From b0809bef1c006a8795afbba514b6b84157ead304 Mon Sep 17 00:00:00 2001
From: YevhenBondarenko <ybondarenko@thingsboard.io>
Date: Mon, 2 Dec 2024 18:18:56 +0100
Subject: [PATCH 1/2] updated versions due to vulnerabilities fix

---
 pom.xml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/pom.xml b/pom.xml
index a1d5f26ecf..c03465ba07 100755
--- a/pom.xml
+++ b/pom.xml
@@ -42,13 +42,13 @@
         <jakarta.xml.bind-api.version>4.0.2</jakarta.xml.bind-api.version>
         <javax.xml.bind-api.version>2.4.0-b180830.0359</javax.xml.bind-api.version>
         <jaxb-runtime.version>4.0.5</jaxb-runtime.version>
-        <spring-boot.version>3.2.4</spring-boot.version>
-        <spring-data.version>3.2.5</spring-data.version>
-        <spring-data-redis.version>3.2.5</spring-data-redis.version>
-        <spring.version>6.1.6</spring.version>
-        <spring-redis.version>6.2.4</spring-redis.version>
-        <spring-security.version>6.2.4</spring-security.version>
-        <jedis.version>5.1.2</jedis.version>
+        <spring-boot.version>3.2.12</spring-boot.version>
+        <spring-data.version>3.2.12</spring-data.version>
+        <spring-data-redis.version>3.2.12</spring-data-redis.version>
+        <spring.version>6.1.15</spring.version>
+        <spring-redis.version>6.2.11</spring-redis.version>
+        <spring-security.version>6.2.8</spring-security.version>
+        <jedis.version>5.1.5</jedis.version>
         <jjwt.version>0.12.5</jjwt.version>
         <slf4j.version>2.0.13</slf4j.version>
         <log4j.version>2.23.1</log4j.version>
@@ -81,13 +81,13 @@
         <mail.version>2.0.1</mail.version>
         <curator.version>5.6.0</curator.version>
         <zookeeper.version>3.9.2</zookeeper.version>
-        <protobuf.version>3.25.3</protobuf.version> <!-- A Major v4 does not support by the pubsub yet-->
+        <protobuf.version>3.25.5</protobuf.version> <!-- A Major v4 does not support by the pubsub yet-->
         <grpc.version>1.63.0</grpc.version>
         <tbel.version>1.2.4</tbel.version>
         <lombok.version>1.18.32</lombok.version>
         <paho.client.version>1.2.5</paho.client.version>
         <paho.mqttv5.client.version>1.2.5</paho.mqttv5.client.version>
-        <netty.version>4.1.109.Final</netty.version>
+        <netty.version>4.1.115.Final</netty.version>
         <netty-tcnative.version>2.0.65.Final</netty-tcnative.version>
         <reactor-netty.version>1.1.18</reactor-netty.version>
         <os-maven-plugin.version>1.7.1</os-maven-plugin.version>
@@ -110,7 +110,7 @@
         <!-- IMPORTANT: If you change the version of the kafka client, make sure to synchronize our overwritten implementation of the
         org.apache.kafka.common.network.NetworkReceive class in the application module. It addresses the issue https://issues.apache.org/jira/browse/KAFKA-4090.
         Here is the source to track https://github.com/apache/kafka/tree/trunk/clients/src/main/java/org/apache/kafka/common/network -->
-        <kafka.version>3.7.0</kafka.version>
+        <kafka.version>3.7.1</kafka.version>
         <bucket4j.version>8.10.1</bucket4j.version>
         <antlr.version>3.5.3</antlr.version>
         <snakeyaml.version>2.2</snakeyaml.version>
@@ -122,7 +122,7 @@
         <ua-parser.version>1.6.1</ua-parser.version>
         <commons-beanutils.version>1.9.4</commons-beanutils.version>
         <commons-collections.version>4.4</commons-collections.version>
-        <micrometer.version>1.12.5</micrometer.version>
+        <micrometer.version>1.12.12</micrometer.version>
         <protobuf-dynamic.version>1.0.4TB</protobuf-dynamic.version>
         <wire-schema.version>3.7.1</wire-schema.version>
         <twilio.version>10.1.3</twilio.version>
@@ -137,7 +137,7 @@
         <awaitility.version>4.2.1</awaitility.version>
         <dbunit.version>2.7.3</dbunit.version>
         <java-websocket.version>1.5.6</java-websocket.version>
-        <jupiter.version>5.10.2</jupiter.version> <!-- keep the same version as spring-boot-starter-test depend on jupiter-->
+        <jupiter.version>5.10.5</jupiter.version> <!-- keep the same version as spring-boot-starter-test depend on jupiter-->
         <mock-server.version>5.15.0</mock-server.version>
         <spring-test-dbunit.version>1.3.0</spring-test-dbunit.version> <!-- 2016 -->
         <takari-cpsuite.version>1.2.7</takari-cpsuite.version> <!-- 2015 -->
@@ -147,7 +147,7 @@
         <assertj.version>3.25.3</assertj.version>
         <rest-assured.version>5.4.0</rest-assured.version>
         <hamcrest.version>2.2</hamcrest.version>
-        <testcontainers.version>1.19.7</testcontainers.version>
+        <testcontainers.version>1.20.4</testcontainers.version>
         <testcontainers-junit4-mock.version>1.0.1</testcontainers-junit4-mock.version>
         <zeroturnaround.version>1.12</zeroturnaround.version>
         <selenium.version>4.19.1</selenium.version>

From 2dddc1da1971608954381f8329891efca80c01aa Mon Sep 17 00:00:00 2001
From: YevhenBondarenko <ybondarenko@thingsboard.io>
Date: Tue, 3 Dec 2024 17:26:53 +0100
Subject: [PATCH 2/2] updated bouncycastle version

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index c03465ba07..8dc3e1c40a 100755
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@
         <swagger-annotations.version>2.2.21</swagger-annotations.version>
         <spatial4j.version>0.8</spatial4j.version>
         <jts.version>1.19.0</jts.version>
-        <bouncycastle.version>1.78</bouncycastle.version>
+        <bouncycastle.version>1.78.1</bouncycastle.version>
         <winsw.version>2.0.1</winsw.version>
         <postgresql.driver.version>42.7.3</postgresql.driver.version>
         <sonar.exclusions>org/thingsboard/server/gen/**/*,