Snyk security updates

.editorconfig

@@ -15,8 +15,12 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 
+[*.{kt,kts}]
+ktlint_standard_no-wildcard-imports = disabled
+
 [*.md]
 trim_trailing_whitespace = false
 
 [*.{json,yaml,yml}]
+indent_style = space
 indent_size = 2

buildSrc/build.gradle.kts

@@ -9,7 +9,6 @@ repositories {
     mavenCentral()
 }
 
-
 tasks.withType<JavaCompile> {
     sourceCompatibility = "17"
     targetCompatibility = "17"

buildSrc/src/main/kotlin/Versions.kt

@@ -3,14 +3,17 @@ object Versions {
     const val project = "1.1.2-SNAPSHOT"
 
     object Plugins {
-        const val kotlin = "1.9.10"
+        const val licenseReport = "2.5"
+        const val kotlin = "1.9.21"
+        const val dokka = "1.9.10"
         const val kotlinSerialization = kotlin
         const val kotlinAllOpen = kotlin
         const val avro = "1.8.0"
         const val gradle = "8.3"
+        const val publishPlugin = "2.0.0-rc-1"
     }
 
-    const val java = 11
+    const val java = 17
     const val slf4j = "2.0.9"
     const val confluent = "7.5.0"
     const val kafka = "7.5.0-ce"
@@ -27,4 +30,7 @@ object Versions {
     const val coroutines = "1.7.3"
     const val commonsCompress = "1.24.0"
     const val snappy = "1.1.10.5"
+    const val guava = "32.1.1-jre"
+    const val gradleVersionsPlugin = "0.50.0"
+    const val ktlint = "12.0.3"
 }

radar-commons-gradle/build.gradle.kts

@@ -4,6 +4,7 @@ import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
 plugins {
     `kotlin-dsl`
     `java-gradle-plugin`
+    // Match to the versions in the bottom of this file
     kotlin("jvm") version "1.9.21"
     `maven-publish`
     id("io.github.gradle-nexus.publish-plugin") version "2.0.0-rc-1"
@@ -23,12 +24,12 @@ repositories {
 }
 
 dependencies {
-    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.21")
-    implementation("org.jetbrains.dokka:dokka-gradle-plugin:1.9.10")
-    implementation("com.github.ben-manes:gradle-versions-plugin:0.50.0")
-    implementation("io.github.gradle-nexus:publish-plugin:2.0.0-rc-1")
-    implementation("org.jlleitschuh.gradle:ktlint-gradle:12.0.3")
-    implementation("com.github.jk1.dependency-license-report:com.github.jk1.dependency-license-report.gradle.plugin:2.5")
+    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:${Versions.Plugins.kotlin}")
+    implementation("org.jetbrains.dokka:dokka-gradle-plugin:${Versions.Plugins.dokka}")
+    implementation("com.github.ben-manes:gradle-versions-plugin:${Versions.gradleVersionsPlugin}")
+    implementation("io.github.gradle-nexus:publish-plugin:${Versions.Plugins.publishPlugin}")
+    implementation("org.jlleitschuh.gradle:ktlint-gradle:${Versions.ktlint}")
+    implementation("com.github.jk1.dependency-license-report:com.github.jk1.dependency-license-report.gradle.plugin:${Versions.Plugins.licenseReport}")
 }
 
