chore(deps): update all non-major dependencies

.checkov.yml

@@ -34,3 +34,6 @@ skip-check:
   # "Apply security context to your pods and containers"
   # security contexts are applied to containers
   - CKV_K8S_29
+
+skip-path:
+  - src/hack

.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "csharpier": {
-      "version": "0.25.0",
+      "version": "0.27.2",
       "commands": ["dotnet-csharpier"]
     }
   }

.mega-linter.yml

@@ -24,6 +24,9 @@ DISABLE_LINTERS:
   # seems to ignore yamllint config file entirely
   - YAML_YAMLLINT
   - SPELL_LYCHEE
+  # failing on previously existing CVEs in PRs isn't entirely helpful.
+  # ideally should be part of a regularly scheduled check instead
+  - REPOSITORY_GRYPE
 
 SHOW_ELAPSED_TIME: true
 FILEIO_REPORTER: false

charts/recruit/Chart.lock

@@ -1,18 +1,18 @@
 dependencies:
 - name: hapi-fhir-jpaserver
   repository: https://hapifhir.github.io/hapi-fhir-jpaserver-starter
-  version: 0.14.0
+  version: 0.15.0
 - name: mailhog
   repository: https://codecentric.github.io/helm-charts
   version: 5.2.3
 - name: ohdsi
   repository: oci://ghcr.io/chgl/charts
-  version: 0.21.9
+  version: 0.22.3
 - name: postgresql
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 13.2.27
 - name: fhir-pseudonymizer
   repository: oci://ghcr.io/miracum/charts
-  version: 0.5.7
-digest: sha256:4f368946f11d32880d68fef79f1f6def7d407897da7e11d34e237b12b5fe0200
-generated: "2024-01-13T16:34:38.919972344+01:00"
+  version: 0.6.3
+digest: sha256:69a0e2d4644fcfa781b1c0c5ae896426e9fdc069a4a3dbad915437ec308c0d5d
+generated: "2024-02-14T12:22:48.724133437Z"

charts/recruit/Chart.yaml

@@ -22,22 +22,22 @@ dependencies:
     alias: fhirserver
     name: hapi-fhir-jpaserver
     repository: https://hapifhir.github.io/hapi-fhir-jpaserver-starter
-    version: 0.14.0
+    version: 0.15.0
   - condition: mailhog.enabled
     name: mailhog
     repository: https://codecentric.github.io/helm-charts
     version: 5.2.3
   - condition: ohdsi.enabled
     name: ohdsi
     repository: oci://ghcr.io/chgl/charts
-    version: 0.21.9
+    version: 0.22.3
   - name: postgresql
     version: 13.2.27
     repository: oci://registry-1.docker.io/bitnamicharts
     condition: postgresql.enabled
   - condition: fhir-pseudonymizer.enabled
     name: fhir-pseudonymizer
-    version: 0.5.7
+    version: 0.6.3
     repository: oci://ghcr.io/miracum/charts
 # x-release-please-start-version
 version: 10.1.8

charts/recruit/values.yaml

@@ -677,7 +677,7 @@ curl: # +doc-gen:ignore
   image:
     registry: docker.io
     repository: curlimages/curl
-    tag: 8.4.0@sha256:4a3396ae573c44932d06ba33f8696db4429c419da87cbdc82965ee96a37dd0af
+    tag: 8.6.0@sha256:c3b8bee303c6c6beed656cfc921218c529d65aa61114eb9e27c62047a1271b9b
 
 broadseaAtlasdb:
   # -- whether to deploy the OHDSI Broadsea Atlasdb (<https://github.com/OHDSI/Broadsea-Atlasdb>)

