Upgrade to Spring Boot 4 and Jackson 3

dependency-check-suppressions.xml

@@ -1,2 +1,21 @@
-<?xml version="1.0" encoding="UTF-8"?><suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress until="2026-10-31Z">
+        <notes><![CDATA[
+            CVE-2025-21199 affects the Azure Backup and Site Recovery agent installers, not the
+            Application Insights Java SDK. Remove this suppression when Dependency-Check no longer
+            maps applicationinsights-core to the microsoft:azure_agent CPE.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.microsoft\.azure/applicationinsights-core@3\.7\.9$</packageUrl>
+        <cve>CVE-2025-21199</cve>
+    </suppress>
+    <suppress until="2026-10-31Z">
+        <notes><![CDATA[
+            CVE-2026-53914 affects Kotlin build-cache metadata deserialization, not the JVM runtime
+            standard-library artifacts. Remove this suppression when Dependency-Check no longer
+            maps the runtime stdlib jars to the affected Kotlin build tooling.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib(?:-jdk7|-jdk8)?@2\.2\.21$</packageUrl>
+        <cve>CVE-2026-53914</cve>
+    </suppress>
 </suppressions>

lib/applicationinsights.json

@@ -1,5 +1,6 @@
 {
   "connectionString": "${file:/mnt/secrets/ccd/app-insights-connection-string}",
+  "connectionStringConfiguredAtRuntime": true,
   "role": {
     "name": "ccd-data-store-api"
   },

lombok.config

@@ -1,3 +1,3 @@
 config.stopBubbling = true
 lombok.addLombokGeneratedAnnotation = true
-lombok.jacksonized.jacksonVersion += 2
+lombok.jacksonized.jacksonVersion += 3

src/aat/java/uk/gov/hmcts/ccd/datastore/tests/helper/S2SHelper.java

@@ -1,7 +1,7 @@
 package uk.gov.hmcts.ccd.datastore.tests.helper;
 
 import feign.Feign;
-import feign.jackson.JacksonEncoder;
+import feign.gson.GsonEncoder;
 import org.springframework.cloud.openfeign.support.SpringMvcContract;
 import uk.gov.hmcts.reform.authorisation.ServiceAuthorisationApi;
 import uk.gov.hmcts.reform.authorisation.generators.ServiceAuthTokenGenerator;
@@ -12,7 +12,7 @@ public class S2SHelper {
 
     public S2SHelper(final String s2sUrl, final String secret, final String microservice) {
         final ServiceAuthorisationApi serviceAuthorisationApi = Feign.builder()
-            .encoder(new JacksonEncoder())
+            .encoder(new GsonEncoder())
             .contract(new SpringMvcContract())
             .target(ServiceAuthorisationApi.class, s2sUrl);
 

src/aat/java/uk/gov/hmcts/ccd/datastore/tests/helper/idam/IdamApi.java

@@ -1,6 +1,6 @@
 package uk.gov.hmcts.ccd.datastore.tests.helper.idam;
 
-import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.gson.annotations.SerializedName;
 import feign.Body;
 import feign.Headers;
 import feign.Param;
@@ -33,7 +33,7 @@ TokenExchangeResponse exchangeCode(@Param("code") String code,
     IdamUser getUser(@Param("access_token") String accessToken);
 
     class AuthenticateUserResponse {
-        @JsonProperty("code")
+        @SerializedName("code")
         private String code;
 
         public String getCode() {
@@ -43,7 +43,7 @@ public String getCode() {
 
     class TokenExchangeResponse {
 
-        @JsonProperty("access_token")
+        @SerializedName("access_token")
         private String accessToken;
 
         public String getAccessToken() {
@@ -52,10 +52,10 @@ public String getAccessToken() {
     }
 
     class IdamUser {
-        @JsonProperty("uid")
+        @SerializedName("uid")
         private String uid;
 
-        @JsonProperty("roles")
+        @SerializedName("roles")
         private List<String> roles;
 
         public String getUid() {
@@ -67,4 +67,3 @@ public List<String> getRoles() {
         }
     }
 }
-

src/aat/java/uk/gov/hmcts/ccd/datastore/tests/helper/idam/IdamHelper.java

@@ -5,8 +5,8 @@
 import java.util.Map;
 
 import feign.Feign;
-import feign.jackson.JacksonDecoder;
-import feign.jackson.JacksonEncoder;
+import feign.gson.GsonDecoder;
+import feign.gson.GsonEncoder;
 
 public class IdamHelper {
 
@@ -21,8 +21,8 @@ public class IdamHelper {
 
     public IdamHelper(String idamBaseUrl, OAuth2 oauth2) {
         idamApi = Feign.builder()
-                       .encoder(new JacksonEncoder())
-                       .decoder(new JacksonDecoder())
+                       .encoder(new GsonEncoder())
+                       .decoder(new GsonDecoder())
                        .target(IdamApi.class, idamBaseUrl);
         this.oauth2 = oauth2;
     }

src/aat/java/uk/gov/hmcts/ccd/datastore/tests/v2/external/GetCaseValidatorTest.java

@@ -7,7 +7,7 @@
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
+import tools.jackson.core.JacksonException;
 
 import java.util.function.Supplier;
 
@@ -37,7 +37,7 @@ class StartCaseTrigger {
 
         @Test
         @DisplayName("should get 422 when event not provided")
-        void should422WhenEventNotProvided() throws JsonProcessingException {
+        void should422WhenEventNotProvided() throws JacksonException {
             callCaseDataValidate(INVALID_CASE_TYPE_ID, getBody(null))
                 .when()
                 .post("/case-types/{caseTypeId}/validate")
@@ -48,7 +48,7 @@ void should422WhenEventNotProvided() throws JsonProcessingException {
 
