Update dependencies #3307

build.gradle

@@ -544,6 +544,7 @@ configure(coreTestsModule) {
         compile(coreModule)
 
         compile(bom['org.apache.commons:commons-dbcp2'])
+        compile(bom['junit:junit'])
         compile(bom['org.junit.jupiter:junit-jupiter-api'])
         compile(bom['org.junit.jupiter:junit-jupiter-engine'])
         compile(bom['org.junit.vintage:junit-vintage-engine'])
@@ -581,6 +582,7 @@ configure(clientTestsModule) {
         compile(clientModule)
 
         compile(bom['org.jmockit:jmockit'])
+        compile(bom['junit:junit'])
         compile(bom['org.junit.jupiter:junit-jupiter-api'])
         compile(bom['org.junit.jupiter:junit-jupiter-engine'])
         compile(bom['org.junit.vintage:junit-vintage-engine'])
@@ -648,6 +650,8 @@ configure(webWidgetsModule) {
         }
         compile(bom['com.vaadin:vaadin-push'])
 
+        compile(bom['org.jsoup:jsoup'])
+
         /* Vaadin addons */
         /* The following add-ons are embedded into Platform
             com.vaadin:vaadin-context-menu:2.1.0
@@ -862,7 +866,16 @@ configure(webToolkitModule) {
         compile(bom['com.vaadin:vaadin-compatibility-client'])
 
         // for code server only
-        compile('org.eclipse.jetty:jetty-server:9.2.27.v20190403')
+        compile(bom['org.eclipse.jetty:jetty-server'])
+        compile(bom['org.eclipse.jetty:jetty-webapp'])
+        compile(bom['org.eclipse.jetty.websocket:websocket-client'])
+        compile(bom['org.eclipse.jetty:jetty-servlets'])
+        compile(bom['org.eclipse.jetty:jetty-annotations'])
+        compile(bom['org.eclipse.jetty:apache-jsp'])
+        compile(bom['org.eclipse.jetty:jetty-client'])
+
+        compile(bom['net.sourceforge.htmlunit:htmlunit'])
+        compile(bom['com.ibm.icu:icu4j'])
 
         runtime(bom['javax.servlet:javax.servlet-api'])
     }
@@ -981,9 +994,15 @@ configure(portalModule) {
 
         compile(bom['org.json:json'])
 
-        compile(bom['org.thymeleaf:thymeleaf'])
-        compile(bom['org.thymeleaf:thymeleaf-spring5'])
-        compile(bom['org.thymeleaf.extras:thymeleaf-extras-springsecurity5'])
+        compile(bom['org.thymeleaf:thymeleaf']) {
+            exclude(group: 'org.slf4j', module: 'slf4j-api')
+        }
+        compile(bom['org.thymeleaf:thymeleaf-spring5']) {
+            exclude(group: 'org.slf4j', module: 'slf4j-api')
+        }
+        compile(bom['org.thymeleaf.extras:thymeleaf-extras-springsecurity5']) {
+            exclude(group: 'org.slf4j', module: 'slf4j-api')
+        }
 
         compileOnly(bom['javax.servlet:javax.servlet-api'])
 

modules/core/src/com/haulmont/cuba/core/app/FoldersServiceBean.java

@@ -34,7 +34,6 @@
 import com.thoughtworks.xstream.XStream;
 import groovy.lang.Binding;
 import org.apache.commons.collections4.CollectionUtils;
-import org.apache.commons.compress.archivers.ArchiveEntry;
 import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
 import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
 import org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;
@@ -247,7 +246,7 @@ public byte[] exportFolder(Folder folder) throws IOException {
         zipOutputStream.setEncoding(StandardCharsets.UTF_8.name());
         String xml = createXStream().toXML(folder);
         byte[] xmlBytes = xml.getBytes(StandardCharsets.UTF_8);
-        ArchiveEntry zipEntryDesign = newStoredEntry("folder.xml", xmlBytes);
+        ZipArchiveEntry zipEntryDesign = newStoredEntry("folder.xml", xmlBytes);
         zipOutputStream.putArchiveEntry(zipEntryDesign);
         zipOutputStream.write(xmlBytes);
         try {
@@ -369,7 +368,7 @@ protected XStream createXStream() {
         return xStream;
     }
 
