From aadd1afb034dcdd59adf8644dc018e5618f96b2a Mon Sep 17 00:00:00 2001
From: Ivar Derksen <ivar.derksen@sidn.nl>
Date: Wed, 20 Mar 2024 11:55:01 +0100
Subject: [PATCH 1/2] Chore: bump vulnerable dependencies

---
 build.gradle    | 23 ++++++++++++-----------
 settings.gradle |  5 +++++
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/build.gradle b/build.gradle
index 9db7bd0..1de60d1 100644
--- a/build.gradle
+++ b/build.gradle
@@ -13,7 +13,7 @@ buildscript {
         }
     }
     dependencies {
-        classpath "org.gretty:gretty:4.0.3"
+        classpath "org.gretty:gretty:4.1.2"
     }
 }
 
@@ -29,21 +29,22 @@ repositories {
 }
 
 dependencies {
-    implementation 'org.glassfish.jersey.core:jersey-server:3.0.0'
-    implementation 'org.glassfish.jersey.containers:jersey-container-servlet:3.0.0'
-    implementation 'org.glassfish.jersey.inject:jersey-hk2:3.0.0'
-    implementation 'ch.qos.logback:logback-classic:1.1.7'
+    implementation 'org.glassfish.jersey.core:jersey-server:3.1.5'
+    implementation 'org.glassfish.jersey.containers:jersey-container-servlet:3.1.5'
+    implementation 'org.glassfish.jersey.inject:jersey-hk2:3.1.5'
+    implementation 'ch.qos.logback:logback-classic:1.5.3'
     implementation 'com.sun.mail:jakarta.mail:2.0.1'
     implementation 'jakarta.ws.rs:jakarta.ws.rs-api:3.1.0'
     
-    implementation 'io.jsonwebtoken:jjwt:0.9.1'
-    implementation 'com.google.code.gson:gson:2.8.9'
-    implementation 'org.apache.commons:commons-lang3:3.7'
-    implementation 'org.bouncycastle:bcpkix-jdk15on:1.70'
-    implementation 'org.bouncycastle:bcprov-jdk15on:1.67'
+    implementation 'io.jsonwebtoken:jjwt:0.12.5'
+    implementation 'com.google.code.gson:gson:2.10.1'
+    implementation 'org.apache.commons:commons-lang3:3.14.0'
+    implementation 'org.bouncycastle:bcpkix-jdk18on:1.77'
+    implementation 'org.bouncycastle:bcprov-jdk18on:1.77'
     implementation 'jakarta.xml.bind:jakarta.xml.bind-api:3.0.1'
 
-    implementation 'org.irmacard.api:irma_api_common:2.0.0'
+    // Source dependencies. Check settings.gradle for the source repositories.
+    implementation 'org.irmacard.api:irma_api_common:v2.0.1'
 
     testImplementation group: 'junit', name: 'junit', version: '4.13.1'
 }
diff --git a/settings.gradle b/settings.gradle
index 5857d8b..c398aec 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -1,2 +1,7 @@
 rootProject.name = 'irma_email_issuer'
 
+sourceControl {
+    gitRepository("https://github.com/privacybydesign/irma_api_common.git") {
+        producesModule("org.irmacard.api:irma_api_common")
+    }
+}

From 9995e65221fcd8b4b3814a04031c6b4b35c3d567 Mon Sep 17 00:00:00 2001
From: Ivar Derksen <ivar.derksen@sidn.nl>
Date: Wed, 20 Mar 2024 15:43:30 +0100
Subject: [PATCH 2/2] Fix: jersey version not compatible with TomEE

---
 build.gradle | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/build.gradle b/build.gradle
index 1de60d1..6641715 100644
--- a/build.gradle
+++ b/build.gradle
@@ -29,9 +29,9 @@ repositories {
 }
 
 dependencies {
-    implementation 'org.glassfish.jersey.core:jersey-server:3.1.5'
-    implementation 'org.glassfish.jersey.containers:jersey-container-servlet:3.1.5'
-    implementation 'org.glassfish.jersey.inject:jersey-hk2:3.1.5'
+    implementation 'org.glassfish.jersey.core:jersey-server:3.0.12'
+    implementation 'org.glassfish.jersey.containers:jersey-container-servlet:3.0.12'
+    implementation 'org.glassfish.jersey.inject:jersey-hk2:3.0.12'
     implementation 'ch.qos.logback:logback-classic:1.5.3'
     implementation 'com.sun.mail:jakarta.mail:2.0.1'
     implementation 'jakarta.ws.rs:jakarta.ws.rs-api:3.1.0'