docker-compose/docker-compose.probe.yaml

@@ -1,6 +1,6 @@
 services:
   health-probes:
-    image: docker.io/curlimages/curl:8.4.0@sha256:4a3396ae573c44932d06ba33f8696db4429c419da87cbdc82965ee96a37dd0af
+    image: docker.io/curlimages/curl:8.6.0@sha256:c3b8bee303c6c6beed656cfc921218c529d65aa61114eb9e27c62047a1271b9b
     ipc: private
     security_opt:
       - "no-new-privileges:true"
@@ -11,14 +11,14 @@ services:
     read_only: true
     user: 65532:65532
     command: >
-      sh -euxc "curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://fhir:8080/fhir/metadata?_summary=true &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://query:8080/actuator/health &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://notify:8080/actuator/health &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://list:8080/api/health/readiness &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://maildev:1080/healthz &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://ohdsi-webapi:8080/WebAPI/info &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://ohdsi-atlas:8080/atlas/ &&
-                curl --fail --retry-connrefuse --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://keycloak:8080/"
+      sh -euxc "curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://fhir:8080/fhir/metadata?_summary=true &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://query:8080/actuator/health &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://notify:8080/actuator/health &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://list:8080/api/health/readiness &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://maildev:1080/healthz &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://ohdsi-webapi:8080/WebAPI/info &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://ohdsi-atlas:8080/atlas/ &&
+                curl --fail --retry-connrefused --connect-timeout 30 --max-time 60 --retry 10 --retry-delay 30 http://keycloak:8080/"
     depends_on:
       - fhir
       - query

docker-compose/docker-compose.staging.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: docker.io/library/traefik:2.10.5@sha256:948978f7ec62f137a79f8af7044a1785bd7868706ef2c8cba9c88db688d08661
+    image: docker.io/library/traefik:2.11.0@sha256:4be302e188b5be7637a3404033e8088c005059fd29e05b7ff04a403fac3d13ea
     restart: unless-stopped
     ipc: none
     security_opt:
@@ -36,7 +36,7 @@ services:
           memory: 2048m
 
   ohdsi-webapi:
-    image: docker.io/ohdsi/webapi:2.13.0@sha256:04313754fc79a6e362a8116ef462360e3891581a045924f4ec5ed404fbb9b837
+    image: docker.io/ohdsi/webapi:2.14.0@sha256:582b59b186fde5936081c1df6e41cba53e45e112d5b4875ddfda1e4dee4b2981
     restart: unless-stopped
     ipc: none
     security_opt:
@@ -79,7 +79,7 @@ services:
       - "traefik.http.routers.ohdsi-webapi.entrypoints=web"
 
   ohdsi-atlas:
-    image: docker.io/ohdsi/atlas:2.13.0@sha256:e91501a45c96debc83715631a31b3417a37d0ac3020701f9823413ec86cb5b0e
+    image: docker.io/ohdsi/atlas:2.14.1@sha256:bd095ed794a6619f877d72c13ecfc22c8bb8a863937392857866e4bd6015157f
     restart: unless-stopped
     ipc: none
     security_opt:
@@ -102,7 +102,7 @@ services:
       - "traefik.http.routers.ohdsi-atlas.entrypoints=web"
 
   fhir:
-    image: docker.io/hapiproject/hapi:v6.8.3@sha256:6195f1116ebabfb0a608addde043b3e524c456c4d4f35b3d25025afd7dcd2e27
+    image: docker.io/hapiproject/hapi:v6.10.1@sha256:4eac1b3481180b028616d1fab7e657e368538063d75f7ed3be2032e34c657dd4
     restart: unless-stopped
     cap_drop:
       - ALL

