From 0c01df0f96df748e0b6d469d94c8494b8f3ebd3c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 17:05:11 +0000 Subject: [PATCH 1/2] Add Gradle dependency locking and Dependabot configuration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enables Gradle's built-in dependency locking on all resolvable configurations and the buildscript classpath, generating buildscript-gradle.lockfile and lib/gradle.lockfile so Dependabot can see the full transitive dependency graph and open PRs that patch indirect dependencies (e.g. CVEs in transitives of httpclient or bcprov-jdk15on). The lockfile only constrains CI/test/publish builds — the POM produced by maven-publish still publishes declared versions, so consumers on Maven Central are unaffected. Also pins mockito-core from the dynamic 3.+ range to 3.12.4 so the recorded lock resolution is intentional; Dependabot will bump from here on its own cadence. --- .github/dependabot.yml | 16 ++++++++ build.gradle | 10 +++++ buildscript-gradle.lockfile | 6 +++ lib/build.gradle | 6 ++- lib/gradle.lockfile | 80 +++++++++++++++++++++++++++++++++++++ 5 files changed, 117 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml create mode 100644 buildscript-gradle.lockfile create mode 100644 lib/gradle.lockfile diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2cf5dba2 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + - package-ecosystem: "gradle" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + groups: + gradle-minor-and-patch: + update-types: + - "minor" + - "patch" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/build.gradle b/build.gradle index fc117848..06d09c4c 100644 --- a/build.gradle +++ b/build.gradle @@ -1,9 +1,19 @@ +buildscript { + configurations.classpath { + resolutionStrategy.activateDependencyLocking() + } +} + plugins { id 'io.github.gradle-nexus.publish-plugin' version '1.1.0' } group 'com.evervault' +dependencyLocking { + lockAllConfigurations() +} + def getRepositoryUsername() { return hasProperty("ossrhUsername") ? ossrhUsername : "" } diff --git a/buildscript-gradle.lockfile b/buildscript-gradle.lockfile new file mode 100644 index 00000000..7d97a8ef --- /dev/null +++ b/buildscript-gradle.lockfile @@ -0,0 +1,6 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +io.github.gradle-nexus.publish-plugin:io.github.gradle-nexus.publish-plugin.gradle.plugin:1.1.0=classpath +io.github.gradle-nexus:publish-plugin:1.1.0=classpath +empty= diff --git a/lib/build.gradle b/lib/build.gradle index f67e09e6..c0a5ce23 100644 --- a/lib/build.gradle +++ b/lib/build.gradle @@ -13,6 +13,10 @@ repositories { mavenLocal() } +dependencyLocking { + lockAllConfigurations() +} + def getKeyFile() { return hasProperty("signingKey") ? signingKey : "" } @@ -24,7 +28,7 @@ def getKeyPassword() { dependencies { testImplementation 'org.junit.jupiter:junit-jupiter:5.7.2' testImplementation "com.github.tomakehurst:wiremock-jre8:2.32.0" - testImplementation "org.mockito:mockito-core:3.+" + testImplementation "org.mockito:mockito-core:3.12.4" implementation 'com.google.code.gson:gson:2.8.9' implementation 'com.google.guava:guava:31.1-android' diff --git a/lib/gradle.lockfile b/lib/gradle.lockfile new file mode 100644 index 00000000..cc4d3508 --- /dev/null +++ b/lib/gradle.lockfile @@ -0,0 +1,80 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +com.fasterxml.jackson.core:jackson-annotations:2.13.0=testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-core:2.13.0=testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.13.0=testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson:jackson-bom:2.13.0=testCompileClasspath,testRuntimeClasspath +com.github.jknack:handlebars-helpers:4.3.0=testCompileClasspath,testRuntimeClasspath +com.github.jknack:handlebars:4.3.0=testCompileClasspath,testRuntimeClasspath +com.github.tomakehurst:wiremock-jre8:2.32.0=testCompileClasspath,testRuntimeClasspath +com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.code.gson:gson:2.8.9=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.errorprone:error_prone_annotations:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.guava:failureaccess:1.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.guava:guava:31.1-android=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.j2objc:j2objc-annotations:1.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.jayway.jsonpath:json-path:2.6.0=testCompileClasspath,testRuntimeClasspath +commons-codec:commons-codec:1.11=compileClasspath,runtimeClasspath +commons-codec:commons-codec:1.15=testCompileClasspath,testRuntimeClasspath +commons-fileupload:commons-fileupload:1.4=testCompileClasspath,testRuntimeClasspath +commons-io:commons-io:2.11.0=testCompileClasspath,testRuntimeClasspath +commons-logging:commons-logging:1.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +javax.servlet:javax.servlet-api:3.1.0=testCompileClasspath,testRuntimeClasspath +net.bytebuddy:byte-buddy-agent:1.11.13=testCompileClasspath,testRuntimeClasspath +net.bytebuddy:byte-buddy:1.11.13=testCompileClasspath,testRuntimeClasspath +net.javacrumbs.json-unit:json-unit-core:2.28.0=testCompileClasspath,testRuntimeClasspath +net.minidev:accessors-smart:2.4.7=testCompileClasspath,testRuntimeClasspath +net.minidev:json-smart:2.4.7=testCompileClasspath,testRuntimeClasspath +net.sf.jopt-simple:jopt-simple:5.0.4=testCompileClasspath,testRuntimeClasspath +org.apache.commons:commons-lang3:3.12.0=testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents.client5:httpclient5:5.1=testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents.core5:httpcore5-h2:5.1.1=testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents.core5:httpcore5:5.1.1=testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpclient:4.5.13=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpcore:4.4.13=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apiguardian:apiguardian-api:1.1.0=testCompileClasspath,testRuntimeClasspath +org.bouncycastle:bcprov-jdk15on:1.70=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.checkerframework:checker-qual:3.12.