Add dependabot config and include lockfiles

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      gradle-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,6 +69,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -16,19 +16,19 @@ jobs:
       GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
 
       - name: Get tags
         run: git fetch --tags origin
 
       - name: Setup java environment
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: 'corretto'
           java-version: '17'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
 
       - name: Install changeset dependencies
         run: npm install

.github/workflows/sdk.yml

@@ -18,9 +18,9 @@ jobs:
       EV_CAGE_RUN_HOST: run.evervault.com
       EV_RELAY_HOST: strict.relay.evervault.com
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
       - name: Set up JDK ${{ matrix.java-version }} with ${{ matrix.distribution }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: 'corretto'
           java-version: ${{ matrix.java-version }}
@@ -31,7 +31,7 @@ jobs:
           TEST_EV_API_KEY: ${{ secrets.TEST_EV_API_KEY }}
       - name: Upload unit test report on failure
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v7
         with:
           name: failed_unit_tests
           path: ${{ github.workspace }}/lib/build/reports/tests/test

build.gradle

@@ -1,9 +1,19 @@
+buildscript {
+    configurations.classpath {
+        resolutionStrategy.activateDependencyLocking()
+    }
+}
+
 plugins {
     id 'io.github.gradle-nexus.publish-plugin' version '1.1.0'
 }
 
 group 'com.evervault'
 
+dependencyLocking {
+    lockAllConfigurations()
+}
+
 def getRepositoryUsername() {
     return hasProperty("ossrhUsername") ? ossrhUsername : ""
 }

buildscript-gradle.lockfile

@@ -0,0 +1,6 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+io.github.gradle-nexus.publish-plugin:io.github.gradle-nexus.publish-plugin.gradle.plugin:1.1.0=classpath
+io.github.gradle-nexus:publish-plugin:1.1.0=classpath
+empty=

lib/build.gradle

@@ -13,6 +13,10 @@ repositories {
     mavenLocal()
 }
 
+dependencyLocking {
+    lockAllConfigurations()
+}
+
 def getKeyFile() {
     return hasProperty("signingKey") ? signingKey : ""
 }
@@ -24,7 +28,7 @@ def getKeyPassword() {
 dependencies {
     testImplementation 'org.junit.jupiter:junit-jupiter:5.7.2'
     testImplementation "com.github.tomakehurst:wiremock-jre8:2.32.0"
-    testImplementation "org.mockito:mockito-core:3.+"
+    testImplementation "org.mockito:mockito-core:3.12.4"
 
     implementation 'com.google.code.gson:gson:2.8.9'
     implementation 'com.google.guava:guava:31.1-android'

lib/gradle.lockfile

@@ -0,0 +1,80 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson.core:jackson-annotations:2.13.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.13.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.13.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.13.0=testCompileClasspath,testRuntimeClasspath
+com.github.jknack:handlebars-helpers:4.3.0=testCompileClasspath,testRuntimeClasspath
+com.github.jknack:handlebars:4.3.0=testCompileClasspath,testRuntimeClasspath
+com.github.tomakehurst:wiremock-jre8:2.32.0=testCompileClasspath,testRuntimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.code.gson:gson:2.8.9=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:failureaccess:1.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:31.1-android=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.j2objc:j2objc-annotations:1.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.jayway.jsonpath:json-path:2.6.0=testCompileClasspath,testRuntimeClasspath
+commons-codec:commons-codec:1.11=compileClasspath,runtimeClasspath
+commons-codec:commons-codec:1.15=testCompileClasspath,testRuntimeClasspath
+commons-fileupload:commons-fileupload:1.4=testCompileClasspath,testRuntimeClasspath
+commons-io:commons-io:2.11.0=testCompileClasspath,testRuntimeClasspath
+commons-logging:commons-logging:1.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.servlet:javax.servlet-api:3.1.0=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.11.13=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.11.13=testCompileClasspath,testRuntimeClasspath
+net.javacrumbs.json-unit:json-unit-core:2.28.0=testCompileClasspath,testRuntimeClasspath
+net.minidev:accessors-smart:2.4.7=testCompileClasspath,testRuntimeClasspath
+net.minidev:json-smart:2.4.7=testCompileClasspath,testRuntimeClasspath
+net.sf.jopt-simple:jopt-simple:5.0.4=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.12.0=testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents.client5:httpclient5:5.1=testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents.core5:httpcore5-h2:5.1.1=testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents.core5:httpcore5:5.1.1=testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents:httpclient:4.5.13=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents:httpcore:4.4.13=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apiguardian:apiguardian-api:1.1.0=testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk15on:1.70=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.12.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.http2:http2-common:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.http2:http2-hpack:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.http2:http2-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-java-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-java-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-openjdk8-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-openjdk8-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-bom:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-client:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-continuation:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-proxy:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlets:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-webapp:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath
+org.hamcrest:hamcrest-core:2.2=testCompileClasspath,testRuntimeClasspath
+org.hamcrest:hamcrest:2.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.7.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.7.2=testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.7.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter:5.7.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.7.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.7.2=testRuntimeClasspath
+org.junit:junit-bom:5.7.2=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:3.12.4=testCompileClasspath,testRuntimeClasspath
+org.objenesis:objenesis:3.2=testCompileClasspath,testRuntimeClasspath
+org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.2=testCompileClasspath,testRuntimeClasspath
+org.slf4j:slf4j-api:1.7.32=testCompileClasspath,testRuntimeClasspath
+org.xmlunit:xmlunit-core:2.8.3=testCompileClasspath,testRuntimeClasspath
+org.xmlunit:xmlunit-legacy:2.8.3=testCompileClasspath,testRuntimeClasspath
+org.xmlunit:xmlunit-placeholders:2.8.3=testCompileClasspath,testRuntimeClasspath
+empty=annotationProcessor,testAnnotationProcessor