-    protected ArchiveEntry newStoredEntry(String name, byte[] data) {
+    protected ZipArchiveEntry newStoredEntry(String name, byte[] data) {
         ZipArchiveEntry zipEntry = new ZipArchiveEntry(name);
         zipEntry.setSize(data.length);
         zipEntry.setCompressedSize(zipEntry.getSize());

modules/core/src/com/haulmont/cuba/core/app/importexport/EntityImportExport.java

@@ -33,7 +33,6 @@
 import com.haulmont.cuba.core.global.*;
 import com.haulmont.cuba.core.global.validation.CustomValidationException;
 import com.haulmont.cuba.core.global.validation.groups.RestApiChecks;
-import org.apache.commons.compress.archivers.ArchiveEntry;
 import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
 import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
 import org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;
@@ -102,7 +101,7 @@ public byte[] exportEntitiesToZIP(Collection<? extends Entity> entities) {
         ZipArchiveOutputStream zipOutputStream = new ZipArchiveOutputStream(byteArrayOutputStream);
         zipOutputStream.setMethod(ZipArchiveOutputStream.STORED);
         zipOutputStream.setEncoding(StandardCharsets.UTF_8.name());
-        ArchiveEntry singleDesignEntry = newStoredEntry("entities.json", jsonBytes);
+        ZipArchiveEntry singleDesignEntry = newStoredEntry("entities.json", jsonBytes);
         try {
             zipOutputStream.putArchiveEntry(singleDesignEntry);
             zipOutputStream.write(jsonBytes);
@@ -141,7 +140,7 @@ protected Collection<? extends Entity> reloadEntities(Collection<? extends Entit
         return dataManager.loadList(ctx);
     }
 
-    protected ArchiveEntry newStoredEntry(String name, byte[] data) {
+    protected ZipArchiveEntry newStoredEntry(String name, byte[] data) {
         ZipArchiveEntry zipEntry = new ZipArchiveEntry(name);
         zipEntry.setSize(data.length);
         zipEntry.setCompressedSize(zipEntry.getSize());

modules/global/src/com/haulmont/cuba/bom.properties

@@ -17,81 +17,81 @@
 javax.servlet/javax.servlet-api = 3.1.0
 
 # for compatibility only
-org.apache.tomcat/tomcat-servlet-api = 9.0.27
+org.apache.tomcat/tomcat-servlet-api = 9.0.97
 
-org.postgresql/postgresql = 42.2.8
-org.hsqldb/hsqldb = 2.5.0
+org.postgresql/postgresql = 42.7.4
+org.hsqldb/hsqldb = 2.5.2
 com.microsoft.sqlserver/mssql-jdbc = 7.2.2.jre8
-mysql/mysql-connector-java = 8.0.17
-
-org.apache.commons/commons-lang3 = 3.9
-org.apache.commons/commons-text = 1.10.0
-commons-io/commons-io = 2.6
-commons-cli/commons-cli = 1.4
-commons-codec/commons-codec = 1.13
-commons-fileupload/commons-fileupload = 1.4
-
-org.apache.httpcomponents/httpclient = 4.5.10
-org.apache.httpcomponents/httpmime = 4.5.8
-org.apache.httpcomponents/httpcore = 4.4.11
-org.apache.httpcomponents/fluent-hc = 4.5.8
+mysql/mysql-connector-java = 8.0.33
+
+org.apache.commons/commons-lang3 = 3.17.0
+org.apache.commons/commons-text = 1.12.0
+commons-io/commons-io = 2.18.0
+commons-cli/commons-cli = 1.9.0
+commons-codec/commons-codec = 1.17.1
+commons-fileupload/commons-fileupload = 1.5
+
+org.apache.httpcomponents/httpclient = 4.5.14
+org.apache.httpcomponents/httpmime = 4.5.14
+org.apache.httpcomponents/httpcore = 4.4.16
+org.apache.httpcomponents/fluent-hc = 4.5.14
 org.apache.commons/commons-pool2 = 2.7.0
 org.apache.commons/commons-dbcp2 = 2.7.0
-org.apache.commons/commons-compress = 1.21
+org.apache.commons/commons-compress = 1.27.1
 org.apache.commons/commons-collections4 = 4.4
 
-org.eclipse.persistence/org.eclipse.persistence.jpa=2.7.3-19-cuba
+org.eclipse.persistence/org.eclipse.persistence.jpa=2.7.3-21-cuba
 org.eclipse.persistence/org.eclipse.persistence.oracle=2.7.3
 
-com.thoughtworks.xstream/xstream = 1.4.17
+com.thoughtworks.xstream/xstream = 1.4.21
 com.haulmont.thirdparty/glazedlists = 1.9.20110801
 com.haulmont.thirdparty/swingx-core = 1.6.5-1.cuba.0
-org.apache.poi/poi = 4.1.1
-org.apache.poi/poi-ooxml = 4.1.1
+org.apache.poi/poi = 4.1.2
+org.apache.poi/poi-ooxml = 4.1.2
 
-com.esotericsoftware/kryo-shaded = 4.0.2
+com.esotericsoftware/kryo-shaded = 4.0.3
 de.javakaffee/kryo-serializers = 0.45
 
