MCP-440 Update dependencies resolution

[nquinquenel]

No description provided.

[hashicorp-vault-sonar-prod]

MCP-440

[nquinquenel]

@sonar-review-alpha review

[sonar-review-alpha]

Summary

This PR fixes security vulnerabilities by enforcing patched versions of transitive dependencies that are pulled in indirectly through the build chain.

Changes:

• Main build (build.gradle.kts): Added dependency resolution overrides for 4 vulnerable libraries:

  • Kotlin stdlib → 2.2.0 (CVE-2020-29582)
  • Jackson core (fasterxml) → 2.21.1 (GHSA-72hv-8253-57qq)
  • Jackson core (tools) → 3.1.2 (CVE-2026-29062 + GHSA-72hv-8253-57qq)
  • commons-compress → 1.28.0 (CVE-2024-25710 + CVE-2024-26308)

• Integration tests (its/build.gradle.kts): Added the same commons-compress override

• Version bump: mcp-server 1.1.1 → 1.1.2

What reviewers should know

For reviewers:

• The approach uses Gradle's resolutionStrategy.eachDependency to force safe versions of libraries pulled in transitively (e.g., via xodus-entity-store, mcp-json-jackson2, sonarlint-rpc-impl, sonarlint-core)
• Each override includes a CVE/advisory reference in a because() comment for traceability
• The overrides apply globally across all configurations in both the main build and integration tests
• This is a non-invasive way to address transitive dependency vulnerabilities without requiring upstream projects to update first

Things to check:

• Verify the chosen versions (2.2.0, 2.21.1, 3.1.2, 1.28.0) are indeed patched versions addressing the cited CVEs
• Confirm these versions are compatible with the code and don't introduce any breaking changes
• The mcp-server bump may be related to this fix—check the changelog if available

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sophio-japharidze-sonarsource]

🔥 🧯 🧑‍🚒

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

LGTM! ✅

The commons-compress duplication flagged in the previous review round is still present — the two blocks now have identical because() text (that part is addressed), but the structural duplication across build.gradle.kts and its/build.gradle.kts remains, meaning a version bump still requires two-place edits.

🗣️ Give feedback