Update dependencies for CVE-2026-8763, CVE-2026-13506

build.gradle

@@ -5,10 +5,10 @@
  */
 
 plugins {
-    id "com.github.ben-manes.versions" version "0.54.0"
-    id "com.diffplug.spotless" version "8.4.0"
-    id "com.gradleup.nmcp.aggregation" version "1.5.0"
-    id "com.gradleup.nmcp" version "1.5.0" apply false
+    alias(libs.plugins.versions)
+    alias(libs.plugins.spotless)
+    alias(libs.plugins.nmcp.aggregation)
+    alias(libs.plugins.nmcp) apply false
 }
 
 version = '2.5.11'
@@ -37,8 +37,8 @@ dependencies {
 }
 
 allprojects {
-    apply plugin: "com.diffplug.spotless"
-    apply plugin: "com.github.ben-manes.versions"
+    apply(plugin: libs.plugins.spotless.get().pluginId)
+    apply(plugin: libs.plugins.versions.get().pluginId)
 
     repositories {
         mavenCentral()
@@ -52,6 +52,12 @@ allprojects {
             endWithNewline()
         }
     }
+
+    tasks.named("dependencyUpdates").configure {
+        checkConstraints = true
+        gradleReleaseChannel = 'current'
+        revision = 'release'
+    }
 }
 
 subprojects {
@@ -67,17 +73,17 @@ subprojects {
     }
 
     dependencies {
-        implementation 'commons-cli:commons-cli:1.11.0'
-        implementation 'commons-logging:commons-logging:1.3.6'
+        implementation(libs.commons.cli)
+        implementation(libs.commons.logging)
 
-        testImplementation platform('org.junit:junit-bom:6.0.3')
-        testImplementation 'org.junit.jupiter:junit-jupiter'
-        testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-        testImplementation 'org.assertj:assertj-core:3.27.7'
-        testImplementation 'org.mockito:mockito-core:5.23.0'
-        testImplementation 'uk.org.webcompere:system-stubs-jupiter:2.1.8'
+        testImplementation platform(libs.junit.bom)
+        testImplementation(libs.junit.jupiter)
+        testRuntimeOnly(libs.junit.platform.launcher)
+        testImplementation(libs.assertj)
+        testImplementation(libs.mockito.core)
+        testImplementation(libs.system.stubs.jupiter)
 
-        testImplementation 'org.hamcrest:hamcrest-library:3.0'
+        testImplementation(libs.hamcrest)
     }
 
     test {
@@ -86,9 +92,11 @@ subprojects {
 
     spotless {
         java {
-            removeUnusedImports()
-            palantirJavaFormat().formatJavadoc(true)
+            forbidWildcardImports()
             formatAnnotations()
+            palantirJavaFormat().formatJavadoc(true)
+            removeUnusedImports()
+            shortenFullyQualifiedTypes()
         }
     }
 }

fabric-chaincode-docker/Dockerfile

@@ -1,10 +1,12 @@
-ARG JAVA_IMAGE=eclipse-temurin:25-jdk
+ARG JAVA_IMAGE=eclipse-temurin:25.0.4_7-jdk
 
 FROM ${JAVA_IMAGE} AS builder
 
+ENV DEBIAN_FRONTEND=noninteractive
+
 RUN apt-get update \
-    && apt-get install -y curl zip unzip
-RUN curl -s "https://get.sdkman.io" | bash
+    && apt-get install --yes curl zip unzip
+RUN curl --fail --show-error --silent "https://get.sdkman.io" | bash
 
 SHELL ["/bin/bash", "-c"]
 
@@ -23,14 +25,14 @@ ENV PATH="/opt/maven/bin:/opt/gradle/bin:${PATH}"
 # Coping libs, scripts and sources
 COPY build/distributions/ /root/
 
-#Creating folders structure
+# Create folders structure
 RUN mkdir -p \
     /root/chaincode-java/chaincode/src \
     /root/chaincode-java/chaincode/build/out \
     /root/chaincode-java/shim-src/fabric-chaincode-integration-test \
     /root/chaincode-java/shim-src/fabric-chaincode-docker
 
-#Making scripts runnable
+# Make scripts runnable
 RUN chmod +x /root/chaincode-java/start /root/chaincode-java/build.sh
 
 # Build protos and shim jar and installing them to maven local and gradle cache

fabric-chaincode-docker/build.gradle

@@ -5,7 +5,7 @@
  */
 
 plugins {
-    id 'com.bmuschko.docker-remote-api' version '10.0.0'
+    alias(libs.plugins.docker.remote.api)
 }
 
 repositories {
@@ -54,6 +54,11 @@ tasks.register('copyAllDeps', Copy) {
         from project.getParent().file("settings.gradle")
         into('build/distributions/chaincode-java/shim-src/')
     }
+
+    copy {
+        from project.getParent().file("gradle/libs.versions.toml")
+        into('build/distributions/chaincode-java/shim-src/gradle/')
+    }
 }
 
 tasks.register('buildImage', DockerBuildImage) {

fabric-chaincode-integration-test/build.gradle

@@ -1,7 +1,7 @@
 dependencies {
     implementation project(':fabric-chaincode-docker')
     implementation project(':fabric-chaincode-shim')
-    implementation 'org.json:json:20251224'
+    implementation(libs.json)
 }
 