-org.dom4j/dom4j = 2.1.3
+org.dom4j/dom4j = 2.1.4
 xml-apis/xml-apis = 1.4.01
 javax.activation/activation = 1.1.1
-org.freemarker/freemarker = 2.3.29
-org.jsoup/jsoup = 1.12.1
-com.google.code.gson/gson = 2.8.6
+org.freemarker/freemarker = 2.3.33
+org.jsoup/jsoup = 1.18.2
+com.google.code.gson/gson = 2.8.9
 
-org.codehaus.groovy = 2.5.14
+org.codehaus.groovy = 2.5.23
 org.codehaus.groovy/groovy = ${org.codehaus.groovy}
 org.codehaus.groovy/groovy-sql = ${org.codehaus.groovy}
 org.codehaus.groovy/groovy-templates = ${org.codehaus.groovy}
 org.codehaus.groovy/groovy-json = ${org.codehaus.groovy}
 
-ch.qos.logback/logback-classic = 1.2.3
-org.slf4j/slf4j-api = 1.7.29
-org.slf4j/log4j-over-slf4j = 1.7.29
-org.json/json = 20180130
+ch.qos.logback/logback-classic = 1.2.13
+org.slf4j/slf4j-api = 1.7.36
+org.slf4j/log4j-over-slf4j = 1.7.36
+org.json/json = 20240303
 com.sun.mail/javax.mail = 1.6.2
 org.perf4j/perf4j = 0.9.16
 com.google.code.findbugs/jsr305 = 3.0.2
 javax.inject/javax.inject = 1
 javax.annotation/javax.annotation-api = 1.3.2
 antlr/antlr = 2.7.7
-org.antlr/antlr-runtime = 3.5.2
-com.google.guava/guava = 30.1.1-jre
-org.jgroups/jgroups = 4.1.8.Final
-org.aspectj/aspectjrt = 1.9.4
-org.aspectj/aspectjweaver = 1.9.4
-org.jmockit/jmockit = 1.48
+org.antlr/antlr-runtime = 3.5.3
+com.google.guava/guava = 33.3.1-jre
+org.jgroups/jgroups = 4.1.10.Final
+org.aspectj/aspectjrt = 1.9.22.1
+org.aspectj/aspectjweaver = 1.9.22.1
+org.jmockit/jmockit = 1.49
 junit/junit = 4.13.2
 org.junit.jupiter/junit-jupiter-api = 5.5.2
 org.junit.vintage/junit-vintage-engine = 5.5.2
 org.junit.jupiter/junit-jupiter-engine = 5.5.2
 org.spockframework/spock-core = 1.3-groovy-2.5
-com.jayway.jsonpath/json-path = 2.4.0
+com.jayway.jsonpath/json-path = 2.9.0
 com.miglayout/miglayout-swing = 4.2
-com.fifesoft/rsyntaxtextarea = 2.5.6
-org.javassist/javassist = 3.24.0-GA
+com.fifesoft/rsyntaxtextarea = 2.5.8
+org.javassist/javassist = 3.30.2-GA
 
-org.hibernate.validator/hibernate-validator = 6.1.5.Final
+org.hibernate.validator/hibernate-validator = 6.2.5.Final
 org.glassfish/jakarta.el = 3.0.4
 
 com.vaadin = 8.14.3-1-cuba
@@ -104,7 +104,7 @@ com.vaadin/vaadin-push = ${com.vaadin}
 com.vaadin/vaadin-compatibility-server = ${com.vaadin}
 com.vaadin/vaadin-compatibility-client = ${com.vaadin}
 
-org.springframework = 5.3.23
+org.springframework = 5.3.39
 org.springframework/spring-core = ${org.springframework}
 org.springframework/spring-beans = ${org.springframework}
 org.springframework/spring-context = ${org.springframework}
@@ -115,38 +115,50 @@ org.springframework/spring-tx = ${org.springframework}
 org.springframework/spring-webmvc = ${org.springframework}
 org.springframework/spring-jdbc = ${org.springframework}
 
-org.springframework.security = 5.5.8
+org.springframework.security = 5.7.14
 org.springframework.security/spring-security-core = ${org.springframework.security}
 org.springframework.security/spring-security-web = ${org.springframework.security}
 org.springframework.security/spring-security-config = ${org.springframework.security}
 org.springframework.security/spring-security-taglibs = ${org.springframework.security}
 
 org.springframework.ldap/spring-ldap-core = 2.3.8.RELEASE
 
-org.thymeleaf = 3.0.15.RELEASE
+org.thymeleaf = 3.1.3.RELEASE
 org.thymeleaf/thymeleaf = ${org.thymeleaf}
 org.thymeleaf/thymeleaf-spring5 = ${org.thymeleaf}
-org.thymeleaf.extras/thymeleaf-extras-springsecurity5 = 3.0.4.RELEASE
+org.thymeleaf.extras/thymeleaf-extras-springsecurity5 = 3.1.3.RELEASE
 
