FINERACT-2684: Update all non-major dependencies

.github/workflows/liquibase-only-postgresql.yml

@@ -16,7 +16,7 @@ jobs:
 
     services:
       postgresql:
-        image: postgres:18.3
+        image: postgres:18.6
         ports:
           - 5432:5432
         env:

.github/workflows/regression-safety-db-changes.yml

@@ -81,7 +81,7 @@ jobs:
 
     services:
       postgresql:
-        image: postgres:18.3
+        image: postgres:18.6
         ports:
           - 5432:5432
         env:

.github/workflows/verify-liquibase-backward-compatibility.yml

@@ -17,7 +17,7 @@ jobs:
 
     services:
       postgresql:
-        image: postgres:18.3
+        image: postgres:18.6
         ports:
           - 5432:5432
         env:

build.gradle

@@ -122,24 +122,24 @@ plugins {
     id "org.barfuin.gradle.taskinfo" version "3.0.2"
     id 'com.adarshr.test-logger' version '4.0.0'
     id 'com.diffplug.spotless' version '6.25.0' apply false
-    id 'org.nosphere.apache.rat' version '0.8.1' apply false
+    id 'org.nosphere.apache.rat' version '0.11.0' apply false
     id 'com.github.hierynomus.license' version '0.16.1' apply false
     id 'com.github.jk1.dependency-license-report' version '2.9' apply false
-    id 'org.zeroturnaround.gradle.jrebel' version '1.2.2' apply false
-    id 'org.springframework.boot' version '4.1.0' apply false
+    id 'org.zeroturnaround.gradle.jrebel' version '1.2.3' apply false
+    id 'org.springframework.boot' version '4.1.1' apply false
     id 'net.ltgt.errorprone' version '4.4.0' apply false
-    id 'io.swagger.core.v3.swagger-gradle-plugin' version '2.2.49' apply false
+    id 'io.swagger.core.v3.swagger-gradle-plugin' version '2.2.55' apply false
     id 'com.gorylenko.gradle-git-properties' version '2.5.7' apply false
     id 'org.asciidoctor.jvm.convert' version '4.0.5' apply false
     id 'org.asciidoctor.jvm.pdf' version '4.0.5' apply false
-    id 'com.google.cloud.tools.jib' version '3.5.3' apply false
+    id 'com.google.cloud.tools.jib' version '3.5.4' apply false
     id 'org.sonarqube' version '6.3.1.5724'
-    id 'com.github.andygoossens.modernizer' version '1.13.0' apply false
-    id 'com.github.spotbugs' version '6.5.4' apply false
+    id 'com.github.andygoossens.modernizer' version '1.15.0' apply false
+    id 'com.github.spotbugs' version '6.5.11' apply false
     id 'se.thinkcode.cucumber-runner' version '0.0.14' apply false
     id "com.github.davidmc24.gradle.plugin.avro-base" version "1.9.1" apply false
-    id 'org.openapi.generator' version '7.22.0' apply false
-    id 'com.gradleup.shadow' version '9.4.1' apply false
+    id 'org.openapi.generator' version '7.25.0' apply false
+    id 'com.gradleup.shadow' version '9.6.1' apply false
     id 'me.champeau.jmh' version '0.7.3' apply false
     id 'org.cyclonedx.bom' version '3.4.1' apply false
     id 'com.docktape.swagger-brake' version '2.7.0' apply false

buildSrc/build.gradle

@@ -45,7 +45,7 @@ configurations.all {
     resolutionStrategy {
         dependencySubstitution {
             // Substitution is to resolve CVE-2025-12183
-            substitute module('org.lz4:lz4-java') using module('at.yawk.lz4:lz4-java:1.11.0')
+            substitute module('org.lz4:lz4-java') using module('at.yawk.lz4:lz4-java:1.11.3')
         }
     }
 }

buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle

@@ -23,17 +23,17 @@ apply plugin: 'io.spring.dependency-management'
 dependencyManagement {
     imports {
         mavenBom 'com.squareup.okhttp3:okhttp-bom:4.12.0'
-        mavenBom 'org.slf4j:slf4j-bom:2.0.17'
-        mavenBom 'io.micrometer:micrometer-bom:1.16.5'
-        mavenBom 'org.springframework.boot:spring-boot-dependencies:4.1.0'
-        mavenBom 'io.awspring.cloud:spring-cloud-aws-dependencies:4.0.2'
-        mavenBom 'io.opentelemetry:opentelemetry-bom:1.62.0'
-        mavenBom 'org.jetbrains.kotlin:kotlin-bom:2.3.21'
-        mavenBom 'org.junit:junit-bom:6.0.3'
-        mavenBom 'com.fasterxml.jackson:jackson-bom:2.22.1'
-        mavenBom 'io.cucumber:cucumber-bom:7.34.3'
+        mavenBom 'org.slf4j:slf4j-bom:2.0.19'
+        mavenBom 'io.micrometer:micrometer-bom:1.17.1'
+        mavenBom 'org.springframework.boot:spring-boot-dependencies:4.1.1'
+        mavenBom 'io.awspring.cloud:spring-cloud-aws-dependencies:4.1.1'
+        mavenBom 'io.opentelemetry:opentelemetry-bom:1.66.0'
+        mavenBom 'org.jetbrains.kotlin:kotlin-bom:2.4.20'
+        mavenBom 'org.junit:junit-bom:6.1.3'
+        mavenBom 'com.fasterxml.jackson:jackson-bom:2.22.3'
+        mavenBom 'io.cucumber:cucumber-bom:7.34.8'
         mavenBom 'org.mockito:mockito-bom:5.23.0'
-        mavenBom 'software.amazon.awssdk:bom:2.44.4'
+        mavenBom 'software.amazon.awssdk:bom:2.55.2'
         mavenBom 'io.github.resilience4j:resilience4j-bom:2.4.0'
         mavenBom 'org.testcontainers:testcontainers-bom:1.21.4'
         mavenBom 'org.glassfish.jersey:jersey-bom:4.0.2'
@@ -44,27 +44,27 @@ dependencyManagement {
         // We do not use :+ to get the latest available version available on Maven Central, as that could suddenly break things.
         // We use the Renovate Bot to automatically propose Pull Requests (PRs) when upgrades for all of these versions are available.
 
-        dependency 'ch.qos.logback:logback-core:1.5.35'
-        dependency 'ch.qos.logback:logback-classic:1.5.35'
+        dependency 'ch.qos.logback:logback-core:1.6.3'
+        dependency 'ch.qos.logback:logback-classic:1.6.3'
         dependency 'ch.qos.logback.contrib:logback-json-classic:0.1.5'
         dependency 'ch.qos.logback.contrib:logback-jackson:0.1.5'
         dependency 'org.codehaus.janino:janino:3.1.12'
 
