chore(deps): bump the gradle group across 1 directory with 12 updates

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,31 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Operating System (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Volttron Version [develop, releases/8.2, main]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/auto-assign-project.yml

@@ -0,0 +1,22 @@
+name: Add bugs to bugs project
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v0.3.0
+        with:
+          # You can target a repository in a different organization
+          # to the issue
+          project-url: https://github.com/orgs/GRIDAPPSD/projects/7
+          # project-url: https://github.com/orgs/<orgName>/projects/<projectNumber>
+          # github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
+          github-token: ${{ secrets.AUTO_ASSIGN_PAT }}
+          # labeled: bug, needs-triage
+          # label-operator: OR

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in GOSS-GridAPPS-D,
+please report it privately through GitHub's private vulnerability reporting.
+
+Go to the **Security** tab of this repository and click **Report a vulnerability**.
+This opens a private advisory visible only to the maintainers, so details are
+not disclosed publicly before a fix is available.
+
+Please include enough information to reproduce the issue: affected version or
+commit, a description of the impact, and steps to trigger the behavior.
+
+## Response Expectations
+
+GOSS-GridAPPS-D is a research platform maintained on a best-effort basis.
+We do not offer a formal service level agreement or a guaranteed response
+window, and we do not maintain a fixed supported-version matrix. Maintainers
+will acknowledge and triage reports as capacity allows, and will coordinate
+disclosure of any confirmed issue with the reporter.
+
+## Scope
+
+Reports about this repository's source code and its published artifacts are in
+scope. For issues in a dependency, please report them to that project directly;
+we will address the dependency update here once an upstream fix is available.

build.gradle

@@ -292,20 +292,20 @@ task collectBundles(type: Copy) {
             'org.apache.felix:org.apache.felix.metatype:1.2.4',
 
             // Jetty 11.x WebSocket support (required by ActiveMQ 6.2.0 for ws:// transport)
-            'org.eclipse.jetty.websocket:websocket-jetty-server:11.0.24',
-            'org.eclipse.jetty.websocket:websocket-jetty-api:11.0.24',
-            'org.eclipse.jetty.websocket:websocket-jetty-common:11.0.24',
-            'org.eclipse.jetty.websocket:websocket-core-server:11.0.24',
-            'org.eclipse.jetty.websocket:websocket-core-common:11.0.24',
-            'org.eclipse.jetty.websocket:websocket-servlet:11.0.24',
-            'org.eclipse.jetty:jetty-servlet:11.0.24',
-            'org.eclipse.jetty:jetty-server:11.0.24',
-            'org.eclipse.jetty:jetty-http:11.0.24',
-            'org.eclipse.jetty:jetty-io:11.0.24',
-            'org.eclipse.jetty:jetty-util:11.0.24',
-            'org.eclipse.jetty:jetty-security:11.0.24',
-            'org.eclipse.jetty:jetty-webapp:11.0.24',
-            'org.eclipse.jetty:jetty-xml:11.0.24',
+            'org.eclipse.jetty.websocket:websocket-jetty-server:12.0.33',
+            'org.eclipse.jetty.websocket:websocket-jetty-api:12.0.33',
+            'org.eclipse.jetty.websocket:websocket-jetty-common:12.0.33',
+            'org.eclipse.jetty.websocket:websocket-core-server:12.0.33',
+            'org.eclipse.jetty.websocket:websocket-core-common:12.0.33',
+            'org.eclipse.jetty.websocket:websocket-servlet:12.0.33',
+            'org.eclipse.jetty:jetty-servlet:12.0.33',
+            'org.eclipse.jetty:jetty-server:12.0.33',
+            'org.eclipse.jetty:jetty-http:12.0.33',
+            'org.eclipse.jetty:jetty-io:12.0.33',
+            'org.eclipse.jetty:jetty-util:12.0.33',
+            'org.eclipse.jetty:jetty-security:12.0.33',
+            'org.eclipse.jetty:jetty-webapp:12.0.33',
+            'org.eclipse.jetty:jetty-xml:12.0.33',
 