-com.fasterxml.jackson = 2.10.5
-com.fasterxml.jackson-databind = 2.10.5.1
-com.fasterxml.jackson.core/jackson-databind = ${com.fasterxml.jackson-databind}
+com.fasterxml.jackson = 2.18.2
+com.fasterxml.jackson.core/jackson-databind = ${com.fasterxml.jackson}
 com.fasterxml.jackson.dataformat/jackson-dataformat-yaml = ${com.fasterxml.jackson}
+com.fasterxml.jackson.dataformat/jackson-dataformat-xml = ${com.fasterxml.jackson}
 com.fasterxml.jackson.core/jackson-annotations = ${com.fasterxml.jackson}
 
-org.webjars/jquery = 3.3.1
-org.webjars/jquery-ui = 1.13.0
+org.webjars/jquery = 3.7.1
+org.webjars/jquery-ui = 1.13.3
 org.webjars.bower/jquery-file-upload = 9.22.0.cuba.0
 org.webjars.npm/object-fit-images = 3.2.3
 org.webjars/ace-builds = 1.1.9-1-cuba
 org.webjars/diff-match-patch = 0.1.cuba.1
 
+org.eclipse.jetty = 9.4.56.v20240826
+org.eclipse.jetty/jetty-webapp = ${org.eclipse.jetty}
+org.eclipse.jetty/jetty-server = ${org.eclipse.jetty}
+org.eclipse.jetty/jetty-servlets = ${org.eclipse.jetty}
+org.eclipse.jetty/jetty-annotations = ${org.eclipse.jetty}
+org.eclipse.jetty/apache-jsp = ${org.eclipse.jetty}
+org.eclipse.jetty/jetty-client = ${org.eclipse.jetty}
+org.eclipse.jetty.websocket/websocket-client = ${org.eclipse.jetty}
+
+net.sourceforge.htmlunit/htmlunit = 2.70.0
+com.ibm.icu/icu4j = 76.1
+
 com.haulmont.cuba-resources/cuba-png-icons = 1.0.1
 
 org.mindrot/jbcrypt = 0.4
 
-com.zaxxer/HikariCP = 3.4.1
+com.zaxxer/HikariCP = 3.4.5
 
-com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer = 20211018.1
+com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer = 20240325.1
 
 com.querydsl/querydsl-jpa = 4.1.4

modules/global/src/com/haulmont/cuba/core/sys/logging/LogArchiver.java

@@ -17,7 +17,6 @@
 
 package com.haulmont.cuba.core.sys.logging;
 
-import org.apache.commons.compress.archivers.ArchiveEntry;
 import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
 import org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;
 import org.apache.commons.io.FileUtils;
@@ -47,7 +46,7 @@ public static void writeArchivedLogTailToStream(File logFile, OutputStream outpu
 
         byte[] content = getTailBytes(logFile);
 
-        ArchiveEntry archiveEntry = newTailArchive(logFile.getName(), content);
+        ZipArchiveEntry archiveEntry = newTailArchive(logFile.getName(), content);
         zipOutputStream.putArchiveEntry(archiveEntry);
         zipOutputStream.write(content);
 
@@ -66,7 +65,7 @@ public static void writeArchivedLogToStream(File logFile, OutputStream outputStr
         zipOutputStream.setMethod(ZipArchiveOutputStream.DEFLATED);
         zipOutputStream.setEncoding(ZIP_ENCODING);
 
-        ArchiveEntry archiveEntry = newArchive(logFile);
+        ZipArchiveEntry archiveEntry = newArchive(logFile);
         zipOutputStream.putArchiveEntry(archiveEntry);
 
         FileInputStream logFileInput = new FileInputStream(logFile);
@@ -111,7 +110,7 @@ private static byte[] getTailBytes(File logFile) throws FileNotFoundException {
         return buf;
     }
 
-    private static ArchiveEntry newTailArchive(String name, byte[] tail) {
+    private static ZipArchiveEntry newTailArchive(String name, byte[] tail) {
         ZipArchiveEntry zipEntry = new ZipArchiveEntry(name);
         zipEntry.setSize(tail.length);
         zipEntry.setCompressedSize(zipEntry.getSize());
@@ -121,7 +120,7 @@ private static ArchiveEntry newTailArchive(String name, byte[] tail) {
         return zipEntry;
     }
 
-    private static ArchiveEntry newArchive(File file) throws IOException {
+    private static ZipArchiveEntry newArchive(File file) throws IOException {
         ZipArchiveEntry zipEntry = new ZipArchiveEntry(file.getName());
         zipEntry.setSize(file.length());
         zipEntry.setCompressedSize(zipEntry.getSize());