         dependency 'org.eclipse.persistence:org.eclipse.persistence.jpa:5.0.1'
-        dependency 'com.google.guava:guava:33.6.0-jre'
+        dependency 'com.google.guava:guava:33.7.1-jre'
         dependency 'com.google.code.gson:gson:2.14.0'
-        dependency 'com.google.googlejavaformat:google-java-format:1.35.0'
-        dependency 'org.apache.commons:commons-collections4:4.5.0'
+        dependency 'com.google.googlejavaformat:google-java-format:1.36.1'
+        dependency 'org.apache.commons:commons-collections4:4.6.0'
         dependency 'org.apache.commons:commons-compress:1.28.0'
-        dependency ('software.amazon.msk:aws-msk-iam-auth:2.3.6') {
+        dependency ('software.amazon.msk:aws-msk-iam-auth:2.3.8') {
             exclude 'commons-logging:commons-logging:'
         }
         dependency ('org.apache.commons:commons-email:1.6.0') {
             exclude 'com.sun.mail:javax.mail'
             exclude 'javax.activation:activation'
         }
         dependency 'commons-io:commons-io:2.22.0'
-        dependency 'com.github.librepdf:openpdf:3.0.4'
+        dependency 'com.github.librepdf:openpdf:3.0.5'
         dependency ('org.mnode.ical4j:ical4j:3.2.19') {
             exclude 'com.sun.mail:javax.mail'
             exclude 'org.codehaus.groovy:groovy'
@@ -74,10 +74,10 @@ dependencyManagement {
         dependency 'org.ehcache:ehcache:3.12.0'
         dependency 'com.github.spullara.mustache.java:compiler:0.9.14'
         dependency 'com.jayway.jsonpath:json-path:3.0.0'
-        dependency ('org.apache.tika:tika-core:3.3.0') {
+        dependency ('org.apache.tika:tika-core:3.3.2') {
             exclude 'commons-logging:commons-logging'
         }
-        dependency ('org.apache.tika:tika-parser-miscoffice-module:3.3.0') {
+        dependency ('org.apache.tika:tika-parser-miscoffice-module:3.3.2') {
             exclude 'org.bouncycastle:bcprov-jdk15on'
             exclude 'org.bouncycastle:bcjmail-jdk15on'
             exclude 'org.bouncycastle:bcprov-jdk18on'
@@ -94,7 +94,7 @@ dependencyManagement {
             exclude 'org.apache.commons:commons-compress'
             exclude 'xml-apis:xml-apis'
         }
-        dependency ('org.apache.tika:tika-parser-microsoft-module:3.3.0') {
+        dependency ('org.apache.tika:tika-parser-microsoft-module:3.3.2') {
             exclude 'org.bouncycastle:bcprov-jdk15on'
             exclude 'org.bouncycastle:bcjmail-jdk15on'
             exclude 'org.bouncycastle:bcprov-jdk18on'
@@ -111,7 +111,7 @@ dependencyManagement {
             exclude 'org.apache.commons:commons-compress'
             exclude 'xml-apis:xml-apis'
         }
-        dependency ('org.apache.tika:tika-parser-image-module:3.3.0') {
+        dependency ('org.apache.tika:tika-parser-image-module:3.3.2') {
             exclude 'org.bouncycastle:bcprov-jdk15on'
             exclude 'org.bouncycastle:bcjmail-jdk15on'
             exclude 'org.bouncycastle:bcprov-jdk18on'
@@ -131,18 +131,18 @@ dependencyManagement {
         dependency ('org.apache.httpcomponents:httpclient:4.5.14') {
             exclude 'commons-logging:commons-logging:'
         }
-        dependency 'org.apache.httpcomponents.core5:httpcore5:5.4'
-        dependency 'org.apache.httpcomponents.core5:httpcore5-h2:5.4'
+        dependency 'org.apache.httpcomponents.core5:httpcore5:5.4.3'
+        dependency 'org.apache.httpcomponents.core5:httpcore5-h2:5.4.3'
         dependency 'jakarta.management.j2ee:jakarta.management.j2ee-api:1.1.4'
         dependency 'jakarta.jms:jakarta.jms-api:3.1.0'
         dependency 'jakarta.ws.rs:jakarta.ws.rs-api:3.1.0'
         dependency 'org.glassfish.jaxb:jaxb-runtime:2.3.6' // Swagger needs exactly this version
-        dependency 'joda-time:joda-time:2.14.2'
+        dependency 'joda-time:joda-time:2.14.4'
 
-        dependency 'io.github.classgraph:classgraph:4.8.184'
-        dependency 'com.github.spotbugs:spotbugs-annotations:4.9.8'
+        dependency 'io.github.classgraph:classgraph:4.8.195'
+        dependency 'com.github.spotbugs:spotbugs-annotations:4.10.4'
         dependency 'javax.cache:cache-api:1.1.1'
-        dependency 'org.mock-server:mockserver-junit-jupiter:5.14.0'
+        dependency 'org.mock-server:mockserver-junit-jupiter:5.15.0'
         dependency 'org.webjars:webjars-locator-core:0.59'
         dependency 'com.icegreen:greenmail-junit5:2.0.1'
 
