Apply March 2026 security updates

Author: pvannierop

build.gradle.kts

@@ -20,15 +20,20 @@ radarRootProject {
 subprojects {
     apply(plugin = "org.radarbase.radar-kotlin")
 
-    configurations.all {
-        resolutionStrategy {
-            /* The entries in the block below are added here to force the version of
-             * transitive dependencies and mitigate reported vulnerabilities */
-            force(
-                "org.apache.commons:commons-lang3:${rootProject.libs.versions.commonsLang3.get()}",
-            )
+    // --- Vulnerability fixes start ---
+    dependencies {
+        plugins.withType<JavaPlugin> {
+            constraints {
+                add("implementation", rootProject.libs.jackson.bom) {
+                    because("Force safe version of Jackson across all modules")
+                }
+                add("implementation", rootProject.libs.commons.lang3) {
+                    because("Force safe version of commons-lang3 across all modules")
+                }
+            }
         }
     }
+    // --- Vulnerability fixes end ---
 
     radarKotlin {
         javaVersion.set(rootProject.libs.versions.java.get().toInt())

gradle/libs.versions.toml

@@ -2,18 +2,19 @@
 project = "0.7.2"
 java = "17"
 gradle = "8.14"
-kotlin = "1.9.22"
-radarCommons = "1.2.4"
+kotlin = "1.9.24"
+radarCommons = "1.2.6"
 confluent = "7.8.1"
 avro = "1.12.0"
-jackson = "2.17.3"
+jackson = "2.20.2"
+jacksonAnnotations = "2.20"
 log4j2 = "2.23.1"
 slf4j = "2.0.13"
 sentryLog4j = "1.7.30"
 sentryOpenTelemetryAgent = "8.1.0"
 okhttp = "4.12.0"
 firebaseAdmin = "9.6.0"
-radarSchemas = "0.8.14"
+radarSchemas = "0.8.16"
 ktor = "2.3.10"
 junit = "5.10.2"
 wiremock = "3.0.1"
@@ -28,7 +29,7 @@ kafka-connect-api = { group = "org.apache.kafka", name = "connect-api", version
 kafka-connect-avro-converter = { group = "io.confluent", name = "kafka-connect-avro-converter", version.ref = "confluent" }
 okhttp = { group = "com.squareup.okhttp3", name = "okhttp", version.ref = "okhttp" }
 jackson-bom = { group = "com.fasterxml.jackson", name = "jackson-bom", version.ref = "jackson" }
-jackson-annotations = { group = "com.fasterxml.jackson.core", name = "jackson-annotations", version.ref = "jackson" }
+jackson-annotations = { group = "com.fasterxml.jackson.core", name = "jackson-annotations", version.ref = "jacksonAnnotations" }
 jackson-databind = { group = "com.fasterxml.jackson.core", name = "jackson-databind", version.ref = "jackson" }
 jackson-dataformat-yaml = { group = "com.fasterxml.jackson.dataformat", name = "jackson-dataformat-yaml", version.ref = "jackson" }
 jackson-datatype-jsr310 = { group = "com.fasterxml.jackson.datatype", name = "jackson-datatype-jsr310", version.ref = "jackson" }

kafka-connect-fitbit-source/Dockerfile

@@ -32,7 +32,7 @@ COPY ./kafka-connect-fitbit-source/src/ /code/kafka-connect-fitbit-source/src
 
 RUN gradle jar
 
-FROM confluentinc/cp-kafka-connect-base:7.8.1
+FROM confluentinc/cp-kafka-connect-base:7.8.7
 
 USER appuser
 

kafka-connect-oura-source/Dockerfile

@@ -32,7 +32,7 @@ COPY ./oura-library/src/ /code/oura-library/src
 
 RUN gradle jar
 
-FROM confluentinc/cp-kafka-connect-base:7.8.1
+FROM confluentinc/cp-kafka-connect-base:7.8.7
 
 
 LABEL org.opencontainers.image.authors="pauline.conde@kcl.ac.uk"

kafka-connect-rest-source/build.gradle.kts

@@ -17,6 +17,9 @@ dependencies {
     runtimeOnly(libs.sentry.log4j) {
         // Exclude log4j with security vulnerability (safe version is provided by docker image).
         exclude(group = "log4j", module = "log4j")
+        exclude(group = "org.slf4j", module = "slf4j-api")
+        // Exclude Jackson with security vulnerability (safe version is provided by docker image).
+        exclude(group = "com.fasterxml.jackson.core")
     }
     runtimeOnly(libs.sentry.opentelemetry.agent)
 }