         @Test
         @DisplayName("should get 422 when event trigger does not exist")
-        void should422WhenEventTriggerDoesNotExist() throws JsonProcessingException {
+        void should422WhenEventTriggerDoesNotExist() throws JacksonException {
             callCaseDataValidate(CASE_TYPE, getBody(INVALID_EVENT_TRIGGER_ID))
                 .when()
                 .post("/case-types/{caseTypeId}/validate")
@@ -58,7 +58,7 @@ void should422WhenEventTriggerDoesNotExist() throws JsonProcessingException {
         }
 
         private RequestSpecification callCaseDataValidate(String caseTypeId, Supplier<String> supplier)
-                                                          throws JsonProcessingException {
+                                                          throws JacksonException {
             return asAutoTestCaseworker(FALSE)
                 .get()
                 .given()

src/contractTest/java/uk/gov/hmcts/ccd/WireMockBaseContractTest.java

@@ -1,7 +1,10 @@
 package uk.gov.hmcts.ccd;
 
+import com.github.tomakehurst.wiremock.WireMockServer;
+import com.github.tomakehurst.wiremock.client.MappingBuilder;
 import com.github.tomakehurst.wiremock.client.ResponseDefinitionBuilder;
 import com.github.tomakehurst.wiremock.common.FileSource;
+import com.github.tomakehurst.wiremock.core.WireMockConfiguration;
 import com.github.tomakehurst.wiremock.extension.Parameters;
 import com.github.tomakehurst.wiremock.extension.ResponseDefinitionTransformer;
 import com.github.tomakehurst.wiremock.http.Request;
@@ -11,16 +14,16 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.cloud.contract.wiremock.AutoConfigureWireMock;
-import org.springframework.cloud.contract.wiremock.WireMockConfigurationCustomizer;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.test.util.ReflectionTestUtils;
+import org.wiremock.spring.ConfigureWireMock;
+import org.wiremock.spring.EnableWireMock;
+import org.wiremock.spring.InjectWireMock;
+import org.wiremock.spring.WireMockConfigurationCustomizer;
 
 import jakarta.inject.Inject;
 import java.io.IOException;
 
-@AutoConfigureWireMock(port = 0)
+@EnableWireMock(@ConfigureWireMock(configurationCustomizers = WireMockBaseContractTest.Customizer.class))
 public abstract class WireMockBaseContractTest {
 
     private static final Logger LOG = LoggerFactory.getLogger(WireMockBaseContractTest.class);
@@ -33,6 +36,9 @@ public abstract class WireMockBaseContractTest {
     @Inject
     protected ApplicationParams applicationParams;
 
+    @InjectWireMock
+    protected WireMockServer wireMockServer;
+
     @BeforeEach
     public void initMock() throws IOException {
         hostUrl = "http://localhost:" + wiremockPort;
@@ -45,12 +51,15 @@ public void initMock() throws IOException {
         ReflectionTestUtils.setField(applicationParams, "draftHost", hostUrl);
     }
 
-    @Configuration
-    static class WireMockTestConfiguration {
+    protected void stubFor(MappingBuilder mappingBuilder) {
+        wireMockServer.stubFor(mappingBuilder);
+    }
+
+    public static class Customizer implements WireMockConfigurationCustomizer {
 
-        @Bean
-        public WireMockConfigurationCustomizer wireMockConfigurationCustomizer() {
-            return config -> config.extensions(new ResponseDefinitionTransformer() {
+        @Override
+        public void customize(WireMockConfiguration configuration, ConfigureWireMock options) {
+            configuration.extensions(new ResponseDefinitionTransformer() {
 
                 @Override
                 public String getName() {

src/contractTest/java/uk/gov/hmcts/ccd/v2/external/controller/CasesControllerProviderTest.java

@@ -8,9 +8,10 @@
 import au.com.dius.pact.provider.junitsupport.loader.PactBroker;
 import au.com.dius.pact.provider.junitsupport.loader.VersionSelector;
 import au.com.dius.pact.provider.spring.junit5.PactVerificationSpringProvider;
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 import com.github.tomakehurst.wiremock.client.WireMock;
 import com.google.common.collect.Lists;
 import lombok.extern.slf4j.Slf4j;
@@ -86,7 +87,6 @@
 import java.util.Optional;
 
 import static com.github.tomakehurst.wiremock.client.WireMock.okJson;
-import static com.github.tomakehurst.wiremock.client.WireMock.stubFor;
 import static com.github.tomakehurst.wiremock.client.WireMock.urlMatching;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
@@ -204,8 +204,9 @@ public class CasesControllerProviderTest extends WireMockBaseContractTest {
     @Qualifier("authorised")
     CaseAssignedUserRolesOperation caseAssignedUserRolesOperation;
 
-    private final ObjectMapper mapper = new ObjectMapper()
-        .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+    private final ObjectMapper mapper = JsonMapper.builderWithJackson2Defaults()
+        .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+        .build();
 
 
     @TestTemplate
@@ -217,7 +218,7 @@ void pactVerificationTestTemplate(PactVerificationContext context) {
     }
 
     @BeforeEach
-    void before(PactVerificationContext context) throws JsonProcessingException {
+    void before(PactVerificationContext context) throws JacksonException {
         if (context != null) {
             context.setTarget(new HttpTestTarget("localhost", 8123, "/"));
         }

src/contractTest/java/uk/gov/hmcts/ccd/v2/external/controller/caseassigned/CaseAssignedUserRolesProviderTest.java

@@ -13,8 +13,8 @@
 import org.junit.jupiter.api.TestTemplate;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.TestPropertySource;