MOSIP-44772: SECURITY: update vulnerable libraries

[exalate-issue-sync]

https://mosip.atlassian.net/wiki/spaces/NFR/pages/2506555475/esignet

[exalate-issue-sync]

Jira Assignee: Rachik Sharma (no valid GitHub user found)

[Md-Humair-KK]

The vulnerability run is done on master branch can we please re run this on release branches, as I cannot run this because of the access denied from Infosys side for forked repos.

[Md-Humair-KK]

Not updating:

1. org.springframework.boot:spring-boot-starter-data-redis@3.4.11 -> org.springframework.boot:spring-boot-starter-data-redis@4.0.0 MAJOR UPGRADE
2. org.springframework.boot:spring-boot-starter-actuator -> CloudFoundry Actuator path is not supported by esignet

[Md-Humair-KK]

based on new reports:

snyk.zip

eSignet — SCA Verified Report issues - Fixed - #2060
eSignet — SAST Verified Report - needs UI fixes.

[Md-Humair-KK]

According to the latest reports there are 3 critical issues in eSignet repo:

1. axios @1.13.5 -> updated to 1.16.0
2. io.netty:netty-handler @4.1.107.Final -> updated to netty-handler ≥ 4.2.15.Final
3. org.springframework.kafka:spring-kafka @3.1.2 -> not changed as we are using spring version of 3.2.3 which has to be changed in order change the kafka dependency version to 3.3.16

PR - #2060

[Md-Humair-KK]

According to the latest reports there are 5 critical issues in Signup repo:

1. axios @1.13.5 -> updated to 1.16.0
2. io.netty:netty-handler @4.1.107.Final -> not changed as we are using spring version of 3.2.3
3. org.springframework.kafka:spring-kafka @3.1.2 -> not changed as we are using spring version of 3.2.3 which has to be changed in order change the kafka dependency version to 3.3.16
4. com.fasterxml.jackson.core:jackson-databind@2.15.0 -> not updated as we are using spring version of 3.2.3 which has to be changed in order change the jackson-databind dependency version to 2.21.4
5. org.bouncycastle:bcpkix-jdk18on@1.78 -> updated to 1.84

PR - mosip/esignet-signup#942

[Md-Humair-KK]

io.netty:netty-handler@4.1.104 - not changed as we are using spring version of 3.2.3

Mock plugin:

1. org.apache.tomcat.embed:tomcat-embed-core@10.1.19 -> not changed as this is transitive dependency io.mosip.kernel:kernel-keymanager-service
2. org.bouncycastle:bcpkix-jdk18on@1.78.1 -> added dependency in respective pom to overide with version 1.80

Mosip plugin:

1. org.springframework.security:spring-security-web@6.2.2 , org.springframework.security:spring-security-crypto
   @6.2.2-> updated to spring-security-web ≥ 6.2.8 by adding a new BOM in pom xml, which is compatible with spring 3.2.2 the 6.5.11 will not be compatible with spring 3.2.2.
2. com.fasterxml.jackson.core:jackson-databind@2.15.0 -> not changed
3. org.bouncycastle:bcpkix-jdk18on@1.78.1 -> added dependency in respective pom to overide with version 1.80

Sunbird:

1. com.fasterxml.jackson.core:jackson-databind@2.15.4 -> not changed
2. commons-collections:commons-collections@3.2.1 -> transitive from velocity:1.7 changed it to velocity-engine-core:2.3
3. org.bouncycastle:bcpkix-jdk18on@1.78.1 -> added dependency in respective pom to overide with version 1.80

org.springframework.boot:spring-boot-autoconfigure@3.2.3 -> since we are using spring 3.2.3 not changed
org.springframework.boot:spring-boot-actuator-autoconfigure@3.2.3 -> since we are using spring 3.2.3 not changed
org.springframework.kafka:spring-kafka@3.1.2 -> since we are using spring 3.2.3 not changed
org.springframework.boot:spring-boot-actuator@3.2.3 -> since we are using spring 3.2.3 not changed

PR - mosip/esignet-plugins#213