DTSRD-6169 (#1127)

* rse-gradle-java-plugin 0.12.70

* ben-manes.versions 0.54.0

* dependencycheck 12.2.0

* CVE-2025-48976: enforce commons-fileupload 1.6.0

* CVE-2024-47554: enforce commons-io 2.22.0

* CVE-2025-48924: enforce commons-lang3 3.20.0

* CVE-2026-42198: enforce postgres 42.7.11

* removed deprecated logging-appinsights 6.1.9

* replaced deprecated methods

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: lukasz-wolski

build.gradle

@@ -1,19 +1,19 @@
 plugins {
   id 'application'
-  id 'uk.gov.hmcts.java' version '0.12.67'
+  id 'uk.gov.hmcts.java' version '0.12.70'
   id 'idea'
   id 'jacoco'
   id 'pmd'
   id 'checkstyle'
   id 'project-report'
-  id 'com.github.ben-manes.versions' version '0.53.0'
+  id 'com.github.ben-manes.versions' version '0.54.0'
   id "info.solidsoft.pitest" version '1.15.0'
   id 'io.spring.dependency-management' version '1.1.7'
   id 'org.sonarqube' version '7.0.1.6134'
   id 'org.springframework.boot' version '3.5.14'
   id "org.flywaydb.flyway" version "9.22.3"
   id 'au.com.dius.pact' version '4.6.17'
-  id 'org.owasp.dependencycheck' version '12.1.6'
+  id 'org.owasp.dependencycheck' version '12.2.0'
   id 'net.serenity-bdd.serenity-gradle-plugin' version '4.2.34'
 }
 
@@ -27,7 +27,7 @@ def versions = [
   reformHealthStarter: '0.0.5',
   sonarPitest        : '0.5',
   junitPitest        : '1.2.1',
-  commonsLang3       : '3.17.0',
+  commonsLang3       : '3.20.0',
   pact_version       : '4.6.17',
   launchDarklySdk    : "5.10.9",
   junit              : '6.0.0',
@@ -357,7 +357,7 @@ dependencies {
   implementation group: 'com.launchdarkly', name: 'launchdarkly-java-server-sdk', version: versions.launchDarklySdk
 
   implementation group: 'org.flywaydb', name: 'flyway-core', version: '9.22.3'
-  implementation group: 'org.postgresql', name: 'postgresql', version: '42.7.8'
+  implementation group: 'org.postgresql', name: 'postgresql', version: '42.7.11'
 
   implementation group: 'com.google.guava', name: 'guava', version: '33.5.0-jre'
   implementation group: 'jakarta.el', name: 'jakarta.el-api', version: '6.0.1'
@@ -377,12 +377,12 @@ dependencies {
   implementation 'io.github.openfeign:feign-httpclient:13.6'
   implementation group: 'org.apache.logging.log4j', name: 'log4j-core', version: versions.log4j
   implementation "com.github.hmcts.java-logging:logging:${versions.reformLogging}"
-  implementation "com.github.hmcts.java-logging:logging-appinsights:6.1.9"
   implementation('net.logstash.logback:logstash-logback-encoder') {
         version { strictly versions.logstashEncoder }
         because 'logstash 9 pulls Jackson 3 (tools.*); stay on Jackson 2 for Spring Boot 3'
     }
   implementation group: 'org.apache.commons', name: 'commons-lang3', version: versions.commonsLang3
+  implementation group: 'commons-fileupload', name: 'commons-fileupload', version: '1.6.0'
 
   testImplementation 'com.github.hmcts:rd-commons-lib:0.1.3'
 
@@ -496,6 +496,12 @@ dependencyManagement {
       entry 'tomcat-embed-el'
       entry 'tomcat-embed-websocket'
     }
+    dependencySet(group: 'commons-io', version: '2.22.0') {
+      entry 'commons-io'
+    }
+    dependencySet(group: 'org.apache.commons', version: versions.commonsLang3) {
+      entry 'commons-lang3'
+    }
   }
 }
 

src/main/java/uk/gov/hmcts/reform/lrdapi/service/impl/RegionServiceImpl.java

@@ -1,6 +1,7 @@
 package uk.gov.hmcts.reform.lrdapi.service.impl;
 
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.Strings;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
@@ -15,7 +16,6 @@
 import java.util.function.BooleanSupplier;
 import java.util.function.Supplier;
 
-import static org.apache.commons.lang3.StringUtils.replaceIgnoreCase;
 import static org.apache.logging.log4j.util.Strings.isNotBlank;
 import static org.springframework.util.ObjectUtils.isEmpty;
 import static uk.gov.hmcts.reform.lrdapi.controllers.constants.LocationRefConstants.ALL;
@@ -114,7 +114,7 @@ private void isRegionIdParamValid(String param) {
     }
 
     private boolean doesStringContainAlphabetOtherThanAll(String param) {
-        String paramWithoutAll = replaceIgnoreCase(param.toUpperCase(), ALL, "");
+        String paramWithoutAll = Strings.CI.replace(param.toUpperCase(), ALL, "");
 
         return isPatternPresent(paramWithoutAll, ALPHABET_REGEX);
     }

src/main/java/uk/gov/hmcts/reform/lrdapi/util/ValidationUtils.java

@@ -2,6 +2,7 @@
 
 import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 import org.slf4j.Logger;
 import uk.gov.hmcts.reform.lrdapi.controllers.advice.InvalidRequestException;
 import uk.gov.hmcts.reform.lrdapi.domain.CourtVenueRequestParam;
@@ -233,7 +234,7 @@ public static boolean isPatternPresent(String stringToEvaluate, String regex) {
     }
 
     private static void checkIfStringStartsAndEndsWithComma(String csvIds, String exceptionMessage) {
-        if (StringUtils.startsWith(csvIds, COMMA) || StringUtils.endsWith(csvIds, COMMA)) {
+        if (Strings.CS.startsWith(csvIds, COMMA) || Strings.CS.endsWith(csvIds, COMMA)) {
             throw new InvalidRequestException(String.format(exceptionMessage, csvIds));
         }
     }
@@ -257,8 +258,8 @@ public static void validateCourtVenueFilters(CourtVenueRequestParam requestParam
 
     private static void validateSingleFilters(String value, String filterString) {
         if (value != null
-            && !StringUtils.equalsIgnoreCase(value, IS_Y)
-            && !StringUtils.equalsIgnoreCase(value, IS_N)) {
+            && !Strings.CI.equals(value, IS_Y)
+            && !Strings.CI.equals(value, IS_N)) {
             throw new InvalidRequestException(String.format(INVALID_ADDITIONAL_FILTER, filterString));
         }
     }