 gradlePlugin {
@@ -53,11 +54,12 @@ gradlePlugin {
 }
 
 tasks.withType<JavaCompile> {
-    options.release.set(11)
+    options.release.set(Versions.java)
 }
+
 tasks.withType<KotlinCompile> {
     compilerOptions {
-        jvmTarget.set(JvmTarget.JVM_11)
+        jvmTarget.set(JvmTarget.JVM_17)
         languageVersion.set(org.jetbrains.kotlin.gradle.dsl.KotlinVersion.KOTLIN_1_9)
         apiVersion.set(org.jetbrains.kotlin.gradle.dsl.KotlinVersion.KOTLIN_1_9)
     }
@@ -169,3 +171,43 @@ tasks.withType<Sign> {
 tasks.withType<PublishToMavenRepository> {
     dependsOn(tasks.withType<Sign>())
 }
+
+// Because this project is where all the required plugins get built, we need to add the dependencies separately here.
+// They should be copied from the Versions.kt file directly to maintain consistency.
+@Suppress("ConstPropertyName", "MemberVisibilityCanBePrivate")
+object Versions {
+    const val project = "1.1.2-SNAPSHOT"
+
+    object Plugins {
+        const val licenseReport = "2.5"
+        const val kotlin = "1.9.21"
+        const val dokka = "1.9.10"
+        const val kotlinSerialization = kotlin
+        const val kotlinAllOpen = kotlin
+        const val avro = "1.8.0"
+        const val gradle = "8.3"
+        const val publishPlugin = "2.0.0-rc-1"
+    }
+
+    const val java = 17
+    const val slf4j = "2.0.9"
+    const val confluent = "7.5.0"
+    const val kafka = "7.5.0-ce"
+    const val avro = "1.11.3"
+    const val jackson = "2.15.2"
+    const val okhttp = "4.11.0"
+    const val junit = "5.10.0"
+    const val mockito = "5.5.0"
+    const val mockitoKotlin = "5.1.0"
+    const val hamcrest = "2.2"
+    const val radarSchemas = "0.8.4"
+    const val opencsv = "5.8"
+    const val ktor = "2.3.4"
+    const val coroutines = "1.7.3"
+    const val commonsCompress = "1.24.0"
+    const val snappy = "1.1.10.5"
+    const val guava = "32.1.1-jre"
+    const val gradleVersionsPlugin = "0.50.0"
+    const val ktlint = "12.0.3"
+}
+

radar-commons-gradle/src/main/kotlin/org/radarbase/gradle/plugin/RadarDependencyManagementPlugin.kt

@@ -22,7 +22,7 @@ interface RadarDependencyManagementExtension {
 class RadarDependencyManagementPlugin : Plugin<Project> {
     override fun apply(project: Project): Unit = with(project) {
         val extension = extensions.create<RadarDependencyManagementExtension>("radarDependencies").apply {
-            regex.convention("(^[0-9,.v-]+(-r)?|RELEASE|FINAL|GA|-CE)$")
+            regex.convention("(^[0-9,.v-]+(-r)?|RELEASE|FINAL|GA|-CE|-JRE|-ANDROID)$")
             rejectMajorVersionUpdates.convention(false)
         }
 

radar-commons-kotlin/build.gradle.kts

@@ -6,12 +6,12 @@ description = "Library for Kotlin utility classes and functions"
 
 dependencies {
     api(platform("org.jetbrains.kotlinx:kotlinx-coroutines-bom:${Versions.coroutines}"))
-    api("org.jetbrains.kotlinx:kotlinx-coroutines-core")
+    api("org.jetbrains.kotlinx:kotlinx-coroutines-core:${Versions.coroutines}")
 
     api(platform("io.ktor:ktor-bom:${Versions.ktor}"))
-    api("io.ktor:ktor-client-auth")
-    implementation("io.ktor:ktor-client-content-negotiation")
-    implementation("io.ktor:ktor-serialization-kotlinx-json")
+    api("io.ktor:ktor-client-auth:${Versions.ktor}")
+    implementation("io.ktor:ktor-client-content-negotiation:${Versions.ktor}")
+    implementation("io.ktor:ktor-serialization-kotlinx-json:${Versions.ktor}")
 
     testImplementation("org.hamcrest:hamcrest:${Versions.hamcrest}")
 }

radar-commons-server/build.gradle.kts

@@ -36,18 +36,23 @@ dependencies {
 
     // For POJO classes and ConfigLoader
     implementation(platform("com.fasterxml.jackson:jackson-bom:${Versions.jackson}"))
-    implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-yaml")
-    implementation("com.fasterxml.jackson.core:jackson-databind")
+    implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${Versions.jackson}")
+    implementation("com.fasterxml.jackson.core:jackson-databind:${Versions.jackson}")
 