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty.http2:http2-common:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty.http2:http2-hpack:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty.http2:http2-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-alpn-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-alpn-java-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-alpn-java-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-alpn-openjdk8-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-alpn-openjdk8-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-alpn-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-bom:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-continuation:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-http:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-io:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-proxy:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-security:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-servlet:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-servlets:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-util-ajax:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-util:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-webapp:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.eclipse.jetty:jetty-xml:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath +org.hamcrest:hamcrest-core:2.2=testCompileClasspath,testRuntimeClasspath +org.hamcrest:hamcrest:2.2=testCompileClasspath,testRuntimeClasspath +org.junit.jupiter:junit-jupiter-api:5.7.2=testCompileClasspath,testRuntimeClasspath +org.junit.jupiter:junit-jupiter-engine:5.7.2=testRuntimeClasspath +org.junit.jupiter:junit-jupiter-params:5.7.2=testCompileClasspath,testRuntimeClasspath +org.junit.jupiter:junit-jupiter:5.7.2=testCompileClasspath,testRuntimeClasspath +org.junit.platform:junit-platform-commons:1.7.2=testCompileClasspath,testRuntimeClasspath +org.junit.platform:junit-platform-engine:1.7.2=testRuntimeClasspath +org.junit:junit-bom:5.7.2=testCompileClasspath,testRuntimeClasspath +org.mockito:mockito-core:3.12.4=testCompileClasspath,testRuntimeClasspath +org.objenesis:objenesis:3.2=testCompileClasspath,testRuntimeClasspath +org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testRuntimeClasspath +org.ow2.asm:asm:9.2=testCompileClasspath,testRuntimeClasspath +org.slf4j:slf4j-api:1.7.32=testCompileClasspath,testRuntimeClasspath +org.xmlunit:xmlunit-core:2.8.3=testCompileClasspath,testRuntimeClasspath +org.xmlunit:xmlunit-legacy:2.8.3=testCompileClasspath,testRuntimeClasspath +org.xmlunit:xmlunit-placeholders:2.8.3=testCompileClasspath,testRuntimeClasspath +empty=annotationProcessor,testAnnotationProcessor From c9524c8565863ca71d828649a72fa498d23e6ce8 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 7 Jul 2026 15:06:58 +0000 Subject: [PATCH 2/2] Bump GitHub Actions to current majors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI on this branch was failing on hard-deprecated action versions (actions/upload-artifact@v2, github/codeql-action/*@v2, checkout@v2). Bump every third-party action in the workflows to its latest major so CI can run — Dependabot's github-actions ecosystem (added in the previous commit) will keep them fresh from here on. - actions/checkout v2/v3 -> v7 - actions/setup-java v3 -> v5 - actions/setup-node v3 -> v6 - actions/upload-artifact v2 -> v7 - github/codeql-action/* v2 -> v4 --- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/release.yml | 6 +++--- .github/workflows/sdk.yml | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a8f7c700..e07b52a0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,11 +38,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v7 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -56,7 +56,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@v4 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -69,6 +69,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5d03642..483dfdd3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,19 +16,19 @@ jobs: GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }} steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@v7 - name: Get tags run: git fetch --tags origin - name: Setup java environment - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'corretto' java-version: '17' - name: Setup Node.js environment - uses: actions/setup-node@v3 + uses: actions/setup-node@v6 - name: Install changeset dependencies run: npm install diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml index 04ff794d..b760b26d 100644 --- a/.github/workflows/sdk.yml +++ b/.github/workflows/sdk.yml @@ -18,9 +18,9 @@ jobs: EV_CAGE_RUN_HOST: run.evervault.com EV_RELAY_HOST: strict.relay.evervault.com steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 - name: Set up JDK ${{ matrix.java-version }} with ${{ matrix.distribution }} - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'corretto' java-version: ${{ matrix.java-version }} @@ -31,7 +31,7 @@ jobs: TEST_EV_API_KEY: ${{ secrets.TEST_EV_API_KEY }} - name: Upload unit test report on failure if: ${{ failure() }} - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v7 with: name: failed_unit_tests path: ${{ github.workspace }}/lib/build/reports/tests/test \ No newline at end of file