feat: upgrade java client for china auth (#25)

* feat: upgrade java client version

* fix: added owasp dependency check and resolved critical vulnerabilities

build.gradle

@@ -50,5 +50,6 @@ apply from: file('gradle/dependencies.gradle')
 apply from: file('gradle/check.gradle')
 apply from: file('gradle/integration.gradle')
 apply from: file('gradle/bintray.gradle')
+apply from: file('gradle/owasp-dependency-check.gradle')
 
 group = groupId

gradle.properties

@@ -14,7 +14,7 @@
 # limitations under the License.
 #
 
-version=7.0.1
+version=7.1.0
 groupId=com.nike
 artifactId=cerberus-archaius-client
 

gradle/buildscript.gradle

@@ -23,4 +23,5 @@ dependencies {
     classpath 'com.jfrog.bintray.gradle:gradle-bintray-plugin:1.8.5'
     classpath 'org.kt3k.gradle.plugin:coveralls-gradle-plugin:2.6.3'
     classpath "com.diffplug.spotless:spotless-plugin-gradle:3.30.0"
+    classpath 'org.owasp:dependency-check-gradle:5.3.2'
 }

gradle/dependencies.gradle

@@ -21,9 +21,29 @@ repositories {
     }
 }
 
+configurations.all {
+    resolutionStrategy {
+        force "ch.qos.logback:logback-core:1.2.3"
+        force "ch.qos.logback:logback-classic:1.2.3"
+        force "net.sourceforge.pmd:pmd-core:6.21.0"
+        force "net.sourceforge.pmd:pmd-java:6.21.0"
+        force "com.fasterxml.jackson:jackson-core:2.11.1"
+        force "com.fasterxml.jackson:jackson-annotations:2.11.1"
+        force "com.fasterxml.jackson.core:jackson-databind:2.11.1"
+        force "org.apache.httpcomponents:httpclient:4.5.12"
+
+        dependencySubstitution {
+            substitute module("org.mortbay.jetty:jetty") with module("org.eclipse.jetty:jetty-server:9.4.30.v20200611")
+            substitute module("org.mortbay.jetty:jetty-util") with module("org.eclipse.jetty:jetty-util:9.4.30.v20200611")
+            substitute module("org.mortbay.jetty:jetty-http") with module("org.eclipse.jetty:jetty-http:9.4.30.v20200611")
+        }
+    }
+    exclude group: 'org.mortbay.jetty', module:'servlet-api-2.5'
+}
+
 dependencies {
     compile 'com.netflix.archaius:archaius-aws:0.6.5'
-    compile 'com.nike:cerberus-client:7.1.1'
+    compile 'com.nike:cerberus-client:7.3.1'
 
     compile "org.apache.commons:commons-lang3:3.5"
     compile "com.squareup.okhttp3:okhttp:3.9.0"

gradle/owasp-dependency-check.gradle

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2020 Nike, inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+allprojects {
+    apply plugin: "org.owasp.dependencycheck"
+
+    dependencyCheck {
+        failOnError = false
+        format = 'ALL'
+        failBuildOnCVSS = 7
+    }
+}
+
+tasks.check.dependsOn dependencyCheckAnalyze