Upgrade various libraries

acceptance-tests/build.gradle

@@ -25,10 +25,10 @@ dependencies {
   testImplementation project(":commandline")
   testImplementation project(":common")
 
-  testImplementation 'org.apache.tuweni:tuweni-bytes'
-  testImplementation 'org.apache.tuweni:tuweni-units'
+  testImplementation 'io.tmio:tuweni-bytes'
+  testImplementation 'io.tmio:tuweni-units'
 
-  testImplementation 'commons-io:commons-io:2.6'
+  testImplementation 'commons-io:commons-io'
 
   testRuntimeOnly 'javax.activation:activation'
   testRuntimeOnly 'org.apache.logging.log4j:log4j-core'
@@ -58,8 +58,8 @@ dependencies {
   testImplementation 'tech.pegasys.teku.internal:async'
   testImplementation 'io.rest-assured:rest-assured'
   testImplementation 'org.web3j:core'
-  testImplementation 'org.apache.tuweni:tuweni-bytes'
-  testImplementation 'org.apache.tuweni:tuweni-net'
+  testImplementation 'io.tmio:tuweni-bytes'
+  testImplementation 'io.tmio:tuweni-net'
   testImplementation 'com.github.arteam:simple-json-rpc-server'
   testImplementation 'com.github.arteam:simple-json-rpc-client'
   testImplementation 'org.flywaydb:flyway-core'

build.gradle

@@ -31,13 +31,13 @@ buildscript {
 plugins {
   id 'org.owasp.dependencycheck' version "11.1.0"
   id 'java-test-fixtures'
-  id 'com.diffplug.spotless' version '7.0.0.BETA1'
+  id 'com.diffplug.spotless' version '7.0.0.BETA4'
   id 'com.github.ben-manes.versions' version '0.51.0' //`./gradlew dependencyUpdates` to report outdated dependencies
   id 'com.github.jk1.dependency-license-report' version '2.8'
   id 'io.spring.dependency-management' version '1.1.6'
   id 'me.champeau.jmh' version '0.7.2' apply false
-  id 'net.ltgt.errorprone' version '4.0.1'
-  id 'org.ajoberstar.grgit' version '5.2.2'
+  id 'net.ltgt.errorprone' version '4.1.0'
+  id 'org.ajoberstar.grgit' version '5.3.0'
 }
 
 if (!JavaVersion.current().isCompatibleWith(JavaVersion.VERSION_21)) {

common/build.gradle

@@ -17,8 +17,8 @@ jar {
 dependencies {
 
   implementation 'com.fasterxml.jackson.core:jackson-databind'
-  implementation 'org.apache.tuweni:tuweni-bytes'
-  implementation 'org.apache.tuweni:tuweni-net'
+  implementation 'io.tmio:tuweni-bytes'
+  implementation 'io.tmio:tuweni-net'
   implementation 'org.hyperledger.besu.internal:metrics-core'
   implementation 'org.hyperledger.besu:plugin-api'
 }

core/build.gradle

@@ -34,9 +34,9 @@ dependencies {
   implementation 'org.apache.commons:commons-lang3'
   implementation 'org.apache.logging.log4j:log4j-api'
   implementation 'org.apache.logging.log4j:log4j-core'
-  implementation 'org.apache.tuweni:tuweni-bytes'
-  implementation 'org.apache.tuweni:tuweni-io'
-  implementation 'org.apache.tuweni:tuweni-net'
+  implementation 'io.tmio:tuweni-bytes'
+  implementation 'io.tmio:tuweni-io'
+  implementation 'io.tmio:tuweni-net'
   implementation 'org.hyperledger.besu.internal:metrics-core'
   implementation 'org.hyperledger.besu:plugin-api'
   implementation 'org.jdbi:jdbi3-core'

gradle/versions.gradle

@@ -13,10 +13,10 @@
 
 dependencyManagement {
   dependencies {
-    dependency 'com.fasterxml.jackson.core:jackson-databind:2.17.2'
-    dependency 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.17.2'
+    dependency 'com.fasterxml.jackson.core:jackson-databind:2.18.2'
+    dependency 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2'
 