release-please-config.json

@@ -1,25 +1,24 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-  "pull-request-title-pattern": "chore(release): release ${version}",
   "packages": {
     ".": {
       "changelog-path": "CHANGELOG.md",
       "release-type": "simple",
       "bump-minor-pre-major": false,
       "bump-patch-for-minor-pre-major": false,
       "draft": false,
-      "prerelease": false
+      "prerelease": false,
+      "extra-files": [
+        "charts/recruit/Chart.yaml",
+        "charts/recruit/values.yaml",
+        "src/list/Dockerfile",
+        "src/buildSrc/src/main/groovy/org.miracum.recruit.java-common-conventions.gradle",
+        "src/notify/src/main/resources/application.yml",
+        "src/query/src/main/resources/application.yml",
+        "docker-compose/docker-compose.yaml",
+        "docs/configuration/security.md",
+        "docs/_snippets/k8s/query-argo-workflow.yaml"
+      ]
     }
-  },
-  "extra-files": [
-    "charts/recruit/Chart.yaml",
-    "charts/recruit/values.yaml",
-    "src/list/Dockerfile",
-    "src/buildSrc/src/main/groovy/org.miracum.recruit.java-common-conventions.gradle",
-    "src/notify/src/main/resources/application.yml",
-    "src/query/src/main/resources/application.yml",
-    "docker-compose/docker-compose.yaml",
-    "docs/configuration/security.md",
-    "docs/_snippets/k8s/query-argo-workflow.yaml"
-  ]
+  }
 }

src/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/gradle:8.4.0-jdk17@sha256:70da12adf27e83bcc125af9d2bc6f9432590e89c96609625aa688135b27e75fb AS build
+FROM docker.io/library/gradle:8.6.0-jdk17@sha256:05a2d55e715fa98b1bb75a87c9589d349721137ae0825c4ee726907523a62af7 AS build
 WORKDIR /home/gradle/src
 ENV GRADLE_USER_HOME="/gradle"
 
@@ -37,4 +37,4 @@ COPY --from=build /home/gradle/src/${MODULE_NAME}/application/ .
 USER 65532:65532
 EXPOSE 8080/tcp 8081/tcp
 ENV SPRING_PROFILES_ACTIVE="prod"
-ENTRYPOINT ["java", "org.springframework.boot.loader.JarLauncher"]
+ENTRYPOINT ["java", "org.springframework.boot.loader.launch.JarLauncher"]

src/buildSrc/build.gradle

@@ -15,10 +15,10 @@ repositories {
 }
 
 dependencies {
-    implementation 'org.springframework.boot:spring-boot-gradle-plugin:3.1.5'
-    implementation 'io.spring.gradle:dependency-management-plugin:1.1.3'
+    implementation 'org.springframework.boot:spring-boot-gradle-plugin:3.2.2'
+    implementation 'io.spring.gradle:dependency-management-plugin:1.1.4'
     implementation 'com.google.cloud.tools:jib-gradle-plugin:3.4.0'
-    implementation 'com.diffplug.spotless:spotless-plugin-gradle:6.22.0'
+    implementation 'com.diffplug.spotless:spotless-plugin-gradle:6.25.0'
     implementation 'io.freefair.gradle:lombok-plugin:8.4'
     implementation 'de.undercouch:gradle-download-task:5.5.0'
 }

src/buildSrc/src/main/groovy/org.miracum.recruit.java-application-conventions.gradle

@@ -37,19 +37,19 @@ dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-jdbc'
     implementation 'org.springframework.boot:spring-boot-starter-data-jdbc'
 
-    implementation 'ca.uhn.hapi.fhir:hapi-fhir-base:6.8.5'
-    implementation 'ca.uhn.hapi.fhir:hapi-fhir-client:6.8.5'
-    implementation 'ca.uhn.hapi.fhir:hapi-fhir-structures-r4:6.8.4'
-    implementation 'ca.uhn.hapi.fhir:hapi-fhir-client-okhttp:6.8.5'
+    implementation 'ca.uhn.hapi.fhir:hapi-fhir-base:6.10.4'
+    implementation 'ca.uhn.hapi.fhir:hapi-fhir-client:6.10.4'
+    implementation 'ca.uhn.hapi.fhir:hapi-fhir-structures-r4:6.10.4'
+    implementation 'ca.uhn.hapi.fhir:hapi-fhir-client-okhttp:6.10.4'
 
     implementation 'com.squareup.okhttp3:okhttp:4.12.0'
 
     implementation 'net.logstash.logback:logstash-logback-encoder:7.4'
 
-    implementation 'org.postgresql:postgresql:42.6.0'
+    implementation 'org.postgresql:postgresql:42.7.1'
 
