Fixes for CVE-2024-57699 CVE-2025-25193 CVE-2025-24970

Author: mateuszkp96

core/build.gradle

@@ -125,11 +125,11 @@ dependencies {
     testImplementation  group: 'com.dimafeng',               name: 'testcontainers-scala-core_3',     version: '0.41.4'
 
     constraints {
-        api group: 'io.netty',              name: 'netty-codec-http2',                  version: '4.1.115.Final'
-        api group: 'io.netty',              name: 'netty-handler-proxy',                version: '4.1.115.Final'
-        api group: 'io.netty',              name: 'netty-transport-native-unix-common', version: '4.1.115.Final'
-        api group: 'io.netty',              name: 'netty-transport-native-epoll',       version: '4.1.115.Final'
-        api group: 'io.netty',              name: 'netty-transport-native-kqueue',      version: '4.1.115.Final'
+        api group: 'io.netty',              name: 'netty-codec-http2',                  version: '4.1.118.Final'
+        api group: 'io.netty',              name: 'netty-handler-proxy',                version: '4.1.118.Final'
+        api group: 'io.netty',              name: 'netty-transport-native-unix-common', version: '4.1.118.Final'
+        api group: 'io.netty',              name: 'netty-transport-native-epoll',       version: '4.1.118.Final'
+        api group: 'io.netty',              name: 'netty-transport-native-kqueue',      version: '4.1.118.Final'
         api group: 'com.google.guava',      name: 'guava',                              version: '32.0.1-jre'
         api group: 'io.spray',              name: 'spray-json_3',                       version: '1.3.6'
         api group: 'org.asynchttpclient',   name: 'async-http-client',                  version: '3.0.1'

gradle.properties

@@ -1,5 +1,5 @@
 publishedPluginVersion=1.62.0
-pluginVersion=1.63.0-pre2
+pluginVersion=1.63.0-pre3
 pluginName=readonlyrest
 
 org.gradle.jvmargs=-Xmx6144m

ror-shadowed-libs/build.gradle

@@ -57,6 +57,8 @@ dependencies {
     shadowCompile group: 'com.fasterxml.jackson.core',            name: 'jackson-databind',                       version: '2.13.5'
     shadowCompile group: 'org.yaml',                              name: 'snakeyaml',                              version: '2.2'
     shadowCompile group: 'com.jayway.jsonpath',                   name: 'json-path',                              version: '2.9.0'
+    //It's a transitive dependency for json-path, listed here to fix CVE. It can be removed after json-path update
+    shadowCompile group: 'net.minidev',                           name: 'json-smart',                             version: '2.5.2'
 }
 
 shadowJar {