From 9067dcdc07fe93b72362b1a6eb46712664d21a27 Mon Sep 17 00:00:00 2001
From: Nico <5772511+Death111@users.noreply.github.com>
Date: Thu, 4 Jun 2026 18:28:39 +0200
Subject: [PATCH 1/3] update dependencies. remove sonar step in pipeline

---
 .github/workflows/mavenCi.yml |  6 ------
 pom.xml                       | 23 +++++++++--------------
 2 files changed, 9 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/mavenCi.yml b/.github/workflows/mavenCi.yml
index e3d7aace..24f2194a 100644
--- a/.github/workflows/mavenCi.yml
+++ b/.github/workflows/mavenCi.yml
@@ -44,12 +44,6 @@ jobs:
           name: KeepTime-${{ env.version }}
           path: /home/runner/work/KeepTime/KeepTime/target/*-bin.zip
 
-      - name: Analyze
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: mvn -V -B sonar:sonar -Dsonar.host.url=${{ secrets.HOST_URL }} -Dsonar.organization=${{ secrets.ORGANIZATION_NAME }} -Dsonar.projectKey=${{ secrets.PROJECT_KEY }} -Dsonar.java.binaries=. -Dsonar.qualitygate.wait=false
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
 
diff --git a/pom.xml b/pom.xml
index dd649d92..3871b65d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>3.4.4</version>
+    <version>3.5.14</version>
     <relativePath />
     <!-- lookup parent from repository -->
   </parent>
@@ -39,7 +39,7 @@
     <java.version>17</java.version>
     <javafx.version>22</javafx.version>
 
-    <maven-dependency-check.version>12.0.1</maven-dependency-check.version>
+    <maven-dependency-check.version>12.2.2</maven-dependency-check.version>
     <!-- USING HTML,XML (comma-separated list) did not work with plugin version 5.1.0 -->
     <maven-dependency-check.format>ALL</maven-dependency-check.format>
     <maven-dependency-check.failOnError>true</maven-dependency-check.failOnError>
@@ -103,7 +103,7 @@
     <dependency>
       <groupId>org.springdoc</groupId>
       <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-      <version>2.8.5</version>
+      <version>2.8.17</version>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
@@ -147,14 +147,9 @@
     <dependency>
       <groupId>org.apache.maven.plugins</groupId>
       <artifactId>maven-assembly-plugin</artifactId>
-      <version>3.7.1</version>
+      <version>3.8.0</version>
       <type>maven-plugin</type>
     </dependency>
-    <dependency>
-      <groupId>org.sonarsource.scanner.maven</groupId>
-      <artifactId>sonar-maven-plugin</artifactId>
-      <version>3.11.0.3922</version>
-    </dependency>
     <dependency>
       <groupId>org.hamcrest</groupId>
       <artifactId>hamcrest-library</artifactId>
@@ -165,7 +160,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.datatype</groupId>
       <artifactId>jackson-datatype-jsr310</artifactId>
-      <version>2.18.2</version>
+      <version>2.22.0</version>
     </dependency>
 
   </dependencies>
@@ -208,7 +203,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-site-plugin</artifactId>
-        <version>3.12.1</version>
+        <version>3.22.0</version>
       </plugin>
 
       <!-- https://mvnrepository.com/artifact/org.owasp/dependency-check-maven (run with mvn dependency-check:check ) -->
@@ -267,13 +262,13 @@
            <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-compiler-plugin</artifactId>
-            <version>3.11.0</version>
+            <version>3.15.0</version>
             <configuration>
               <annotationProcessorPaths>
                 <path>
                   <groupId>org.mapstruct</groupId>
                   <artifactId>mapstruct-processor</artifactId>
-                  <version>1.5.5.Final</version>
+                  <version>1.6.3</version>
                 </path>
               </annotationProcessorPaths>
             </configuration>
@@ -281,7 +276,7 @@
           <plugin>
             <groupId>org.jacoco</groupId>
             <artifactId>jacoco-maven-plugin</artifactId>
-            <version>0.8.10</version>
+            <version>0.8.14</version>
             <executions>
               <execution>
                 <id>prepare-agent</id>

From 38555294023a4a285dafde51c40d8bf1914c6625 Mon Sep 17 00:00:00 2001
From: Nico <5772511+Death111@users.noreply.github.com>
Date: Thu, 4 Jun 2026 18:41:15 +0200
Subject: [PATCH 2/3] overwrite tomcat to patched version

---
 pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pom.xml b/pom.xml
index 3871b65d..246dd4ab 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,6 +105,12 @@
       <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
       <version>2.8.17</version>
     </dependency>
+    <!-- Overwrite tomcat version due to security vulnerability -->
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-core</artifactId>
+      <version>10.1.55</version>
+    </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-validation</artifactId>

From 81579971d461db61635a705ac6f70807e9886700 Mon Sep 17 00:00:00 2001
From: Nico <5772511+Death111@users.noreply.github.com>
Date: Thu, 4 Jun 2026 18:51:57 +0200
Subject: [PATCH 3/3] overwrite tomcat to patched version (websocket as well)

---
 pom.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 246dd4ab..cb50b6a2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,12 +105,17 @@
       <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
       <version>2.8.17</version>
     </dependency>
-    <!-- Overwrite tomcat version due to security vulnerability -->
+    <!-- Overwrite tomcat version due to security vulnerability. remove when possible -->
     <dependency>
       <groupId>org.apache.tomcat.embed</groupId>
       <artifactId>tomcat-embed-core</artifactId>
       <version>10.1.55</version>
     </dependency>
+    <dependency>
+        <groupId>org.apache.tomcat.embed</groupId>
+        <artifactId>tomcat-embed-websocket</artifactId>
+        <version>10.1.55</version>
+    </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-validation</artifactId>