-    dependencySet(group: 'com.google.errorprone', version: '2.29.2') {
+    dependencySet(group: 'com.google.errorprone', version: '2.36.0') {
       entry 'error_prone_annotation'
       entry 'error_prone_check_api'
       entry 'error_prone_core'
@@ -25,12 +25,12 @@ dependencyManagement {
 
     dependency 'tech.pegasys.tools.epchecks:errorprone-checks:1.1.1'
 
-    dependency 'com.google.guava:guava:33.2.1-jre'
+    dependency 'com.google.guava:guava:33.3.1-jre'
 
     dependency 'commons-cli:commons-cli:1.5.0'
-    dependency 'commons-io:commons-io:2.16.1'
-    dependency 'org.apache.commons:commons-lang3:3.15.0'
-    dependency 'commons-logging:commons-logging:1.3.3'
+    dependency 'commons-io:commons-io:2.18.0'
+    dependency 'org.apache.commons:commons-lang3:3.17.0'
+    dependency 'commons-logging:commons-logging:1.3.4'
 
     dependency 'info.picocli:picocli:4.7.6'
 
@@ -48,14 +48,14 @@ dependencyManagement {
 
     dependency 'javax.activation:activation:1.1.1'
 
-    dependencySet(group: 'org.apache.logging.log4j', version: '2.23.1') {
+    dependencySet(group: 'org.apache.logging.log4j', version: '2.24.2') {
       entry 'log4j-api'
       entry 'log4j'
       entry 'log4j-core'
       entry 'log4j-slf4j2-impl'
     }
 
-    dependencySet(group: 'org.apache.tuweni', version: '2.3.1') {
+    dependencySet(group: 'io.tmio', version: '2.4.2') {
       entry 'tuweni-net'
       entry 'tuweni-bytes'
       entry 'tuweni-crypto'
@@ -65,23 +65,23 @@ dependencyManagement {
 
     dependency 'org.assertj:assertj-core:3.26.3'
 
-    dependency 'org.awaitility:awaitility:4.2.1'
+    dependency 'org.awaitility:awaitility:4.2.2'
 
-    dependencySet(group: 'org.bouncycastle', version: '1.78.1') {
+    dependencySet(group: 'org.bouncycastle', version: '1.79') {
       entry 'bcpkix-jdk18on'
       entry 'bcprov-jdk18on'
     }
 
-    dependencySet(group: 'org.junit.jupiter', version: '5.10.3') {
+    dependencySet(group: 'org.junit.jupiter', version: '5.11.3') {
       entry 'junit-jupiter-api'
       entry 'junit-jupiter-engine'
       entry 'junit-jupiter-params'
     }
-    dependency 'org.junit.vintage:junit-vintage-engine:5.10.3'
+    dependency 'org.junit.vintage:junit-vintage-engine:5.11.3'
 
     dependency 'org.mock-server:mockserver-netty:5.15.0'
 
-    dependencySet(group: 'org.mockito', version: '5.12.0') {
+    dependencySet(group: 'org.mockito', version: '5.14.2') {
       entry 'mockito-core'
       entry 'mockito-inline'
       entry 'mockito-junit-jupiter'
@@ -114,7 +114,7 @@ dependencyManagement {
 
     dependency 'io.rest-assured:rest-assured:5.5.0'
     dependency 'org.zeroturnaround:zt-exec:1.12'
-    dependencySet(group: 'org.web3j', version: '4.12.0') {
+    dependencySet(group: 'org.web3j', version: '4.12.2') {
       entry 'besu'
       entry ('core') {
         exclude group: 'com.github.jnr', name: 'jnr-unixsocket'
@@ -128,32 +128,32 @@ dependencyManagement {
     dependency 'com.github.arteam:simple-json-rpc-server:1.3'
     dependency 'com.github.arteam:simple-json-rpc-client:1.3'
 
