net.jodah</groupId>

qrda3-update-measures/pom.xml

@@ -4,7 +4,7 @@
 
 	<groupId>gov.cms.qpp.conversion</groupId>
 	<artifactId>qpp-update-measures</artifactId>
-	<version>2026.06.25.01-RELEASE</version>
+	<version>2026.07.23.01-RELEASE</version>
 	<name>qrda3-update-measures</name>
 	<packaging>jar</packaging>
 

rest-api/pom.xml

@@ -19,7 +19,7 @@
     <parent>
         <groupId>gov.cms.qpp.conversion</groupId>
         <artifactId>qpp-conversion-tool-parent</artifactId>
-        <version>2026.06.25.01-RELEASE</version>
+        <version>2026.07.23.01-RELEASE</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -35,17 +35,18 @@
         <spring-framework.version>${spring.framework.version}</spring-framework.version>
         <!-- tomcat.version is managed by spring-boot-dependencies BOM (3.5.13+) -->
         <tomcat.version>managed-by-boot-bom</tomcat.version>
-        <!-- Test stack kept explicit so CI is deterministic across JDK updates -->
-        <junit.jupiter.version>5.11.4</junit.jupiter.version>
-        <junit.platform.version>1.11.4</junit.platform.version>
+        <!-- JUnit 6 unified versioning: platform and jupiter share the same version number.
+             Boot 4.0.0 ships junit-jupiter 6.0.1 / junit-platform 6.0.1. -->
+        <junit.jupiter.version>6.0.1</junit.jupiter.version>
+        <junit.platform.version>6.0.1</junit.platform.version>
         <io.rest-assured.version>5.5.2</io.rest-assured.version>
         <groovy.version>4.0.28</groovy.version>
         <io.hamcrest.version>2.2</io.hamcrest.version>
         <mockito.version>3.9.0</mockito.version>
         <jakarta.servlet.version>6.1.0</jakarta.servlet.version>
 
         <!-- Spring Security aligned with Boot BOM to avoid split versions -->
-        <spring.security.version>6.5.11</spring.security.version>
+        <spring.security.version>7.0.5</spring.security.version>
         <spring.retry.version>2.0.13</spring.retry.version>
 
         <!-- JaCoCo aggregated report path used by Sonar -->
@@ -60,7 +61,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>3.5.15</version>
+                <version>4.0.6</version>
                 <executions>
                     <execution><goals><goal>repackage</goal></goals></execution>
                 </executions>
@@ -177,40 +178,28 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Framework BOM import: MUST be first to override Boot 4.0.6's Framework 7.0.7 with 7.0.8.
+                 Maven uses "first declaration wins" for BOM imports. -->
             <dependency>
-                <groupId>org.springframework.security</groupId>
-                <artifactId>spring-security-bom</artifactId>
-                <version>${spring.security.version}</version>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-framework-bom</artifactId>
+                <version>${spring-framework.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
 
             <dependency>
-                <groupId>org.springframework.boot</groupId>
-                <artifactId>spring-boot-dependencies</artifactId>
-                <version>3.5.15</version>
+                <groupId>org.springframework.security</groupId>
+                <artifactId>spring-security-bom</artifactId>
+                <version>${spring.security.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
 
-            <!-- These two lines are redundant when importing spring-framework-bom but kept for clarity.
-                 You can safely remove them later if desired. -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-webmvc</artifactId>
-                <version>${spring-framework.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-beans</artifactId>
-                <version>${spring-framework.version}</version>
-            </dependency>
-
-            <!-- Framework BOM import: lifts spring-* modules to the patched framework line. -->
             <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-framework-bom</artifactId>
-                <version>${spring-framework.version}</version>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-dependencies</artifactId>
+                <version>4.0.6</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -271,21 +260,7 @@
         <!-- API / Docs -->
         <dependency>
             <groupId>org.springdoc</groupId>
-            <artifactId>springdoc-openapi-ui</artifactId>
-        </dependency>
-
-        <!-- Pre-Jakarta plugin; exclude ALL old Spring 4.x bits it drags -->
-        <dependency>
-            <groupId>org.springframework.plugin</groupId>
-            <artifactId>spring-plugin-core</artifactId>
-            <version>1.2.0.RELEASE</version>
-            <exclusions>
-                <exclusion><groupId>org.springframework</groupId><artifactId>spring-beans</artifactId></exclusion>
-                <exclusion><groupId>org.springframework</groupId><artifactId>spring-core</artifactId></exclusion>
-                <exclusion><groupId>org.springframework</groupId><artifactId>spring-context</artifactId></exclusion>
-                <exclusion><groupId>org.springframework</groupId><artifactId>spring-aop</artifactId></exclusion>
-                <exclusion><groupId>org.springframework</groupId><artifactId>spring-expression</artifactId></exclusion>
-            </exclusions>
+            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
         </dependency>
 
         <!-- Logging -->
@@ -321,10 +296,12 @@
         <!-- Keep these direct to force the patched framework version during mediation. -->
         <dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>${spring-framework.version}</version></dependency>
         <dependency><groupId>org.springframework</groupId><artifactId>spring-expression</artifactId><version>${spring-framework.version}</version></dependency>
+        <dependency><groupId>org.springframework</groupId><artifactId>spring-context</artifactId><version>${spring-framework.version}</version></dependency>
+        <dependency><groupId>org.springframework</groupId><artifactId>spring-beans</artifactId><version>${spring-framework.version}</version></dependency>
 
         <!-- Misc -->
         <dependency><groupId>org.springframework.retry</groupId><artifactId>spring-retry</artifactId></dependency>
-        <dependency><groupId>com.jcabi</groupId><artifactId>jcabi-manifests</artifactId></dependency>
+        <dependency><groupId>com.jcabi</groupId><artifactId>jcabi-manifests</artifactId><version>1.1</version></dependency>
 
         <!-- AWS v1 clients (monitor for CVEs periodically) -->
         <dependency><groupId>com.amazonaws</groupId><artifactId>aws-java-sdk-core</artifactId></dependency>

rest-api/src/main/java/gov/cms/qpp/conversion/api/RestApiApplication.java

@@ -1,12 +1,7 @@
 package gov.cms.qpp.conversion.api;
 
-import org.apache.catalina.connector.Connector;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
-import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
-import org.springframework.context.annotation.Bean;
 
 /**
  * Application to be ran

rest-api/src/main/java/gov/cms/qpp/conversion/api/config/SecurityConfig.java

@@ -33,7 +33,7 @@ public class SecurityConfig {
 	protected String rtiOrgName;
 
     @Bean
-    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    public SecurityFilterChain filterChain(HttpSecurity http) {
         http.securityMatcher(PCF_WILDCARD)
             .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
             .csrf(csrf -> csrf.disable())