Security fixes 2026-09-23

build.gradle.kts

@@ -64,6 +64,12 @@ subprojects {
                 add("implementation", rootProject.libs.commons.lang3) {
                     because("Force safe version of commons-lang3 across all modules")
                 }
+                add("implementation", rootProject.libs.httpcore5) {
+                    because("CVE-2026-54399: firebase-admin pulls in a vulnerable httpcore5")
+                }
+                add("implementation", rootProject.libs.httpcore5.h2) {
+                    because("CVE-2026-54428: firebase-admin pulls in a vulnerable httpcore5-h2")
+                }
             }
         }
     }

gradle/libs.versions.toml

@@ -1,28 +1,29 @@
 [versions]
 project = "0.7.6"
-gradle = "8.14"
-kotlin = "1.9.24"
-radarCommons = "1.2.6"
+gradle = "9.6.0"
+kotlin = "2.3.20"
+radarCommons = "1.2.8"
 confluent = "7.8.1"
 avro = "1.12.1"
-# @pin Upgrade to 2.21.x requires kotlin v2 minimum
-jackson = "2.20.2"
-jacksonAnnotations = "2.20"
-log4j2 = "2.23.1"
+jackson = "2.21.7"
+jacksonAnnotations = "2.21"
+log4j2 = "2.25.5"
 slf4j = "2.0.17"
 sentryLog4j = "1.7.30"
 sentryOpenTelemetryAgent = "8.36.0"
 # @pin Upgrade to 5.x.x requires kotlin v2 minimum
 okhttp = "4.12.0"
-firebaseAdmin = "9.8.0"
-radarSchemas = "0.8.18"
+firebaseAdmin = "9.11.0"
+radarSchemas = "0.9.2"
 # @pin Upgrade to 3.x.x requires kotlin v2 minimum
 ktor = "2.3.13"
-wiremock = "3.0.1"
+wiremock = "3.13.2"
 mockito = "5.23.0"
-netty = "4.2.10.Final"
+netty = "4.2.17.Final"
+# Forced transitive override for firebase-admin, see build.gradle.kts.
+httpcore5 = "5.4.3"
 commonsLang3 = "3.20.0"
-lz4 = "1.10.1"
+lz4 = "1.11.4"
 
 [libraries]
 lz4 = { module = "at.yawk.lz4:lz4-java", version.ref = "lz4" }
@@ -52,7 +53,9 @@ netty-handler-proxy = { module = "io.netty:netty-handler-proxy", version.ref = "
 netty-handler = { module = "io.netty:netty-handler", version.ref = "netty" }
 commons-lang3 = { module = "org.apache.commons:commons-lang3", version.ref = "commonsLang3" }
 mockito-core = { module = "org.mockito:mockito-core", version.ref = "mockito" }
-wiremock = { module = "com.github.tomakehurst:wiremock", version.ref = "wiremock" }
+wiremock = { module = "org.wiremock:wiremock", version.ref = "wiremock" }
+httpcore5 = { module = "org.apache.httpcomponents.core5:httpcore5", version.ref = "httpcore5" }
+httpcore5-h2 = { module = "org.apache.httpcomponents.core5:httpcore5-h2", version.ref = "httpcore5" }
 kotlin-test = { module = "org.jetbrains.kotlin:kotlin-test", version.ref = "kotlin" }
 kotlin-test-junit = { module = "org.jetbrains.kotlin:kotlin-test-junit", version.ref = "kotlin" }
 

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

kafka-connect-fitbit-source/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM gradle:8.14-jdk17 AS builder
+FROM --platform=$BUILDPLATFORM gradle:9.6.0-jdk17 AS builder
 
 RUN mkdir /code
 WORKDIR /code
@@ -25,6 +25,9 @@ COPY ./build.gradle.kts ./settings.gradle.kts ./gradle.properties /code/
 COPY kafka-connect-rest-source/build.gradle.kts /code/kafka-connect-rest-source/
 COPY kafka-connect-fitbit-source/build.gradle.kts /code/kafka-connect-fitbit-source/
 
+# Gradle 9 requires the directory of every included project to exist.
+RUN mkdir -p /code/kafka-connect-oura-source /code/oura-library
+
 RUN gradle downloadDependencies copyDependencies
 
 COPY ./kafka-connect-rest-source/src/ /code/kafka-connect-rest-source/src

kafka-connect-oura-source/Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM gradle:8.14-jdk17 AS builder
+FROM --platform=$BUILDPLATFORM gradle:9.6.0-jdk17 AS builder
 
 RUN mkdir /code
 WORKDIR /code
@@ -25,6 +25,9 @@ COPY ./build.gradle.kts ./settings.gradle.kts ./gradle.properties /code/
 COPY kafka-connect-oura-source/build.gradle.kts /code/kafka-connect-oura-source/
 COPY oura-library/build.gradle /code/oura-library/
 
+# Gradle 9 requires the directory of every included project to exist.
+RUN mkdir -p /code/kafka-connect-fitbit-source /code/kafka-connect-rest-source
+
 RUN gradle downloadDependencies copyDependencies
 
 COPY ./kafka-connect-oura-source/src/ /code/kafka-connect-oura-source/src

scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt

@@ -2,8 +2,8 @@ certifi==2018.10.15
 chardet==3.0.4
 idna==2.7
 PyCap==1.0.2
-PyYAML==5.3.1
-requests==2.22.0
+PyYAML==5.4
+requests==2.25.1
 selenium==3.14.1
 semantic-version==2.3.1
-urllib3==1.25.9
+urllib3==1.26.20