From 3cf747f8f5e390bbe383ca2778ebf21aa342251b Mon Sep 17 00:00:00 2001
From: simonredfern <simon@tesobe.com>
Date: Tue, 12 May 2026 11:55:12 +0200
Subject: [PATCH 1/5] pom.xml bump org.owasp and introduced explicit protobuf
 version

---
 obp-api/pom.xml     | 7 +++++++
 obp-commons/pom.xml | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/obp-api/pom.xml b/obp-api/pom.xml
index e388029711..ce29b35661 100644
--- a/obp-api/pom.xml
+++ b/obp-api/pom.xml
@@ -105,6 +105,13 @@
       <artifactId>mysql-connector-j</artifactId>
       <version>8.0.33</version>
     </dependency>
+    <!-- Pin protobuf-java to override the 3.21.9 pulled in transitively by mysql-connector-j.
+         Fixes CVE-2024-7254 and CVE-2026-0994. -->
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java</artifactId>
+      <version>3.25.5</version>
+    </dependency>
 
     <dependency>
       <groupId>junit</groupId>
diff --git a/obp-commons/pom.xml b/obp-commons/pom.xml
index bd0b365cb1..d69346a214 100644
--- a/obp-commons/pom.xml
+++ b/obp-commons/pom.xml
@@ -204,7 +204,7 @@
                     <plugin>
                         <groupId>org.owasp</groupId>
                         <artifactId>dependency-check-maven</artifactId>
-                        <version>8.4.3</version>
+                        <version>12.1.0</version>
                         <configuration>
                             <!-- Use NVD API 2.0 key from environment -->
                             <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>

From ecdde4188c04f6d4dd28908f01e8cba9bb4f9e0c Mon Sep 17 00:00:00 2001
From: simonredfern <simon@tesobe.com>
Date: Tue, 12 May 2026 12:00:21 +0200
Subject: [PATCH 2/5] pom.xml explicit version of snappy-java

---
 obp-api/pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/obp-api/pom.xml b/obp-api/pom.xml
index ce29b35661..8e451d0b84 100644
--- a/obp-api/pom.xml
+++ b/obp-api/pom.xml
@@ -112,6 +112,13 @@
       <artifactId>protobuf-java</artifactId>
       <version>3.25.5</version>
     </dependency>
+    <!-- Pin snappy-java to override the 1.1.1.3 pulled in transitively by avro 1.8.2.
+         Fixes CVE-2023-34453, CVE-2023-34454, CVE-2023-34455, CVE-2023-43642. -->
+    <dependency>
+      <groupId>org.xerial.snappy</groupId>
+      <artifactId>snappy-java</artifactId>
+      <version>1.1.10.4</version>
+    </dependency>
 
     <dependency>
       <groupId>junit</groupId>

From 324eb0157a3ea68d0645fd79759862a16d820249 Mon Sep 17 00:00:00 2001
From: simonredfern <simon@tesobe.com>
Date: Tue, 12 May 2026 12:07:13 +0200
Subject: [PATCH 3/5] pom.xml bummping postgresql

---
 obp-api/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/obp-api/pom.xml b/obp-api/pom.xml
index 8e451d0b84..5cc7ed82d7 100644
--- a/obp-api/pom.xml
+++ b/obp-api/pom.xml
@@ -82,7 +82,7 @@
     <dependency>
       <groupId>org.postgresql</groupId>
       <artifactId>postgresql</artifactId>
-      <version>42.7.3</version>
+      <version>42.7.7</version>
     </dependency>
     <!-- https://mvnrepository.com/artifact/com.oracle.database.jdbc/ojdbc8-production -->
     <dependency>

From 7fa7db30bdbe1c12d68b09fb9d4f91eed7c87a6f Mon Sep 17 00:00:00 2001
From: simonredfern <simon@tesobe.com>
Date: Tue, 12 May 2026 12:30:06 +0200
Subject: [PATCH 4/5] pom.xml bumped commons-lang3

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 48f71c4989..5ac5a44dad 100644
--- a/pom.xml
+++ b/pom.xml
@@ -87,7 +87,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.14.0</version>
+        <version>3.18.0</version>
       </dependency>
       <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-text -->
       <dependency>

From 0eb1101e6f9c9213cf16c1d512f24e7a912796f7 Mon Sep 17 00:00:00 2001
From: simonredfern <simon@tesobe.com>
Date: Tue, 12 May 2026 13:12:37 +0200
Subject: [PATCH 5/5] pom.xml bump commons-beanutils

---
 obp-api/pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/obp-api/pom.xml b/obp-api/pom.xml
index 5cc7ed82d7..c5ef98268a 100644
--- a/obp-api/pom.xml
+++ b/obp-api/pom.xml
@@ -119,6 +119,13 @@
       <artifactId>snappy-java</artifactId>
       <version>1.1.10.4</version>
     </dependency>
+    <!-- Pin commons-beanutils to override the 1.9.2 pulled in transitively via
+         everit json-schema → commons-validator. Fixes CVE-2025-48734, CVE-2019-10086. -->
+    <dependency>
+      <groupId>commons-beanutils</groupId>
+      <artifactId>commons-beanutils</artifactId>
+      <version>1.10.1</version>
+    </dependency>
 
     <dependency>
       <groupId>junit</groupId>