Security patch (#1333)

* Bump ch.qos.logback:logback-classic in /core-services/egov-user (#1310)

Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.2.0 to 1.2.13.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.0...v_1.2.13)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump org.postgresql:postgresql in /core-services/egov-location (#1311)

Bumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from 42.7.7 to 42.7.11.
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.7...REL42.7.11)

---
updated-dependencies:
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.11
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

* Dependabot/maven/tutorials/backend developer guide/btr service/net.minidev json smart 2.5.2 (#1314)

* Bump net.minidev:json-smart

Bumps [net.minidev:json-smart](https://github.com/netplex/json-smart-v2) from 2.5.0 to 2.5.2.
- [Release notes](https://github.com/netplex/json-smart-v2/releases)
- [Commits](netplex/json-smart-v2@2.5.0...2.5.2)

---
updated-dependencies:
- dependency-name: net.minidev:json-smart
  dependency-version: 2.5.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* updated json-smart version

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Dependabot/maven/core services/egov malware detection/commons io commons io 2.14.0 (#1316)

* Bump commons-io:commons-io in /core-services/egov-malware-detection

Bumps commons-io:commons-io from 2.11.0 to 2.14.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-version: 2.14.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* updated common.io

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Dependabot/maven/core services/egov user/org.jsoup jsoup 1.15.3 (#1317)

* Bump org.jsoup:jsoup from 1.10.2 to 1.15.3 in /core-services/egov-user

Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.10.2 to 1.15.3.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/jsoup-1.15.3/CHANGES)
- [Commits](jhy/jsoup@jsoup-1.10.2...jsoup-1.15.3)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.15.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update jsoup dependency version to 1.15.3

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump io.minio:minio from 7.1.4 to 8.6.0 in /core-services/egov-filestore (#1318)

Bumps [io.minio:minio](https://github.com/minio/minio-java) from 7.1.4 to 8.6.0.
- [Release notes](https://github.com/minio/minio-java/releases)
- [Commits](minio/minio-java@7.1.4...8.6.0)

---
updated-dependencies:
- dependency-name: io.minio:minio
  dependency-version: 8.6.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump io.minio:minio in /core-services/egov-malware-detection (#1319)

Bumps [io.minio:minio](https://github.com/minio/minio-java) from 8.5.7 to 8.6.0.
- [Release notes](https://github.com/minio/minio-java/releases)
- [Commits](minio/minio-java@8.5.7...8.6.0)

---
updated-dependencies:
- dependency-name: io.minio:minio
  dependency-version: 8.6.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump com.amazonaws:aws-java-sdk-s3 in /core-services/egov-filestore (#1321)

Bumps [com.amazonaws:aws-java-sdk-s3](https://github.com/aws/aws-sdk-java) from 1.11.289 to 1.12.261.
- [Changelog](https://github.com/aws/aws-sdk-java/blob/master/CHANGELOG.md)
- [Commits](aws/aws-sdk-java@1.11.289...1.12.261)

---
updated-dependencies:
- dependency-name: com.amazonaws:aws-java-sdk-s3
  dependency-version: 1.12.261
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Kafka client will transitively pull the dependency

* Update tracer dependency version to 2.9.2-SNAPSHOT

* Filestore changes due to minio major version change

* Feat: Updated tracer version to 2.9.2

* Fix: Removed hardcoded postgresql version

* Patches for vulnerabilites

* Changes to dependencies in utilites

* Change branch for push trigger to 'security-patch'

* Clean up permissions in scorecard.yml (#1330)

Removed commented-out permissions for private repositories.

* Add workflow_dispatch trigger to scorecard workflow

Allows manual triggering from GitHub Actions UI and fixes the job condition
to not skip runs triggered via workflow_dispatch on non-default branches.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix scorecard publish_results to allow runs on non-default branches

publish_results: true causes scorecard-action to abort on any branch
other than master. Making it conditional lets manual/PR runs complete.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Update scorecard.yml

* Update scorecard.yml

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: talele08 <talele08@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: talele08 <talele.aniket@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 4 people

.github/workflows/scorecard.yml

@@ -12,7 +12,8 @@ on:
   schedule:
     - cron: '45 1 * * 4'
   push:
-    branches: [ "security-patch" ]
+    branches: [ "master" ]
+
   workflow_dispatch:
 
 # Declare default permissions as read only.

accelerators/gateway-kubernetes-discovery/go.mod

@@ -4,6 +4,6 @@ go 1.13
 
 require (
 	k8s.io/api v0.17.0
-	k8s.io/apimachinery v0.17.0
-	k8s.io/client-go v0.17.0
+	k8s.io/apimachinery v0.17.9
+	k8s.io/client-go v0.17.16
 )

core-services/audit-service/pom.xml

@@ -16,6 +16,7 @@
 		<java.version>17</java.version>
 	    <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>

core-services/boundary-service/pom.xml

@@ -9,6 +9,8 @@
     <java.version>17</java.version>
     <maven.compiler.source>${java.version}</maven.compiler.source>
     <maven.compiler.target>${java.version}</maven.compiler.target>
+    <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
 </properties>
     <parent>
         <groupId>org.springframework.boot</groupId>

core-services/egov-accesscontrol/pom.xml

@@ -25,6 +25,7 @@
         <cache2k-version>1.2.0.Final</cache2k-version>
         <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>
@@ -83,7 +84,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.0</version>
+            <version>3.18.0</version>
         </dependency>
 
         <dependency>

core-services/egov-enc-service/pom.xml

@@ -18,6 +18,7 @@
     <lombok.version>1.18.22</lombok.version>
       <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>

core-services/egov-filestore/pom.xml

@@ -22,6 +22,7 @@
 		<lombok.version>1.18.22</lombok.version>
 	    <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>

core-services/egov-idgen/pom.xml

@@ -20,6 +20,7 @@
     <lombok.version>1.18.22</lombok.version>
       <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>

core-services/egov-indexer/pom.xml

@@ -22,6 +22,7 @@
     <cache2k-version>1.2.0.Final</cache2k-version>
       <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>

core-services/egov-localization/pom.xml

@@ -19,6 +19,7 @@
     <lombok.version>1.18.22</lombok.version>
       <tomcat.version>10.1.45</tomcat.version>
     <jackson-bom.version>2.18.6</jackson-bom.version>
+    <logback.version>1.5.25</logback.version>
     <spring-framework.version>6.2.11</spring-framework.version>
     <postgresql.version>42.7.11</postgresql.version>
   </properties>