From 08ad01d76b3760a566d46205da13f43d3208feee Mon Sep 17 00:00:00 2001 From: jonathan zollinger Date: Fri, 8 May 2026 18:41:02 -0600 Subject: [PATCH] fix: address a few transitive vulnerabilities Signed-off-by: jonathan zollinger --- build.gradle.kts | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/build.gradle.kts b/build.gradle.kts index 7c73844..5511d0f 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -47,6 +47,17 @@ dependencies { compileOnly("org.projectlombok:lombok:${lombokVersion}") implementation("io.micronaut.reactor:micronaut-reactor-http-client") implementation("io.micronaut.serde:micronaut-serde-jackson") + constraints { + implementation("io.micronaut:micronaut-json-core:4.10.16") { + because("CVE-2026-33012 & CVE-2026-33013") + } + implementation("io.micronaut:micronaut-context:4.10.22") { + because("CVE-2026-44241") + } + implementation("org.mozilla.rhino:1.7.14.1") { + because("CVE-2025-66453") + } + } implementation("io.micronaut.validation:micronaut-validation") implementation("io.micronaut:micronaut-retry") "lombok"("org.projectlombok:lombok:${lombokVersion}") @@ -61,6 +72,12 @@ java { withJavadocJar() } +configurations.all { + resolutionStrategy { + force("io.netty:netty-bom:4.2.10.Final") + } +} + tasks.withType().configureEach { // This will generate an empty Javadoc JAR to satisfy publishing requirements // without failing the build on documentation errors from generated code.