From 2d0d0acbd0886c8e83ce92b43ffc76ddf51cadb0 Mon Sep 17 00:00:00 2001
From: Md-Humair-KK <mdhumair.kankudti@gmail.com>
Date: Sat, 4 Jul 2026 22:27:32 +0530
Subject: [PATCH 1/3] vulnerabilities update

Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
---
 mock-plugin/pom.xml           | 13 ++++++++++++-
 mosip-identity-plugin/pom.xml | 24 ++++++++++++++++++++++--
 sunbird-rc-plugin/pom.xml     | 17 ++++++++++++++---
 3 files changed, 48 insertions(+), 6 deletions(-)

diff --git a/mock-plugin/pom.xml b/mock-plugin/pom.xml
index 353c480..43d2d61 100644
--- a/mock-plugin/pom.xml
+++ b/mock-plugin/pom.xml
@@ -66,6 +66,17 @@
 		</repository>
 	</distributionManagement>
 
+	<dependencyManagement>
+		<dependencies>
+			<!-- Override transitive Bouncy Castle version to fix CVEs -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.80</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+
 	<properties>
 		<java.version>21</java.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -85,7 +96,7 @@
 		<spring-cloud.version>2023.0.8</spring-cloud.version>
 		<spring.boot.version>3.2.12</spring.boot.version>
 
-		<kernel-keymanager-service.version>1.3.0-beta.4</kernel-keymanager-service.version>
+		<kernel-keymanager-service.version>1.3.0</kernel-keymanager-service.version>
 		<esignet.version>1.8.1-SNAPSHOT</esignet.version>
 		<esignet-signup.version>1.4.1-SNAPSHOT</esignet-signup.version>
 
diff --git a/mosip-identity-plugin/pom.xml b/mosip-identity-plugin/pom.xml
index 60ad6e2..78c3fdf 100644
--- a/mosip-identity-plugin/pom.xml
+++ b/mosip-identity-plugin/pom.xml
@@ -66,6 +66,26 @@
 		</repository>
 	</distributionManagement>
 
+	<dependencyManagement>
+		<dependencies>
+			<!-- Override transitive spring-security version to fix CVEs -->
+			<!-- Spring Boot 3.2.x is compatible with Spring Security 6.2.x -->
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-bom</artifactId>
+				<version>6.2.8</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<!-- Override transitive Bouncy Castle version to fix CVEs -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.80</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+
 	<properties>
 		<java.version>21</java.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -85,7 +105,7 @@
 		<spring-cloud.version>2023.0.8</spring-cloud.version>
 		<spring.boot.version>3.2.12</spring.boot.version>
 
-		<kernel-keymanager-service.version>1.3.0-beta.4</kernel-keymanager-service.version>
+		<kernel-keymanager-service.version>1.3.0</kernel-keymanager-service.version>
 		<esignet.version>1.8.1-SNAPSHOT</esignet.version>
 		<esignet-signup.version>1.4.1-SNAPSHOT</esignet-signup.version>
 
@@ -116,7 +136,7 @@
 		<dependency>
 			<groupId>io.mosip.biometric.util</groupId>
 			<artifactId>biometrics-util</artifactId>
-			<version>1.3.0-beta.1</version>
+			<version>1.3.0</version>
 			<exclusions>
 				<exclusion>
 					<groupId>com.fasterxml.jackson.core</groupId>
diff --git a/sunbird-rc-plugin/pom.xml b/sunbird-rc-plugin/pom.xml
index fb341c4..ec31f2e 100644
--- a/sunbird-rc-plugin/pom.xml
+++ b/sunbird-rc-plugin/pom.xml
@@ -64,6 +64,17 @@
 		</repository>
 	</distributionManagement>
 
+	<dependencyManagement>
+		<dependencies>
+			<!-- Override transitive Bouncy Castle version to fix CVEs -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.80</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<java.version>21</java.version>
@@ -85,7 +96,7 @@
 		<sonar.exclusions>**/dto/**,**/entity/**,**/exception/**,**/spi/**,**/advice/**,**/config/**</sonar.exclusions>
 		<sonar.cpd.exclusions>**/dto/**,**/entity/**,**/config/**</sonar.cpd.exclusions>
 		<sonar.coverage.exclusions>**/dto/**,**/entity/**,**/exception/**,**/spi/**,**/advice/**,**/config/**</sonar.coverage.exclusions>
-		<kernel-keymanager-service.version>1.3.0-beta.4</kernel-keymanager-service.version>
+		<kernel-keymanager-service.version>1.3.0</kernel-keymanager-service.version>
 	</properties>
 	<dependencies>
 	
@@ -140,8 +151,8 @@
 		<!-- https://mvnrepository.com/artifact/org.apache.velocity/velocity -->
 		<dependency>
 			<groupId>org.apache.velocity</groupId>
-			<artifactId>velocity</artifactId>
-			<version>1.7</version>
+			<artifactId>velocity-engine-core</artifactId>
+			<version>2.3</version>
 		</dependency>
 
 		<dependency>

From 7c765045db6cb9afb5152eb0e4c5a2dc94d1baa0 Mon Sep 17 00:00:00 2001
From: Md-Humair-KK <mdhumair.kankudti@gmail.com>
Date: Mon, 6 Jul 2026 10:57:01 +0530
Subject: [PATCH 2/3] updated pom

Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
---
 mosip-identity-plugin/pom.xml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/mosip-identity-plugin/pom.xml b/mosip-identity-plugin/pom.xml
index 78c3fdf..87a4279 100644
--- a/mosip-identity-plugin/pom.xml
+++ b/mosip-identity-plugin/pom.xml
@@ -53,6 +53,17 @@
 				<enabled>false</enabled>
 			</snapshots>
 		</repository>
+        <repository>
+            <id>gcs-maven-central-mirror</id>
+            <name>GCS Maven Central mirror</name>
+            <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
+            <releases>
+                <enabled>true</enabled>
+            </releases>
+            <snapshots>
+                <enabled>false</enabled>
+            </snapshots>
+        </repository>
 	</repositories>
 
 	<distributionManagement>
@@ -77,7 +88,17 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
-			<!-- Override transitive Bouncy Castle version to fix CVEs -->
+			<!-- Override transitive Bouncy Castle versions to keep the set aligned -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.80</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.80</version>
+			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcpkix-jdk18on</artifactId>

From 56ee4aa45d88e266c250df8d206fd66b0a90e968 Mon Sep 17 00:00:00 2001
From: Md-Humair-KK <mdhumair.kankudti@gmail.com>
Date: Thu, 9 Jul 2026 11:33:50 +0530
Subject: [PATCH 3/3] removed mirror

Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
---
 mosip-identity-plugin/pom.xml | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/mosip-identity-plugin/pom.xml b/mosip-identity-plugin/pom.xml
index 87a4279..85c6e65 100644
--- a/mosip-identity-plugin/pom.xml
+++ b/mosip-identity-plugin/pom.xml
@@ -53,17 +53,6 @@
 				<enabled>false</enabled>
 			</snapshots>
 		</repository>
-        <repository>
-            <id>gcs-maven-central-mirror</id>
-            <name>GCS Maven Central mirror</name>
-            <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-            <releases>
-                <enabled>true</enabled>
-            </releases>
-            <snapshots>
-                <enabled>false</enabled>
-            </snapshots>
-        </repository>
 	</repositories>
 
 	<distributionManagement>