@@ -164,35 +164,35 @@ dependencyManagement {
         dependency 'io.reactivex.rxjava2:rxjava:2.2.21'
         dependency "io.gsonfire:gson-fire:1.9.0"
         dependency "com.google.code.findbugs:jsr305:3.0.2"
-        dependency "commons-codec:commons-codec:1.22.0"
-        dependency "org.projectlombok:lombok:1.18.46"
+        dependency "commons-codec:commons-codec:1.22.1"
+        dependency "org.projectlombok:lombok:1.18.48"
 
-        dependency 'org.bouncycastle:bcpkix-jdk18on:1.84'
-        dependency 'org.bouncycastle:bcprov-jdk18on:1.84'
-        dependency 'org.bouncycastle:bcutil-jdk18on:1.84'
-        dependency 'org.bouncycastle:bcpg-jdk18on:1.84'
+        dependency 'org.bouncycastle:bcpkix-jdk18on:1.86'
+        dependency 'org.bouncycastle:bcprov-jdk18on:1.86'
+        dependency 'org.bouncycastle:bcutil-jdk18on:1.86'
+        dependency 'org.bouncycastle:bcpg-jdk18on:1.86'
 
-        dependency 'org.eclipse.jgit:org.eclipse.jgit:7.6.0.202603022253-r'
-        dependency 'org.eclipse.jgit:org.eclipse.jgit.gpg.bc:7.6.0.202603022253-r'
-        dependency 'org.eclipse.jgit:org.eclipse.jgit.ssh.apache:7.6.0.202603022253-r'
+        dependency 'org.eclipse.jgit:org.eclipse.jgit:7.8.0.202609011348-r'
+        dependency 'org.eclipse.jgit:org.eclipse.jgit.gpg.bc:7.8.0.202609011348-r'
+        dependency 'org.eclipse.jgit:org.eclipse.jgit.ssh.apache:7.8.0.202609011348-r'
 
         dependency ('com.tmatesoft.svnkit:svnkit:1.10.13')
         dependency 'com.vdurmont:semver4j:3.1.0'
         dependency 'org.beryx:text-io:3.4.1'
 
-        dependency ('org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3') {
+        dependency ('org.springdoc:springdoc-openapi-starter-webmvc-ui:3.1.1') {
             exclude 'io.swagger.core.v3:swagger-core'
         }
 
-        dependency ('org.apache.activemq:activemq-client:6.2.5') {
+        dependency ('org.apache.activemq:activemq-client:6.3.2') {
             exclude 'javax.annotation:javax.annotation-api'
         }
 
-        dependency 'io.swagger.core.v3:swagger-annotations-jakarta:2.2.49'
-        dependency ('io.swagger.core.v3:swagger-jaxrs2-jakarta:2.2.49') {
+        dependency 'io.swagger.core.v3:swagger-annotations-jakarta:2.2.55'
+        dependency ('io.swagger.core.v3:swagger-jaxrs2-jakarta:2.2.55') {
             exclude 'jakarta.activation:jakarta.activation-api'
         }
-        dependency ('io.swagger.core.v3:swagger-core-jakarta:2.2.49') {
+        dependency ('io.swagger.core.v3:swagger-core-jakarta:2.2.55') {
             exclude 'jakarta.activation:jakarta.activation-api'
         }
 
@@ -206,7 +206,7 @@ dependencyManagement {
             exclude 'jakarta.activation:jakarta.activation-api'
         }
         dependency 'jakarta.validation:jakarta.validation-api:3.1.1'
-        dependency 'org.hibernate.validator:hibernate-validator:9.1.0.Final'
+        dependency 'org.hibernate.validator:hibernate-validator:9.1.4.Final'
 
         dependency ('org.liquibase:liquibase-core:4.33.0') {
             exclude 'javax.xml.bind:jaxb-api'
@@ -237,13 +237,13 @@ dependencyManagement {
         dependency 'org.mapstruct:mapstruct:1.6.3'
         dependency 'org.mapstruct:mapstruct-processor:1.6.3'
 