-    implementation 'io.micrometer:micrometer-registry-prometheus:1.11.5'
-    implementation 'io.micrometer:micrometer-core:1.11.5'
+    implementation 'io.micrometer:micrometer-registry-prometheus:1.12.3'
+    implementation 'io.micrometer:micrometer-core:1.12.3'
 
     constraints {
         implementation('org.apache.commons:commons-text:1.11.0')
@@ -105,7 +105,7 @@ spotless {
 }
 
 checkstyle {
-    toolVersion '10.12.4'
+    toolVersion '10.13.0'
     configFile = file('../config/checkstyle/checkstyle.xml')
 }
 

src/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.6-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

src/gradlew

@@ -145,15 +145,15 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
     case $MAX_FD in  #(
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -202,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

src/gradlew.bat

@@ -43,11 +43,11 @@ set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -57,11 +57,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 

src/hack/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: docker.io/library/traefik:2.10.5@sha256:948978f7ec62f137a79f8af7044a1785bd7868706ef2c8cba9c88db688d08661
+    image: docker.io/library/traefik:2.11.0@sha256:4be302e188b5be7637a3404033e8088c005059fd29e05b7ff04a403fac3d13ea
     restart: unless-stopped
     ipc: none
     security_opt:
@@ -23,7 +23,7 @@ services:
           memory: 128m
 
   fhir:
-    image: docker.io/hapiproject/hapi:v6.8.3@sha256:6195f1116ebabfb0a608addde043b3e524c456c4d4f35b3d25025afd7dcd2e27
+    image: docker.io/hapiproject/hapi:v6.10.1@sha256:4eac1b3481180b028616d1fab7e657e368538063d75f7ed3be2032e34c657dd4
     restart: unless-stopped
     cap_drop:
       - ALL
@@ -84,7 +84,7 @@ services:
       - "127.0.0.1:25432:5432"
 
   ohdsi-webapi:
-    image: docker.io/ohdsi/webapi:2.13.0@sha256:04313754fc79a6e362a8116ef462360e3891581a045924f4ec5ed404fbb9b837
+    image: docker.io/ohdsi/webapi:2.14.0@sha256:582b59b186fde5936081c1df6e41cba53e45e112d5b4875ddfda1e4dee4b2981
     restart: unless-stopped
     ipc: none
     security_opt:
@@ -143,7 +143,7 @@ services:
       - "traefik.http.routers.ohdsi-webapi.entrypoints=web"
 
   ohdsi-atlas:
-    image: docker.io/ohdsi/atlas:2.13.0@sha256:e91501a45c96debc83715631a31b3417a37d0ac3020701f9823413ec86cb5b0e
+    image: docker.io/ohdsi/atlas:2.14.1@sha256:bd095ed794a6619f877d72c13ecfc22c8bb8a863937392857866e4bd6015157f
     restart: unless-stopped
     ipc: none
     security_opt:
@@ -270,7 +270,7 @@ services:
       OTEL_EXPORTER_JAEGER_ENDPOINT: "http://jaeger:14250"
 
   jaeger:
-    image: docker.io/jaegertracing/all-in-one:1.50.0@sha256:d589499a01e1e2f9d302db8e210af09688076fd8a93278fa024824a755c1a0f1
+    image: docker.io/jaegertracing/all-in-one:1.54.0@sha256:f4044964505c81bf12131c2dfd1f4ddf1d1421bbbd9d79f691221cac077599a8
     ports:
       - "127.0.0.1:16686:16686"
       - "127.0.0.1:6831:6831/udp"

src/list/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/node:20.9.0@sha256:146bbe4eaee99ae885be2a0a767f63a4b96032141d70d80e590f10e0d7ebabcb AS base
+FROM docker.io/library/node:20.11.0@sha256:7bf4a586b423aac858176b3f683e35f08575c84500fbcfd1d433ad8568972ec6 AS base
 WORKDIR /app
 
 COPY package.json ./