DTSRD-6422 (#1147)

* jackson 2.22.0

* tomcat 10.1.56

* dependencycheck 12.2.2

* CVE-2026-54515 suppression

* trigger build

* CVE-2025-7962, CVE-2026-54399 and CVE-2026-54428 suppression

Author: lukasz-wolski

build.gradle

@@ -13,7 +13,7 @@ plugins {
   id 'org.springframework.boot' version '3.5.15'
   id "org.flywaydb.flyway" version "9.22.3"
   id 'au.com.dius.pact' version '4.6.17'
-  id 'org.owasp.dependencycheck' version '12.2.0'
+  id 'org.owasp.dependencycheck' version '12.2.2'
   id 'net.serenity-bdd.serenity-gradle-plugin' version '4.2.34'
 }
 
@@ -32,7 +32,7 @@ def versions = [
   launchDarklySdk    : "5.10.9",
   junit              : '6.0.0',
   junitPlatform      : '6.0.0',
-  jackson            : '2.20.1',
+  jackson            : '2.22.0',
   log4j              : '2.26.0',
   logback            : '1.5.20',
   logstashEncoder    : '8.1',
@@ -341,14 +341,37 @@ dependencies {
   implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '5.3.3'
 
   implementation group: 'com.auth0', name: 'java-jwt', version: '4.5.0'
-  implementation group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310', version: '2.20.1'
   implementation group: 'io.jsonwebtoken', name: 'jjwt', version:'0.9.1'
-  implementation group: 'com.fasterxml.jackson', name: 'jackson-bom', version: versions.jackson, ext: 'pom'
-  implementation group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: versions.jackson
-  implementation group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: '2.20'
-  implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: versions.jackson
-  implementation group: 'com.fasterxml.jackson', name: 'jackson-bom', version: '2.20.1', ext: 'pom'
-  implementation group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310', version: versions.jackson
+  implementation (group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310') {
+    version {
+      strictly versions.jackson
+    }
+  }
+  implementation (group: 'com.fasterxml.jackson', name: 'jackson-bom', ext: 'pom') {
+    version {
+      strictly versions.jackson
+    }
+  }
+  implementation (group: 'com.fasterxml.jackson.core', name: 'jackson-core') {
+    version {
+      strictly versions.jackson
+    }
+  }
+  implementation (group: 'com.fasterxml.jackson.core', name: 'jackson-databind') {
+    version {
+      strictly versions.jackson
+    }
+  }
+  implementation (group: 'com.fasterxml.jackson', name: 'jackson-bom', ext: 'pom') {
+    version {
+      strictly versions.jackson
+    }
+  }
+  implementation (group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310') {
+    version {
+      strictly versions.jackson
+    }
+  }
 
   implementation group: 'jakarta.inject', name: 'jakarta.inject-api', version: '2.0.1'
   implementation 'com.github.hmcts:idam-java-client:3.0.5'
@@ -491,7 +514,7 @@ dependencyManagement {
     mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
   }
   dependencies {
-    dependencySet(group: 'org.apache.tomcat.embed', version: '10.1.55') {
+    dependencySet(group: 'org.apache.tomcat.embed', version: '10.1.56') {
       entry 'tomcat-embed-core'
       entry 'tomcat-embed-el'
       entry 'tomcat-embed-websocket'
@@ -517,6 +540,21 @@ dependencyManagement {
       entry 'spring-web'
       entry 'spring-webmvc'
     }
+    dependencySet(group: 'com.fasterxml.jackson.core', version: versions.jackson) {
+      entry 'jackson-core'
+      entry 'jackson-databind'
+    }
+    dependencySet(group: 'com.fasterxml.jackson.datatype', version: versions.jackson) {
+      entry 'jackson-datatype-jsr310'
+      entry 'jackson-datatype-jdk8'
+    }
+    dependencySet(group: 'com.fasterxml.jackson.dataformat', version: versions.jackson) {
+      entry 'jackson-dataformat-toml'
+      entry 'jackson-dataformat-yaml'
+    }
+    dependencySet(group: 'com.fasterxml.jackson.module', version: versions.jackson) {
+      entry 'jackson-module-parameter-names'
+    }
   }
 }
 
@@ -553,4 +591,3 @@ rootProject.tasks.named("processFunctionalTestResources") {
 rootProject.tasks.named("processIntegrationTestResources") {
   duplicatesStrategy = 'include'
 }
-

config/owasp/suppressions.xml

@@ -1,2 +1,42 @@
 <?xml version="1.0" encoding="UTF-8"?><suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+  <suppress>
+    <notes>
+      <![CDATA[
+        Reviewed 2026-07-07
+        False positive:
+        CVE-2026-54515 applies to jackson libraries.
+        Affected libraries reported by dependency-check are:
+        - jackson-databind 2.22.0
+        Versions of used libraries are their latest respectively.
+      ]]>
+    </notes>
+    <cve>CVE-2026-54515</cve>
+  </suppress>
+  <suppress>
+    <notes>
+      <![CDATA[
+        Reviewed 2026-06-18
+        False positive:
+        CVE-2025-7962 applies to angus-activation.
+        Affected libraries reported by dependency-check are:
+        - angus-activation 2.0.3
+        Versions of used libraries are their latest respectively.
+      ]]>
+    </notes>
+    <cve>CVE-2025-7962</cve>
+  </suppress>
+  <suppress>
+    <notes>
+      <![CDATA[
+        Reviewed 2026-07-07
+        False positive:
+        CVE-2026-54399 and CVE-2026-54428 applies to httpcore libraries.
+        Affected libraries reported by dependency-check are:
+        - httpcore 4.4.16
+        Versions of used libraries are their latest respectively.
+      ]]>
+    </notes>
+    <cve>CVE-2026-54399</cve>
+    <cve>CVE-2026-54428</cve>
+  </suppress>
 </suppressions>