-        dependency "org.apache.avro:avro:1.12.1"
+        dependency "org.apache.avro:avro:1.12.2"
 
-        dependency ('org.mariadb.jdbc:mariadb-java-client:3.5.8') {
+        dependency ('org.mariadb.jdbc:mariadb-java-client:3.5.10') {
             exclude 'org.slf4j:jcl-over-slf4j'
             exclude 'org.slf4j:slf4j-api'
         }
-        dependency 'org.postgresql:postgresql:42.7.11'
+        dependency 'org.postgresql:postgresql:42.7.13'
 
         dependency 'com.mysql:mysql-connector-j:9.7.0'
 
@@ -253,13 +253,13 @@ dependencyManagement {
         dependency 'commons-beanutils:commons-beanutils:1.11.0'
 
         dependency 'org.wiremock:wiremock-standalone:3.13.2'
-        dependency 'org.apache.sshd:sshd-common:2.17.1'
-        dependency 'org.apache.sshd:sshd-core:2.17.1'
+        dependency 'org.apache.sshd:sshd-common:2.19.0'
+        dependency 'org.apache.sshd:sshd-core:2.19.0'
 
-        dependency 'io.cucumber:cucumber-java:7.34.3'
-        dependency 'io.cucumber:cucumber-java8:7.34.3'
-        dependency 'io.cucumber:cucumber-junit-platform-engine:7.34.3'
-        dependency 'io.cucumber:cucumber-spring:7.34.3'
+        dependency 'io.cucumber:cucumber-java:7.34.8'
+        dependency 'io.cucumber:cucumber-java8:7.34.8'
+        dependency 'io.cucumber:cucumber-junit-platform-engine:7.34.8'
+        dependency 'io.cucumber:cucumber-spring:7.34.8'
 
         dependency 'org.reflections:reflections:0.10.2'
 
@@ -279,28 +279,28 @@ dependencyManagement {
         dependency 'com.ibm.icu:icu4j:78.3'
         dependency 'org.yakworks:spring-icu4j:0.5.2'
         dependency 'org.apache.commons:commons-lang3:3.20.0'
-        dependency 'com.nimbusds:nimbus-jose-jwt:10.9'
+        dependency 'com.nimbusds:nimbus-jose-jwt:10.10'
         // spring-core & spring-security-core now come from the Spring Boot 4 BOM (Spring Framework 7 / Security 7)
         // resilience4j-bom does not manage the spring-boot4 starter variant — pin it explicitly:
         dependency 'io.github.resilience4j:resilience4j-spring-boot4:2.4.0'
         // Keep Netty on the 4.1 line for MockServer compatibility.
-        dependency 'io.netty:netty-buffer:4.1.135.Final'
-        dependency 'io.netty:netty-common:4.1.135.Final'
-        dependency 'io.netty:netty-codec:4.1.135.Final'
-        dependency 'io.netty:netty-codec-base:4.1.135.Final'
-        dependency 'io.netty:netty-codec-compression:4.1.135.Final'
-        dependency 'io.netty:netty-codec-http:4.1.135.Final'
-        dependency 'io.netty:netty-codec-http2:4.1.135.Final'
-        dependency 'io.netty:netty-codec-marshalling:4.1.135.Final'
-        dependency 'io.netty:netty-codec-protobuf:4.1.135.Final'
-        dependency 'io.netty:netty-codec-socks:4.1.135.Final'
-        dependency 'io.netty:netty-handler:4.1.135.Final'
-        dependency 'io.netty:netty-handler-proxy:4.1.135.Final'
-        dependency 'io.netty:netty-resolver:4.1.135.Final'
-        dependency 'io.netty:netty-transport:4.1.135.Final'
-        dependency 'io.netty:netty-transport-classes-epoll:4.1.135.Final'
-        dependency 'io.netty:netty-transport-native-unix-common:4.1.135.Final'
-        dependency 'at.yawk.lz4:lz4-java:1.11.0'
+        dependency 'io.netty:netty-buffer:4.2.18.Final'
+        dependency 'io.netty:netty-common:4.2.18.Final'
+        dependency 'io.netty:netty-codec:4.2.18.Final'
+        dependency 'io.netty:netty-codec-base:4.2.18.Final'
+        dependency 'io.netty:netty-codec-compression:4.2.18.Final'
+        dependency 'io.netty:netty-codec-http:4.2.18.Final'
+        dependency 'io.netty:netty-codec-http2:4.2.18.Final'
+        dependency 'io.netty:netty-codec-marshalling:4.2.18.Final'
+        dependency 'io.netty:netty-codec-protobuf:4.2.18.Final'
+        dependency 'io.netty:netty-codec-socks:4.2.18.Final'
+        dependency 'io.netty:netty-handler:4.2.18.Final'
+        dependency 'io.netty:netty-handler-proxy:4.2.18.Final'
+        dependency 'io.netty:netty-resolver:4.2.18.Final'
+        dependency 'io.netty:netty-transport:4.2.18.Final'
+        dependency 'io.netty:netty-transport-classes-epoll:4.2.18.Final'
+        dependency 'io.netty:netty-transport-native-unix-common:4.2.18.Final'
+        dependency 'at.yawk.lz4:lz4-java:1.11.3'
         // thymeleaf + thymeleaf-spring7 and Tomcat 11 embed now come from the Spring Boot 4 BOM
     }
 }

