From 753ccb2f28297be9a6c9cc6429657795cb82ac7a Mon Sep 17 00:00:00 2001 From: Alexander Zakharov Date: Wed, 27 May 2026 16:37:49 +0200 Subject: [PATCH 1/2] build: use Spring-managed dependencies --- build.gradle | 6 ------ .../src/main/groovy/oidcAuth.java-conventions.gradle | 12 +++--------- oidc-client-spring-boot/build.gradle | 12 +++--------- oidc-client/build.gradle | 6 +++++- 4 files changed, 11 insertions(+), 25 deletions(-) diff --git a/build.gradle b/build.gradle index 7f667d6..1e591a5 100644 --- a/build.gradle +++ b/build.gradle @@ -19,14 +19,8 @@ plugins { subprojects { ext { auth0JavaVersion = '2.26.0' - junitJupiterVersion = '5.13.1' - wiremockVersion = '3.12.0' - mockitoVersion = '5.11.0' guavaVersion = '33.5.0-jre' - lombokVersion = '1.18.36' - caffeineVersion = "3.2.3" slf4jVersion = '2.0.17' - logback14xVersion = '1.5.18' } } diff --git a/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle b/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle index 58b7547..be78bcb 100644 --- a/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle +++ b/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle @@ -16,15 +16,9 @@ compileJava { } dependencies { - if(project.hasProperty('junitJupiterVersion')) { - testImplementation(platform("org.junit:junit-bom:${junitJupiterVersion}")) - testImplementation('org.junit.jupiter:junit-jupiter') - testRuntimeOnly('org.junit.platform:junit-platform-launcher') - } - - if(project.hasProperty('mockitoVersion')) { - testImplementation("org.mockito:mockito-core:${mockitoVersion}") - } + testImplementation('org.junit.jupiter:junit-jupiter') + testRuntimeOnly('org.junit.platform:junit-platform-launcher') + testImplementation("org.mockito:mockito-core") } // Enable deprecation messages when compiling Java code diff --git a/oidc-client-spring-boot/build.gradle b/oidc-client-spring-boot/build.gradle index dd41144..89c08ed 100644 --- a/oidc-client-spring-boot/build.gradle +++ b/oidc-client-spring-boot/build.gradle @@ -1,9 +1,8 @@ -import org.springframework.boot.gradle.plugin.SpringBootPlugin +import static org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES plugins { id 'oidcAuth.java-conventions' id 'oidcAuth.library-conventions' - id 'io.spring.dependency-management' } java { @@ -12,13 +11,9 @@ java { } } -dependencyManagement { - imports { - mavenBom SpringBootPlugin.BOM_COORDINATES - } -} - dependencies { + api(platform(BOM_COORDINATES)) + api project(":oidc-client") api("com.auth0:auth0:${auth0JavaVersion}") @@ -27,7 +22,6 @@ dependencies { // Dependencies required to run tests testImplementation("org.springframework.boot:spring-boot-starter-test") - testImplementation("org.springframework.boot:spring-boot-starter-web") testImplementation("org.springframework.boot:spring-boot-starter-webmvc-test") testImplementation("org.springframework.boot:spring-boot-starter-restclient-test") } diff --git a/oidc-client/build.gradle b/oidc-client/build.gradle index c1d1112..3d96358 100644 --- a/oidc-client/build.gradle +++ b/oidc-client/build.gradle @@ -1,3 +1,5 @@ +import static org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES + plugins { id 'oidcAuth.java-conventions' id 'oidcAuth.library-conventions' @@ -14,8 +16,10 @@ test { } dependencies { + api(platform(BOM_COORDINATES)) + api("org.slf4j:slf4j-api:${slf4jVersion}") - api("com.github.ben-manes.caffeine:caffeine:${caffeineVersion}") + api("com.github.ben-manes.caffeine:caffeine") implementation("com.auth0:auth0:${auth0JavaVersion}") From 27d953493bf1e88364cb90b7bb9d761728d2c058 Mon Sep 17 00:00:00 2001 From: Alexander Zakharov Date: Wed, 27 May 2026 16:43:49 +0200 Subject: [PATCH 2/2] fix: address CVE-2026-41293 --- build.gradle | 2 +- .../src/main/groovy/oidcAuth.java-conventions.gradle | 2 +- oidc-client-spring-boot/build.gradle | 9 ++++++++- oidc-client/build.gradle | 2 +- 4 files changed, 11 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 1e591a5..35296f9 100644 --- a/build.gradle +++ b/build.gradle @@ -57,4 +57,4 @@ jreleaser { enabled = true } } -} \ No newline at end of file +} diff --git a/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle b/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle index be78bcb..a0f6b20 100644 --- a/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle +++ b/buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle @@ -87,4 +87,4 @@ idea { outputDir file('build/classes/main') testOutputDir file('build/classes/test') } -} \ No newline at end of file +} diff --git a/oidc-client-spring-boot/build.gradle b/oidc-client-spring-boot/build.gradle index 89c08ed..25b9e68 100644 --- a/oidc-client-spring-boot/build.gradle +++ b/oidc-client-spring-boot/build.gradle @@ -24,8 +24,15 @@ dependencies { testImplementation("org.springframework.boot:spring-boot-starter-test") testImplementation("org.springframework.boot:spring-boot-starter-webmvc-test") testImplementation("org.springframework.boot:spring-boot-starter-restclient-test") + + constraints { + api('org.apache.tomcat.embed:tomcat-embed-core') { + version { require '11.0.22' } + because 'CVE-2026-41293' + } + } } spotbugs { excludeFilter = file("$projectDir/spotbugs-exclude.xml") -} \ No newline at end of file +} diff --git a/oidc-client/build.gradle b/oidc-client/build.gradle index 3d96358..111e517 100644 --- a/oidc-client/build.gradle +++ b/oidc-client/build.gradle @@ -29,4 +29,4 @@ dependencies { spotbugs { excludeFilter = file("$projectDir/spotbugs-exclude.xml") -} \ No newline at end of file +}