             // Pax Logging (OSGi-native logging framework)
             // Provides SLF4J 2.x API + Log4j2 backend with properties-based configuration
@@ -323,9 +323,9 @@ task collectBundles(type: Copy) {
             'org.ow2.asm:asm-util:9.7',
 
             // Jackson (GridAPPS-D requires 2.18.1+ per bnd.bnd)
-            'com.fasterxml.jackson.core:jackson-core:2.18.1',
-            'com.fasterxml.jackson.core:jackson-databind:2.18.1',
-            'com.fasterxml.jackson.core:jackson-annotations:2.18.1',
+            'com.fasterxml.jackson.core:jackson-core:2.18.6',
+            'com.fasterxml.jackson.core:jackson-databind:2.18.6',
+            'com.fasterxml.jackson.core:jackson-annotations:2.18.6',
 
             // GSON (GOSS uses 2.11.0 per bnd.bnd)
             'com.google.code.gson:gson:2.11.0',
@@ -340,16 +340,16 @@ task collectBundles(type: Copy) {
             'org.fusesource.stompjms:stompjms-client:1.19',
 
             // Shiro 2.0.0 (required by ActiveMQ 6.2.0 and GOSS for Jakarta EE support)
-            'org.apache.shiro:shiro-core:2.0.0',
-            'org.apache.shiro:shiro-lang:2.0.0',
-            'org.apache.shiro:shiro-web:2.0.0',
-            'org.apache.shiro:shiro-cache:2.0.0',
-            'org.apache.shiro:shiro-event:2.0.0',
-            'org.apache.shiro:shiro-crypto-core:2.0.0',
-            'org.apache.shiro:shiro-crypto-hash:2.0.0',
-            'org.apache.shiro:shiro-crypto-cipher:2.0.0',
-            'org.apache.shiro:shiro-config-core:2.0.0',
-            'org.apache.shiro:shiro-config-ogdl:2.0.0',
+            'org.apache.shiro:shiro-core:2.2.1',
+            'org.apache.shiro:shiro-lang:2.2.1',
+            'org.apache.shiro:shiro-web:2.2.1',
+            'org.apache.shiro:shiro-cache:2.2.1',
+            'org.apache.shiro:shiro-event:2.2.1',
+            'org.apache.shiro:shiro-crypto-core:2.2.1',
+            'org.apache.shiro:shiro-crypto-hash:2.2.1',
+            'org.apache.shiro:shiro-crypto-cipher:2.2.1',
+            'org.apache.shiro:shiro-config-core:2.2.1',
+            'org.apache.shiro:shiro-config-ogdl:2.2.1',
 
             // Commons BeanUtils (required by Shiro config-ogdl)
             'commons-beanutils:commons-beanutils:1.9.4',
@@ -365,9 +365,9 @@ task collectBundles(type: Copy) {
             'org.apache.httpcomponents:httpcore-osgi:4.4.16',
 
             // Commons libraries (GOSS versions per bnd.bnd)
-            'commons-io:commons-io:2.16.1',
+            'commons-io:commons-io:2.14.0',
             'commons-lang:commons-lang:2.6',
-            'org.apache.commons:commons-lang3:3.17.0',
+            'org.apache.commons:commons-lang3:3.18.0',
             'commons-pool:commons-pool:1.6',
             'org.apache.commons:commons-pool2:2.12.0',
             'commons-dbcp:commons-dbcp:1.4',

gridappsd-jena/build.gradle

@@ -24,20 +24,20 @@ dependencies {
 
     // Jena transitive dependencies
     embed 'org.apache.commons:commons-csv:1.5'  // Jena 3.7.0 uses 1.5
-    embed 'org.apache.thrift:libthrift:0.10.0'  // Jena 3.7.0 uses 0.10.0
+    embed 'org.apache.thrift:libthrift:0.23.0'  // Jena 3.7.0 uses 0.23.0
     embed 'com.github.andrewoma.dexx:collection:0.7'
     embed 'com.github.jsonld-java:jsonld-java:0.12.0'  // Jena 3.7.0 uses 0.12.0
     embed 'commons-codec:commons-codec:1.11'  // Jena 3.7.0 uses 1.11
-    embed 'org.apache.commons:commons-lang3:3.4'
+    embed 'org.apache.commons:commons-lang3:3.18.0'
 