docker-compose-mariadb-test.yml

@@ -23,7 +23,7 @@ services:
       service: mariadb
 
   localstack:
-    image: localstack/localstack:2.1
+    image: localstack/localstack:2.3
     ports:
       - "4566:4566"
       - "4510-4559:4510-4559"

docker-compose-mariadb.yml

@@ -20,7 +20,7 @@
 services:
   mariadb:
     container_name: mariadb
-    image: mariadb:12.2
+    image: mariadb:12.3
     volumes:
       - ./config/docker/mysql/conf.d/server_collation.cnf:/etc/mysql/conf.d/server_collation.cnf:ro
       - ./config/docker/mariadb/conf.d/mariadb_compat.cnf:/etc/mysql/conf.d/mariadb_compat.cnf:ro

docker-compose-mysql-test.yml

@@ -23,7 +23,7 @@ services:
       service: mysql
 
   localstack:
-    image: localstack/localstack:2.1
+    image: localstack/localstack:2.3
     ports:
       - "4566:4566"
       - "4510-4559:4510-4559"

docker-compose-postgresql-kafka.yml

@@ -20,7 +20,7 @@
 version: "3.7"
 services:
   kafka:
-    image: "apache/kafka:4.2.0-rc2"
+    image: "apache/kafka:4.4.0-rc2"
     ports:
       - "9092:9092"
     env_file:

docker-compose-postgresql-test.yml

@@ -23,7 +23,7 @@ services:
       service: postgresql
 
   localstack:
-    image: localstack/localstack:2.1
+    image: localstack/localstack:2.3
     ports:
       - "4566:4566"
       - "4510-4559:4510-4559"

docker-compose-war-test.yml

@@ -37,7 +37,7 @@ services:
     # Same Tomcat major as the servlet API the WAR is built against, on the JDK the project targets.
     # Pinned to an exact patch version, like every other image the repo pulls, so a Tomcat release
     # cannot silently change what this job tests.
-    image: tomcat:10.1.59-jdk25-temurin
+    image: tomcat:10.1.60-jdk25-temurin
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:

fineract-e2e-tests-runner/build.gradle

@@ -19,7 +19,7 @@
 
 plugins {
     id 'se.thinkcode.cucumber-runner' version '0.0.14'
-    id 'io.qameta.allure' version '4.1.0'
+    id 'io.qameta.allure' version '4.3.0'
 }
 
 apply plugin: 'java'