Security fixes 2026-09-23

[pvannierop]

Security patch into dev, from the 2026-09-23 fleet-wide HIGH/CRITICAL dependency scan (Trivy).

Branch strategy: fixes go into dev first. Once this PR is merged, release-0.8.0 (next minor) is created from dev and opened as a release PR into master. (This PR used to target a pre-made release-0.8.0 branch; that branch was removed on 2026-09-26.)

Changes

Each commit lists the CVEs it fixes and how.

Fix HIGH/CRITICAL CVEs in Jackson, Netty, httpcore5, WireMock and Python deps

• jackson 2.20.2 -> 2.21.4: CVE-2026-54512, CVE-2026-54513, GHSA-r7wm-3cxj-wff9
• netty 4.2.10.Final -> 4.2.17.Final: CVE-2026-42583, CVE-2026-59901,
  CVE-2026-42584, CVE-2026-42587, CVE-2026-55831, CVE-2026-55833,
  CVE-2026-56745, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010,
  CVE-2026-75595
• httpcore5/httpcore5-h2 forced to 5.4.3 via constraints: CVE-2026-54399,
  CVE-2026-54428. Forced transitive override: even the latest firebase-admin
  (9.10.0) pulls in 5.2.x.
• wiremock (test) com.github.tomakehurst:wiremock 3.0.1 ->
  org.wiremock:wiremock 3.13.2 (same project, renamed group): fixes the
  jetty-server, http2-common/hpack, commons-fileupload, commons-io and
  json-smart findings on the test classpath.
• scripts/REDCAP-FITBIT-AUTH-AUTO (Python 2): PyYAML 5.3.1 -> 5.4
  (CVE-2020-14343), urllib3 1.25.9 -> 1.26.17 (CVE-2021-33503,
  CVE-2023-43804), plus requests 2.22.0 -> 2.25.1, needed because
  requests 2.22 caps urllib3 below 1.26.

Jackson 2.21 requires Kotlin 2, so this only builds once radarCommons points
at the Kotlin-2-migrated release. Verified against the local
radar-commons 1.2.6-kotlin23-local: full build and tests pass, and the rescan
shows no new HIGH/CRITICAL findings.

Use the upcoming shared-library releases and Kotlin 2.3.20

Point the shared-library pins at the releases prepared together with this
security patch: kotlin="2.3.20",radarCommons="1.2.8",radarSchemas="0.9.1".
radarCommons 1.2.8 is the radar-commons B release (see radar-commons), and
it also supplies the Kotlin 2.3.20 compiler via the radar-kotlin convention
plugin, completing this repo's Kotlin 2.3 migration.

No code changes were needed. Verified against local builds of those
releases: full build and tests pass.

Use radar-schemas 0.9.2

radar-schemas 0.9.1 was released from dev before its security PR was merged. The security fixes and the Kotlin 2.3 build shipped in 0.9.2, which radar-commons 1.2.8 also uses, so the radarSchemas pin moves from 0.9.1 to 0.9.2.

Bump Gradle to 9.6.0

• wrapper and gradle catalog entry: 8.14 -> 9.6.0
• Dockerfile builder images: gradle:8.14-jdk17 -> gradle:9.6.0-jdk17
• Dockerfiles: create the directories of the other included projects
  before the first Gradle run. Each image copies only its own modules,
  and Gradle 9 refuses to configure an included project whose directory
  doesn't exist.

Gradle 9.6.0 embeds Kotlin 2.3.21, so the build scripts are compiled with
Kotlin 2.3 as well.

Not fixed

• Test classpath only (via WireMock 3.13.2): handlebars 4.3.1 (4.5.x breaks WireMock), jetty-http/jetty-security 11.0.26 (fixes need Jetty 12).
• scripts/REDCAP-FITBIT-AUTH-AUTO (Python 2): urllib3 2.x and current certifi require Python 3.

Verification

Full build and tests pass, and a Trivy rescan shows no new HIGH/CRITICAL findings.

Release order. These PRs are part of one coordinated batch, and the pinned library versions only exist once released in this order: radar-commons 1.2.7 → ManagementPortal 3.0.1 (radar-auth, managementportal-client) → radar-jersey 0.12.9 → RADAR-Schemas 0.9.2 → radar-commons 1.2.8 → services. Until then, this branch won't resolve its dependencies in CI. Everything was verified locally against builds of exactly those versions.

Features already on dev (will be part of release-0.8.0)

• Enable Maven Central snapshots and release publishing for oura-library and google-health-library (Enable Maven Central snapshots and release publishing for oura-library and google-health-library #200)

🤖 Generated with Claude Code