Update dependencies to address CVE-2024-7254 (#353)

Also the following dependency changes:

- Remove obsolete JUnit 4.
- Replace com.github.stefanbirkner:system-rules with
  uk.org.webcompere:system-stubs-jupiter since the former appears not to
  work correctly with JUnit 5.
- Update versions following v2.5.3 release.

Signed-off-by: Mark S. Lewis <[email protected]>

Author: bestbeforetoday

build.gradle

@@ -4,9 +4,11 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-apply plugin: 'idea'
-apply plugin: 'eclipse-wtp'
-version = '2.5.3'
+plugins {
+    id "com.github.ben-manes.versions" version "0.51.0"
+}
+
+version = '2.5.4'
 
 
 // If the nightly property is set, then this is the scheduled main 
@@ -46,18 +48,16 @@ subprojects {
     }
 
     dependencies {
-        implementation 'commons-cli:commons-cli:1.6.0'
-        implementation 'commons-logging:commons-logging:1.2'
-        testImplementation 'org.junit.jupiter:junit-jupiter-api:5.3.1'
-        testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.3.1'
-
-        testImplementation 'org.hamcrest:hamcrest-library:1.3'
-        testImplementation 'org.mockito:mockito-core:2.23.0'
-        testImplementation 'com.github.stefanbirkner:system-rules:system-rules-1.17.0'
-
-        testCompileOnly 'junit:junit:4.13.2'
-        testRuntimeOnly 'org.junit.vintage:junit-vintage-engine:5.10.2'
-        testImplementation 'org.assertj:assertj-core:3.9.1'
+        implementation 'commons-cli:commons-cli:1.9.0'
+        implementation 'commons-logging:commons-logging:1.3.4'
+        testImplementation 'org.junit.jupiter:junit-jupiter-api:5.11.0'
+        testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.11.0'
+
+        testImplementation 'org.hamcrest:hamcrest-library:3.0'
+        testImplementation 'org.mockito:mockito-core:5.13.0'
+        testImplementation 'uk.org.webcompere:system-stubs-jupiter:2.1.6'
+
+        testImplementation 'org.assertj:assertj-core:3.26.3'
     }
 
     test {

examples/fabric-contract-example-as-service/build.gradle

@@ -22,10 +22,10 @@ repositories {
 
 dependencies {
     compile 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2'
-    compile 'org.json:json:20231013'
-    testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
-    testImplementation 'org.assertj:assertj-core:3.11.1'
-    testImplementation 'org.mockito:mockito-core:2.+'
+    compile 'org.json:json:20240303'
+    testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
+    testImplementation 'org.assertj:assertj-core:3.26.3'
+    testImplementation 'org.mockito:mockito-core:5.13.0'
 }
 
 shadowJar {

examples/fabric-contract-example-gradle-kotlin/build.gradle.kts

@@ -15,10 +15,10 @@ version = "0.0.1"
 
 dependencies {
     implementation("org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2")
-    implementation("org.json:json:20231013")
+    implementation("org.json:json:20240303")
     implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
 
-    testImplementation("org.junit.jupiter:junit-jupiter:5.4.2")
+    testImplementation("org.junit.jupiter:junit-jupiter:5.11.0")
     testImplementation("com.nhaarman.mockitokotlin2:mockito-kotlin:2.1.0")
 }
 

examples/fabric-contract-example-gradle/build.gradle

@@ -22,10 +22,10 @@ repositories {
 
 dependencies {
     compile 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2'
-    compile 'org.json:json:20231013'
-    testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
-    testImplementation 'org.assertj:assertj-core:3.11.1'
-    testImplementation 'org.mockito:mockito-core:2.+'
+    compile 'org.json:json:20240303'
+    testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
+    testImplementation 'org.assertj:assertj-core:3.26.3'
+    testImplementation 'org.mockito:mockito-core:5.13.0'
 }
 
 shadowJar {

examples/ledger-api/build.gradle

@@ -22,10 +22,10 @@ repositories {
 
 dependencies {
     compile 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2'
-    compile 'org.json:json:20231013'
-    testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
-    testImplementation 'org.assertj:assertj-core:3.11.1'
-    testImplementation 'org.mockito:mockito-core:2.+'
+    compile 'org.json:json:20240303'
+    testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
+    testImplementation 'org.assertj:assertj-core:3.26.3'
+    testImplementation 'org.mockito:mockito-core:5.13.0'
 }
 
 shadowJar {

fabric-chaincode-docker/build.gradle

@@ -9,9 +9,10 @@ buildscript {
         maven { url "https://oss.sonatype.org/content/repositories/snapshots" }
         maven { url "https://www.jitpack.io" }
         mavenCentral()
+        gradlePluginPortal()
     }
     dependencies {
-        classpath 'com.bmuschko:gradle-docker-plugin:5.1.0'
+        classpath 'com.bmuschko:gradle-docker-plugin:9.4.0'
     }
 }
 
@@ -64,6 +65,6 @@ task copyAllDeps(type: Copy) {
 task buildImage(type: DockerBuildImage) {
     dependsOn copyAllDeps
     inputDir = project.file('Dockerfile').parentFile
-    tags = ['hyperledger/fabric-javaenv', 'hyperledger/fabric-javaenv:2.5', 'hyperledger/fabric-javaenv:amd64-2.5.3', 'hyperledger/fabric-javaenv:amd64-latest']
+    images = ['hyperledger/fabric-javaenv', 'hyperledger/fabric-javaenv:2.5', 'hyperledger/fabric-javaenv:amd64-2.5.4', 'hyperledger/fabric-javaenv:amd64-latest']
 }
 

fabric-chaincode-integration-test/build.gradle

@@ -1,7 +1,7 @@
 dependencies {
     implementation project(':fabric-chaincode-docker')
     implementation project(':fabric-chaincode-shim')
-    implementation 'org.json:json:20231013'
+    implementation 'org.json:json:20240303'
 }
 
 

fabric-chaincode-integration-test/src/contracts/bare-gradle/build.gradle

@@ -19,7 +19,7 @@ repositories {
 }
 
 dependencies {
-    implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.3'
+    implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.4'
     implementation 'org.hyperledger.fabric:fabric-protos:0.3.3'
 }
 

fabric-chaincode-integration-test/src/contracts/bare-maven/pom.xml

@@ -12,7 +12,7 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 
 		<!-- fabric-chaincode-java -->
-		<fabric-chaincode-java.version>2.5.3</fabric-chaincode-java.version>
+		<fabric-chaincode-java.version>2.5.4</fabric-chaincode-java.version>
 
 	</properties>
 

fabric-chaincode-integration-test/src/contracts/fabric-ledger-api/build.gradle

@@ -25,7 +25,7 @@ repositories {
 }
 
 dependencies {
-    implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.3'
+    implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.4'
     implementation 'org.hyperledger.fabric:fabric-protos:0.3.3'
 }