-    dependency 'com.azure:azure-security-keyvault-secrets:4.8.7'
-    dependency 'com.azure:azure-security-keyvault-keys:4.8.8'
-    dependency 'com.azure:azure-identity:1.14.0'
+    dependency 'com.azure:azure-security-keyvault-secrets:4.9.0'
+    dependency 'com.azure:azure-security-keyvault-keys:4.9.0'
+    dependency 'com.azure:azure-identity:1.14.2'
 
-    dependency 'com.zaxxer:HikariCP:5.1.0'
-    dependency 'org.postgresql:postgresql:42.7.3'
+    dependency 'com.zaxxer:HikariCP:6.2.1'
+    dependency 'org.postgresql:postgresql:42.7.4'
 
-    dependencySet(group: 'org.jdbi', version: '3.45.2') {
+    dependencySet(group: 'org.jdbi', version: '3.47.0') {
       entry 'jdbi3-core'
       entry 'jdbi3-sqlobject'
       entry 'jdbi3-testing'
     }
 
-    dependency 'org.flywaydb:flyway-core:10.16.0'
-    dependency 'org.flywaydb:flyway-database-postgresql:10.16.0'
+    dependency 'org.flywaydb:flyway-core:11.0.0'
+    dependency 'org.flywaydb:flyway-database-postgresql:11.0.0'
 
-    dependency 'com.google.cloud:google-cloud-secretmanager:2.51.0'
+    dependency 'com.google.cloud:google-cloud-secretmanager:2.54.0'
     dependency 'com.google.protobuf:protobuf-java:3.25.5' // fixes CVE-2024-7254 - transitive from google-cloud-secretmanager
 
-    dependency 'io.zonky.test.postgres:embedded-postgres-binaries-bom:11.22.1'
-    dependency 'io.zonky.test:embedded-postgres:2.0.7'
+    dependency 'io.zonky.test.postgres:embedded-postgres-binaries-bom:17.2.0'
+    dependency 'io.zonky.test:embedded-postgres:2.1.0'
 
-    dependency 'com.github.ipld:java-cid:1.3.3'
+    dependency 'com.github.ipld:java-cid:1.3.8'
     dependency 'net.jodah:failsafe:2.4.4'
 
-    dependencySet(group: 'software.amazon.awssdk', version: '2.26.21') {
+    dependencySet(group: 'software.amazon.awssdk', version: '2.29.23') {
       entry 'bom'
       entry 'auth'
       entry 'secretsmanager'
@@ -202,7 +202,7 @@ dependencyManagement {
 
     // manual overriding of commons-net to avoid CVE-2021-37533
     /* commons-net:commons-net:3.8.0
-       \-- org.apache.tuweni:tuweni-net:2.3.1
+       \-- io.tmio:tuweni-net:2.3.1
      */
     dependency 'commons-net:commons-net:3.9.0'
 

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.9-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

gradlew

@@ -15,6 +15,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
 #
@@ -84,7 +86,8 @@ done
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
 # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
+' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum

gradlew.bat

@@ -13,6 +13,8 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 @rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
 
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################

keystorage/build.gradle

@@ -41,8 +41,8 @@ dependencies {
   implementation 'org.apache.commons:commons-lang3'
   implementation 'org.apache.logging.log4j:log4j-api'
   implementation 'org.apache.logging.log4j:log4j-api'
-  implementation 'org.apache.tuweni:tuweni-bytes'
-  implementation 'org.apache.tuweni:tuweni-net'
+  implementation 'io.tmio:tuweni-bytes'
+  implementation 'io.tmio:tuweni-net'
   implementation 'org.bouncycastle:bcpkix-jdk18on'
   implementation 'org.bouncycastle:bcprov-jdk18on'
   implementation 'org.xipki.iaik:sunpkcs11-wrapper'
@@ -80,7 +80,7 @@ dependencies {
 