 

fabric-chaincode-shim/build.gradle

@@ -9,11 +9,11 @@ plugins {
     id 'signing'
     id 'jacoco'
     id 'pmd'
-    id 'com.gradleup.nmcp'
+    alias(libs.plugins.nmcp)
 }
 
 pmd {
-    toolVersion = '7.24.0'
+    toolVersion = libs.versions.pmd.get()
     ruleSetFiles = files('../pmd-ruleset.xml')
     ruleSets = [] // explicitly set to empty to avoid using the default configuration
     ignoreFailures = false
@@ -31,33 +31,33 @@ tasks.withType(Test).configureEach {
 }
 
 dependencies {
-    implementation platform('com.google.protobuf:protobuf-bom:4.34.1')
-    implementation platform('io.grpc:grpc-bom:1.81.0')
-    implementation platform('io.opentelemetry:opentelemetry-bom:1.62.0')
-    implementation platform("org.bouncycastle:bc-jdk18on-bom:1.84")
-
-    implementation 'org.hyperledger.fabric:fabric-protos:0.3.7'
-    implementation 'org.bouncycastle:bcpkix-jdk18on'
-    implementation 'org.bouncycastle:bcprov-jdk18on'
-    implementation 'io.github.classgraph:classgraph:4.8.184'
-    implementation 'com.github.erosb:everit-json-schema:1.14.6'
-    implementation 'org.json:json:20251224'
-    implementation 'com.google.protobuf:protobuf-java-util'
-
-    implementation 'io.grpc:grpc-netty-shaded'
-    implementation 'io.grpc:grpc-protobuf'
-    implementation 'io.grpc:grpc-stub'
-    testImplementation 'io.grpc:grpc-inprocess'
-
-    implementation 'io.opentelemetry:opentelemetry-api'
-    implementation 'io.opentelemetry.proto:opentelemetry-proto:1.10.0-alpha'
-    implementation 'io.opentelemetry:opentelemetry-sdk'
-    implementation 'io.opentelemetry:opentelemetry-sdk-extension-autoconfigure'
-    implementation 'io.opentelemetry:opentelemetry-sdk-trace'
-    implementation 'io.opentelemetry:opentelemetry-exporter-otlp'
-    implementation 'io.opentelemetry:opentelemetry-extension-trace-propagators'
-    implementation 'io.opentelemetry.semconv:opentelemetry-semconv:1.41.1'
-    implementation 'io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.27.0-alpha'
+    implementation platform(libs.protobuf.bom)
+    implementation platform(libs.grpc.bom)
+    implementation platform(libs.opentelemetry.bom)
+    implementation platform(libs.bouncycastle.bom)
+
+    implementation(libs.fabric.protos)
+    implementation(libs.bouncycastle.pkix)
+    implementation(libs.bouncycastle.prov)
+    implementation(libs.classgraph)
+    implementation(libs.json.schema)
+    implementation(libs.json)
+    implementation(libs.protobuf.util)
+
+    implementation(libs.grpc.netty.shaded)
+    implementation(libs.grpc.protobuf)
+    implementation(libs.grpc.stub)
+    testImplementation(libs.grpc.inprocess)
+
+    implementation(libs.opentelemetry.api)
+    implementation(libs.opentelemetry.exporter)
+    implementation(libs.opentelemetry.grpc)
+    implementation(libs.opentelemetry.proto)
+    implementation(libs.opentelemetry.sdk)
+    implementation(libs.opentelemetry.sdk.autoconfigure)
+    implementation(libs.opentelemetry.sdk.trace)
+    implementation(libs.opentelemetry.semconv)
+    implementation(libs.opentelemetry.trace.propagators)
 }
 
 sourceSets {

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/contract/execution/JSONTransactionSerializer.java

@@ -44,6 +44,7 @@ public class JSONTransactionSerializer implements SerializerInterface {
      * @return Byte buffer
      */
     @Override
+    @SuppressWarnings("PMD.ReturnEmptyCollectionRatherThanNull")
     public byte[] toBuffer(final Object value, final TypeSchema ts) {
         LOGGER.debug(() -> "Schema to convert is " + ts);
         byte[] buffer = null;

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/contract/routing/TxFunction.java