-    api("org.apache.avro:avro:${Versions.avro}")
+    api("org.apache.avro:avro:${Versions.avro}") {
+        implementation("org.apache.commons:commons-compress:${Versions.commonsCompress}")
+    }
 
     implementation("org.apache.kafka:kafka-clients:${Versions.kafka}") {
         implementation("org.xerial.snappy:snappy-java:${Versions.snappy}")
     }
 
     testImplementation("org.mockito:mockito-core:${Versions.mockito}")
     // Direct producer uses KafkaAvroSerializer if initialized
-    testImplementation("io.confluent:kafka-avro-serializer:${Versions.confluent}")
+
+    implementation("io.confluent:kafka-avro-serializer:${Versions.confluent}") {
+        runtimeOnly("com.google.guava:guava:${Versions.guava}")
+    }
     testImplementation("org.radarbase:radar-schemas-commons:${Versions.radarSchemas}")
 }
 

radar-commons-testing/build.gradle.kts

@@ -40,20 +40,26 @@ dependencies {
     api(project(":radar-commons-server"))
     api(project(":radar-commons-kotlin"))
 
-    api("org.apache.avro:avro:${Versions.avro}")
     api("org.radarbase:radar-schemas-commons:${Versions.radarSchemas}")
 
     implementation("com.opencsv:opencsv:${Versions.opencsv}")
     implementation(platform("com.fasterxml.jackson:jackson-bom:${Versions.jackson}"))
-    implementation("com.fasterxml.jackson.core:jackson-databind")
+    implementation("com.fasterxml.jackson.core:jackson-databind:${Versions.jackson}")
 
     implementation("org.apache.kafka:kafka-clients:${Versions.kafka}") {
         implementation("org.xerial.snappy:snappy-java:${Versions.snappy}")
     }
-    implementation("io.confluent:kafka-avro-serializer:${Versions.confluent}")
+
+    implementation("io.confluent:kafka-avro-serializer:${Versions.confluent}") {
+        runtimeOnly("com.google.guava:guava:${Versions.guava}")
+    }
+
+    api("org.apache.avro:avro:${Versions.avro}") {
+        implementation("org.apache.commons:commons-compress:${Versions.commonsCompress}")
+    }
 
     implementation(platform("io.ktor:ktor-bom:${Versions.ktor}"))
-    implementation("io.ktor:ktor-serialization-kotlinx-json")
+    implementation("io.ktor:ktor-serialization-kotlinx-json:${Versions.ktor}")
 
     applicationRuntimeOnly("org.slf4j:slf4j-simple:${Versions.slf4j}")
 

radar-commons/build.gradle.kts

@@ -24,11 +24,11 @@ dependencies {
     implementation(project(":radar-commons-kotlin"))
 
     api(platform("io.ktor:ktor-bom:${Versions.ktor}"))
-    api("io.ktor:ktor-client-core")
-    api("io.ktor:ktor-client-cio")
-    api("io.ktor:ktor-client-auth")
-    implementation("io.ktor:ktor-client-content-negotiation")
-    implementation("io.ktor:ktor-serialization-kotlinx-json")
+    api("io.ktor:ktor-client-core:${Versions.ktor}")
+    api("io.ktor:ktor-client-cio:${Versions.ktor}")
+    api("io.ktor:ktor-client-auth:${Versions.ktor}")
+    implementation("io.ktor:ktor-client-content-negotiation:${Versions.ktor}")
+    implementation("io.ktor:ktor-serialization-kotlinx-json:${Versions.ktor}")
 
     api("org.jetbrains.kotlinx:kotlinx-coroutines-core:${Versions.coroutines}")