     // HTTP components for remote SPARQL endpoints
     embed 'org.apache.httpcomponents:httpclient:4.5.5'
     embed 'org.apache.httpcomponents:httpcore:4.4.9'
 
     // Jackson for JSON parsing
-    embed 'com.fasterxml.jackson.core:jackson-core:2.9.5'
-    embed 'com.fasterxml.jackson.core:jackson-databind:2.9.5'
-    embed 'com.fasterxml.jackson.core:jackson-annotations:2.9.5'
+    embed 'com.fasterxml.jackson.core:jackson-core:2.18.6'
+    embed 'com.fasterxml.jackson.core:jackson-databind:2.18.6'
+    embed 'com.fasterxml.jackson.core:jackson-annotations:2.18.6'
 
     // Xerces for XML parsing (Jena needs it)
     embed 'xerces:xercesImpl:2.11.0'

gridappsd-poi/build.gradle

@@ -16,21 +16,21 @@ configurations {
 
 dependencies {
     // Apache POI core components for Excel handling
-    embed 'org.apache.poi:poi:3.17'
-    embed 'org.apache.poi:poi-ooxml:3.17'
-    embed 'org.apache.poi:poi-ooxml-schemas:3.17'
+    embed 'org.apache.poi:poi:5.4.0'
+    embed 'org.apache.poi:poi-ooxml:5.4.0'
+    embed 'org.apache.poi:poi-ooxml-schemas:5.4.0'
 
     // POI transitive dependencies
     embed 'org.apache.xmlbeans:xmlbeans:2.6.0'
     embed 'org.apache.commons:commons-collections4:4.1'
     embed 'commons-codec:commons-codec:1.10'  // POI 3.17 uses 1.10
 
     // XML Security (needed by POI for signed documents)
-    embed 'org.apache.santuario:xmlsec:2.1.0'
+    embed 'org.apache.santuario:xmlsec:2.2.6'
 
     // Bouncy Castle (needed by xmlsec)
-    embed 'org.bouncycastle:bcprov-jdk15on:1.58'
-    embed 'org.bouncycastle:bcpkix-jdk15on:1.58'
+    embed 'org.bouncycastle:bcprov-jdk15on:1.70'
+    embed 'org.bouncycastle:bcpkix-jdk15on:1.70'
 
     // Curve25519 (needed by POI)
     embed 'com.github.virtuald:curvesapi:1.04'
@@ -70,10 +70,10 @@ shadowJar {
             'Bundle-Version': '3.17.0',
             'Bundle-Vendor': 'PNNL',
             // Export only the POI packages that GridAPPS-D uses
-            'Export-Package': 'org.apache.poi.ss.usermodel;version="3.17.0",' +
-                             'org.apache.poi.hssf.usermodel;version="3.17.0",' +
-                             'org.apache.poi.xssf.usermodel;version="3.17.0",' +
-                             'org.apache.poi.ss.util;version="3.17.0"',
+            'Export-Package': 'org.apache.poi.ss.usermodel;version="5.4.0.0",' +
+                             'org.apache.poi.hssf.usermodel;version="5.4.0.0",' +
+                             'org.apache.poi.xssf.usermodel;version="5.4.0.0",' +
+                             'org.apache.poi.ss.util;version="5.4.0.0"',
             // Import from OSGi environment
             'Import-Package': 'org.slf4j;version="[1.7,3)";resolution:=optional,' +
                              'javax.xml.parsers,' +

gridappsd-proven/build.gradle

@@ -53,10 +53,10 @@ dependencies {
     embed files('../cnf/cache/7.1.0/GOSS Dependencies/shacl-1.1.0.jar')
 
     // Hazelcast for proven-message serialization
-    embed 'com.hazelcast:hazelcast:3.9.3'
+    embed 'com.hazelcast:hazelcast:5.2.5'
 
     // Commons IO (proven-message needs it)
-    embed 'commons-io:commons-io:2.6'
+    embed 'commons-io:commons-io:2.14.0'
 
     // SLF4J API (don't embed implementation, let OSGi provide it)
     compileOnly 'org.slf4j:slf4j-api:2.0.16'