Merge pull request #2959 from bcgov/feature/vuln-nov-updates

November Vulnerabilities.

Author: TayGov

src/backend/efiling-api/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.4</version>
+        <version>3.5.7</version>
 
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
@@ -239,7 +239,7 @@
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-handler</artifactId>
-            <version>4.1.118.Final</version>
+            <version>4.1.123.Final</version>
         </dependency>
         <dependency>
             <groupId>org.apache.cxf</groupId>

src/backend/libs/efiling-bom/pom.xml

@@ -41,8 +41,8 @@
         <logback.access.common.version>2.0.6</logback.access.common.version>
         <org.apache.tomcat.embed.version>[11.0.8,)</org.apache.tomcat.embed.version>
         <org.json.version>20250517</org.json.version>
-        <org.springframework.security.version>6.5.0</org.springframework.security.version>
-        <org.springframework.version>6.2.10</org.springframework.version>
+        <org.springframework.security.version>6.5.4</org.springframework.security.version>
+        <org.springframework.version>6.2.12</org.springframework.version>
     </properties>
 
     <repositories>

src/backend/libs/efiling-ceis-api-client/pom.xml

@@ -133,7 +133,7 @@
 			<dependency>
 				<groupId>org.springframework.boot</groupId>
 				<artifactId>spring-boot-dependencies</artifactId>
-				<version>3.5.0</version>
+				<version>3.5.7</version>
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>

src/backend/libs/efiling-commons/pom.xml

@@ -64,7 +64,7 @@
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>
-                <version>3.5.0</version>
+                <version>3.5.7</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>

src/backend/libs/efiling-cso-starter/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.4</version>
+        <version>3.5.7</version>
         <relativePath/>
     </parent>
 

src/backend/libs/efiling-demo-starter/pom.xml

@@ -76,7 +76,7 @@
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>
-                <version>3.5.0</version>
+                <version>3.5.7</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>

src/frontend/efiling-frontend/package.json

@@ -8,7 +8,7 @@
     "@babel/preset-react": "^7.18.6",
     "@bcgov/bootstrap-theme": "github:bcgov/bootstrap-theme",
     "assert": "^2.0.0",
-    "axios": "^0.30.0",
+    "axios": "^0.30.2",
     "axios-auth-refresh": "^2.2.8",
     "babel-plugin-transform-export-extensions": "^6.22.0",
     "bootstrap": "^4.5.3",

src/frontend/efiling-frontend/yarn.lock

@@ -4274,13 +4274,13 @@ axios-mock-adapter@^1.19.0:
     is-blob "^2.1.0"
     is-buffer "^2.0.5"
 
-axios@^0.30.0:
-  version "0.30.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-0.30.0.tgz#026ae2c0ae6ac35d564056690683fb77c991d0d3"
-  integrity sha512-Z4F3LjCgfjZz8BMYalWdMgAQUnEtKDmpwNHjh/C8pQZWde32TF64cqnSeyL3xD/aTIASRU30RHTNzRiV/NpGMg==
+axios@^0.30.2:
+  version "0.30.2"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-0.30.2.tgz#256d3a8ee765cc27188d08b8b545a5f5a0c77dad"
+  integrity sha512-0pE4RQ4UQi1jKY6p7u6i1Tkzqmu+d+/tHS7Q7rKunWLB9WyilBTpHHpXzPNMDj5hTbK0B0PTLSz07yqMBiF6xg==
   dependencies:
     follow-redirects "^1.15.4"
-    form-data "^4.0.0"
+    form-data "^4.0.4"
     proxy-from-env "^1.1.0"
 
 axobject-query@^2.2.0:
@@ -7506,7 +7506,7 @@ fork-ts-checker-webpack-plugin@^6.5.0:
     semver "^7.3.2"
     tapable "^1.0.0"
 
-form-data@4.0.4, form-data@^3.0.0, form-data@^4.0.0:
+form-data@4.0.4, form-data@^3.0.0, form-data@^4.0.4:
   version "4.0.4"
   resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.4.tgz#784cdcce0669a9d68e94d11ac4eea98088edd2c4"
   integrity sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==