@@ -7,6 +7,7 @@
 
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.lang.reflect.Parameter;
 import java.util.List;
 import org.hyperledger.fabric.contract.ContractInterface;
 import org.hyperledger.fabric.contract.metadata.TypeSchema;
@@ -64,7 +65,7 @@ ContractInterface getContractInstance()
     Class<?> getReturnType();
 
     /** @return Parameter array */
-    java.lang.reflect.Parameter[] getParameters();
+    Parameter[] getParameters();
 
     /** @return Submit or Evaluate */
     TransactionType getType();

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/contract/routing/impl/ContractDefinitionImpl.java

@@ -47,7 +47,7 @@ public ContractDefinitionImpl(final Class<? extends ContractInterface> cl) {
             this.name = annotationName;
         }
 
-        isDefault = (cl.getAnnotation(Default.class) != null);
+        isDefault = cl.getAnnotation(Default.class) != null;
         contractAnnotation = cl.getAnnotation(Contract.class);
         contractClz = cl;
 

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/shim/ChaincodeBase.java

@@ -30,6 +30,7 @@
 import java.util.Base64;
 import java.util.Locale;
 import java.util.Properties;
+import java.util.logging.Handler;
 import java.util.logging.Level;
 import java.util.logging.LogRecord;
 import java.util.logging.Logger;
@@ -284,7 +285,7 @@ public String format(final LogRecord record) {
             }
         };
 
-        for (final java.util.logging.Handler handler : rootLogger.getHandlers()) {
+        for (final Handler handler : rootLogger.getHandlers()) {
             handler.setLevel(ALL);
             handler.setFormatter(formatter);
         }

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/shim/ledger/KeyModification.java

@@ -6,6 +6,8 @@
 
 package org.hyperledger.fabric.shim.ledger;
 
+import java.time.Instant;
+
 /**
  * QueryResult for history query. Holds a transaction ID, value, timestamp, and delete marker which resulted from a
  * history query.
@@ -38,7 +40,7 @@ public interface KeyModification {
      *
      * @return timestamp
      */
-    java.time.Instant getTimestamp();
+    Instant getTimestamp();
 
     /**
      * Returns the deletion marker.

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/traces/impl/OpenTelemetryProperties.java

@@ -35,12 +35,14 @@ final class OpenTelemetryProperties implements ConfigProperties {
     }
 
     @Override
-    @Nullable public String getString(final String name) {
+    @Nullable
+    public String getString(final String name) {
         return config.get(name);
     }
 
     @Override
-    @Nullable public Boolean getBoolean(final String name) {
+    @Nullable
+    public Boolean getBoolean(final String name) {
         String value = config.get(name);
         if (value == null || value.isEmpty()) {
             return null;
@@ -49,7 +51,8 @@ final class OpenTelemetryProperties implements ConfigProperties {
     }
 
     @Override
-    @Nullable public Integer getInt(final String name) {
+    @Nullable
+    public Integer getInt(final String name) {
         String value = config.get(name);
         if (value == null || value.isEmpty()) {
             return null;
@@ -62,7 +65,8 @@ final class OpenTelemetryProperties implements ConfigProperties {
     }
 
     @Override
-    @Nullable public Long getLong(final String name) {
+    @Nullable
+    public Long getLong(final String name) {
         String value = config.get(name);
         if (value == null || value.isEmpty()) {
             return null;
@@ -75,7 +79,8 @@ final class OpenTelemetryProperties implements ConfigProperties {
     }
 
     @Override
-    @Nullable public Double getDouble(final String name) {
+    @Nullable
+    public Double getDouble(final String name) {
         String value = config.get(name);
         if (value == null || value.isEmpty()) {
             return null;
@@ -88,7 +93,8 @@ final class OpenTelemetryProperties implements ConfigProperties {
     }
 
     @Override
-    @Nullable public Duration getDuration(final String name) {
+    @Nullable
+    public Duration getDuration(final String name) {
         String value = config.get(name);
         if (value == null || value.isEmpty()) {
             return null;

fabric-chaincode-shim/src/test/java/org/hyperledger/fabric/LoggingTest.java

@@ -12,6 +12,7 @@
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.util.logging.Level;
+import java.util.logging.Logger;
 import org.hamcrest.CoreMatchers;
 import org.junit.jupiter.api.Test;
 
@@ -55,8 +56,8 @@ void testFormatError() {
     @Test
     void testSetLogLevel() {
 
-        final java.util.logging.Logger l = java.util.logging.Logger.getLogger("org.hyperledger.fabric.test");
-        final java.util.logging.Logger another = java.util.logging.Logger.getLogger("acme.wibble");
+        final Logger l = Logger.getLogger("org.hyperledger.fabric.test");
+        final Logger another = Logger.getLogger("acme.wibble");
 
         final Level anotherLevel = another.getLevel();
         Logging.setLogLevel("debug");