From c30e6fb7f7d3a2f0d7ed2d4ed905257b807e5480 Mon Sep 17 00:00:00 2001
From: Pavlo Strunkin <pashidlos@gmail.com>
Date: Tue, 3 Nov 2026 08:24:30 +0200
Subject: [PATCH] chore(deps): fix vulnerable test and build dependencies,
 submit the Gradle dependency graph

- logback-classic 1.5.16 -> 1.5.38 (CVE-2025-11226, CVE-2026-1225, CVE-2026-9828, CVE-2026-10532)
- mockwebserver 4.11.0 -> 4.12.0: okio 3.6.0 (CVE-2023-3635), junit 4.13.2 (CVE-2020-15250)
- drop the unused shadow 5.2.0 plugin and its log4j 2.11, ant 1.9.7, jdom2,
  plexus-utils and commons-io 2.6 build classpath; JitPack publishes the plain jar
- submit the Gradle dependency graph on pushes to master so Dependabot alerts
  see Gradle dependencies at all

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/dependency-submission.yml | 23 +++++++++++++++++++++
 build.gradle                                | 11 ++++++----
 2 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 0000000..6c03782
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,23 @@
+name: Dependency Submission
+
+on:
+  push:
+    branches: [ master ]
+    paths: [ 'build.gradle', 'settings.gradle', 'gradle/**', '.github/workflows/dependency-submission.yml' ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: 11
+      - uses: gradle/actions/dependency-submission@v6
+        with:
+          cache-provider: basic
diff --git a/build.gradle b/build.gradle
index 578f640..7e0f06e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -4,7 +4,6 @@ version '4.3.1'
 apply plugin: 'java'
 apply plugin: 'jacoco'
 apply plugin: "io.freefair.lombok"
-apply plugin: "com.github.johnrengelman.shadow"
 
 repositories {
     mavenCentral()
@@ -19,18 +18,17 @@ buildscript {
     }
     dependencies {
         classpath "io.freefair.gradle:lombok-plugin:5.1.1"
-        classpath "com.github.jengelman.gradle.plugins:shadow:5.2.0"
     }
 }
 
 dependencies {
     implementation 'com.google.code.gson:gson:2.9.0'
     implementation 'org.slf4j:slf4j-api:1.7.25'
-    testImplementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.5.16'
+    testImplementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.5.38'
     testImplementation group: 'org.testng', name: 'testng', version: '7.7.0'
     testImplementation 'commons-io:commons-io:2.18.0'
     testImplementation 'org.mockito:mockito-core:4.4.0'
-    testImplementation 'com.squareup.okhttp3:mockwebserver:4.11.0'
+    testImplementation 'com.squareup.okhttp3:mockwebserver:4.12.0'
     testImplementation 'uk.org.webcompere:system-stubs-testng:2.1.3'
 }
 
@@ -47,3 +45,8 @@ jacocoTestReport {
 }
 
 check.dependsOn jacocoTestReport
+
+// Gradle 6.1 otherwise picks the sources variant of Kotlin multiplatform modules such as okio 3.6
+configurations.matching { it.canBeResolved }.configureEach {
+    attributes.attribute(Category.CATEGORY_ATTRIBUTE, objects.named(Category, Category.LIBRARY))
+}