Address CVE-2026-41293 vulnerability

build.gradle

@@ -19,14 +19,8 @@ plugins {
 subprojects {
     ext {
         auth0JavaVersion = '2.26.0'
-        junitJupiterVersion  = '5.13.1'
-        wiremockVersion = '3.12.0'
-        mockitoVersion = '5.11.0'
         guavaVersion = '33.5.0-jre'
-        lombokVersion = '1.18.36'
-        caffeineVersion = "3.2.3"
         slf4jVersion = '2.0.17'
-        logback14xVersion = '1.5.18'
     }
 }
 
@@ -63,4 +57,4 @@ jreleaser {
             enabled = true
         }
     }
-}
+}

buildSrc/src/main/groovy/oidcAuth.java-conventions.gradle

@@ -16,15 +16,9 @@ compileJava {
 }
 
 dependencies {
-    if(project.hasProperty('junitJupiterVersion')) {
-        testImplementation(platform("org.junit:junit-bom:${junitJupiterVersion}"))
-        testImplementation('org.junit.jupiter:junit-jupiter')
-        testRuntimeOnly('org.junit.platform:junit-platform-launcher')
-    }
-
-    if(project.hasProperty('mockitoVersion')) {
-        testImplementation("org.mockito:mockito-core:${mockitoVersion}")
-    }
+    testImplementation('org.junit.jupiter:junit-jupiter')
+    testRuntimeOnly('org.junit.platform:junit-platform-launcher')
+    testImplementation("org.mockito:mockito-core")
 }
 
 // Enable deprecation messages when compiling Java code
@@ -93,4 +87,4 @@ idea {
         outputDir file('build/classes/main')
         testOutputDir file('build/classes/test')
     }
-}
+}

oidc-client-spring-boot/build.gradle

@@ -1,9 +1,8 @@
-import org.springframework.boot.gradle.plugin.SpringBootPlugin
+import static org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES
 
 plugins {
     id 'oidcAuth.java-conventions'
     id 'oidcAuth.library-conventions'
-    id 'io.spring.dependency-management'
 }
 
 java {
@@ -12,13 +11,9 @@ java {
     }
 }
 
-dependencyManagement {
-    imports {
-        mavenBom SpringBootPlugin.BOM_COORDINATES
-    }
-}
-
 dependencies {
+    api(platform(BOM_COORDINATES))
+
     api project(":oidc-client")
     api("com.auth0:auth0:${auth0JavaVersion}")
 
@@ -27,11 +22,17 @@ dependencies {
 
     // Dependencies required to run tests
     testImplementation("org.springframework.boot:spring-boot-starter-test")
-    testImplementation("org.springframework.boot:spring-boot-starter-web")
     testImplementation("org.springframework.boot:spring-boot-starter-webmvc-test")
     testImplementation("org.springframework.boot:spring-boot-starter-restclient-test")
+
+    constraints {
+        api('org.apache.tomcat.embed:tomcat-embed-core') {
+            version { require '11.0.22' }
+            because 'CVE-2026-41293'
+        }
+    }
 }
 
 spotbugs {
     excludeFilter = file("$projectDir/spotbugs-exclude.xml")
-}
+}

oidc-client/build.gradle

@@ -1,3 +1,5 @@
+import static org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES
+
 plugins {
     id 'oidcAuth.java-conventions'
     id 'oidcAuth.library-conventions'
@@ -14,8 +16,10 @@ test {
 }
 
 dependencies {
+    api(platform(BOM_COORDINATES))
+
     api("org.slf4j:slf4j-api:${slf4jVersion}")
-    api("com.github.ben-manes.caffeine:caffeine:${caffeineVersion}")
+    api("com.github.ben-manes.caffeine:caffeine")
 
     implementation("com.auth0:auth0:${auth0JavaVersion}")
 
@@ -25,4 +29,4 @@ dependencies {
 
 spotbugs {
     excludeFilter = file("$projectDir/spotbugs-exclude.xml")
-}
+}