   testFixturesImplementation 'com.fasterxml.jackson.core:jackson-databind'
   testFixturesImplementation 'org.apache.logging.log4j:log4j-api'
-  testFixturesImplementation 'org.apache.tuweni:tuweni-net'
+  testFixturesImplementation 'io.tmio:tuweni-net'
   testFixturesImplementation 'org.assertj:assertj-core'
   testFixturesImplementation 'org.awaitility:awaitility'
   testFixturesImplementation 'org.bouncycastle:bcpkix-jdk18on'

signing/build.gradle

@@ -35,7 +35,7 @@ dependencies {
   implementation 'tech.pegasys.teku.internal:spec'
   implementation 'tech.pegasys.teku.internal:unsigned'
   implementation 'com.azure:azure-security-keyvault-keys'
-  implementation 'org.apache.tuweni:tuweni-net'
+  implementation 'io.tmio:tuweni-net'
   implementation 'com.google.guava:guava'
   implementation 'org.bouncycastle:bcprov-jdk18on'
   implementation 'com.github.ben-manes.caffeine:caffeine:3.1.5'
@@ -61,7 +61,7 @@ dependencies {
   testFixturesImplementation 'org.apache.commons:commons-lang3'
   testFixturesImplementation 'org.apache.logging.log4j:log4j-api'
   testFixturesImplementation 'org.apache.logging.log4j:log4j-core'
-  testFixturesImplementation 'org.apache.tuweni:tuweni-bytes'
+  testFixturesImplementation 'io.tmio:tuweni-bytes'
   testFixturesImplementation 'tech.pegasys.teku.internal:bls-keystore'
   testFixturesImplementation 'software.amazon.awssdk:auth'
   testFixturesImplementation 'software.amazon.awssdk:secretsmanager'

slashing-protection/build.gradle

@@ -23,11 +23,11 @@ dependencies {
   implementation 'com.google.guava:guava'
   implementation 'com.zaxxer:HikariCP'
   implementation 'commons-io:commons-io'
-  implementation 'net.jodah:failsafe:2.4.0'
+  implementation 'net.jodah:failsafe'
   implementation 'org.apache.commons:commons-lang3'
   implementation 'org.apache.logging.log4j:log4j-api'
   implementation 'org.apache.logging.log4j:log4j-core'
-  implementation 'org.apache.tuweni:tuweni-units'
+  implementation 'io.tmio:tuweni-units'
   implementation 'org.hyperledger.besu.internal:metrics-core'
   implementation 'org.hyperledger.besu:plugin-api'
   implementation 'org.jdbi:jdbi3-core'

slashing-protection/referencetests/build.gradle

@@ -25,7 +25,7 @@ dependencies {
   testImplementation enforcedPlatform('io.zonky.test.postgres:embedded-postgres-binaries-bom')
   testImplementation 'io.zonky.test:embedded-postgres'
   testImplementation 'org.jdbi:jdbi3-core'
-  testImplementation 'org.apache.tuweni:tuweni-units'
+  testImplementation 'io.tmio:tuweni-units'
   testImplementation 'com.fasterxml.jackson.core:jackson-databind'
   testImplementation 'org.apache.logging.log4j:log4j-api'
   testImplementation 'org.apache.logging.log4j:log4j-core'

slashing-protection/src/main/java/tech/pegasys/web3signer/slashingprotection/DbConnection.java

@@ -42,7 +42,7 @@
 public class DbConnection {
   // https://jdbc.postgresql.org/documentation/head/connect.html#connection-parameters
   private static final String PG_SOCKET_TIMEOUT_PARAM = "socketTimeout";
-  static final long DEFAULT_PG_SOCKET_TIMEOUT_SECONDS = Duration.ofMinutes(5).getSeconds();
+  static final long DEFAULT_PG_SOCKET_TIMEOUT_SECONDS = Duration.ofMinutes(5).toSeconds();
 
   public static Jdbi createConnection(
       final String jdbcUrl,