Merge branch 'vulnerabilities' into 'master'

Vulnerability Fixes and Workload Identity Enablement See merge request !631

Merge branch 'vulnerabilities' into 'master'
54ec4663 · Daniel Scholl (MS] · 46436d55 · 5991b6bb · 54ec4663 · 54ec4663
Commit 54ec4663 authored 3 months ago by Daniel Scholl (MS]
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -210,7 +210,7 @@ azure_deploy:
 azure_containerize:
  needs: [ "azure-compile-and-unit-test" ]
  variables:
-    AZURE_CONTAINERIZE_REPOSITORY: "-b jdk-17 https://gitlab-ci-token:${CI_JOB_TOKEN}@community.opengroup.org/osdu/platform/deployment-and-operations/base-containers-azure/service-base-image"
+    AZURE_CONTAINERIZE_REPOSITORY: "https://gitlab-ci-token:${CI_JOB_TOKEN}@community.opengroup.org/osdu/platform/deployment-and-operations/base-containers-azure/service-base-image"
 azure_test:
  image: community.opengroup.org:5555/osdu/platform/deployment-and-operations/base-containers-azure/azure-maven17:v0.0.1

--- a/NOTICE
+++ b/NOTICE
@@ -32,13 +32,11 @@ The following software have components provided under the terms of this license:
 - AWS Java SDK for the AWS Simple Systems Management (SSM) Service (from https://aws.amazon.com/sdkforjava)
 - AWS SDK for Java - Core (from https://aws.amazon.com/sdkforjava)
 - Adapter: RxJava (from https://github.com/square/retrofit)
- Apache Commons BeanUtils (from http://commons.apache.org/proper/commons-beanutils/, https://commons.apache.org/proper/commons-beanutils/, https://repo1.maven.org/maven2/commons-beanutils/commons-beanutils)
 - Apache Commons Codec (from http://commons.apache.org/proper/commons-codec/, https://commons.apache.org/proper/commons-codec/)
 - Apache Commons IO (from http://commons.apache.org/io/, https://commons.apache.org/proper/commons-io/, https://repo1.maven.org/maven2/commons-io/commons-io)
 - Apache Commons Lang (from https://commons.apache.org/proper/commons-lang/)
 - Apache Commons Logging (from http://commons.apache.org/logging/, http://commons.apache.org/proper/commons-logging/, https://commons.apache.org/proper/commons-logging/)
 - Apache Commons Text (from http://commons.apache.org/proper/commons-text, http://commons.apache.org/proper/commons-text/, https://commons.apache.org/proper/commons-text)
- Apache Commons Validator (from http://commons.apache.org/proper/commons-validator/, http://jakarta.apache.org/commons/${pom.artifactId.substring(8)}/, https://repo1.maven.org/maven2/commons-validator/commons-validator)
 - Apache Groovy (from http://groovy-lang.org, http://groovy.codehaus.org/, https://groovy-lang.org)
 - Apache HttpClient (from http://hc.apache.org/httpcomponents-client, http://hc.apache.org/httpcomponents-client-ga)
 - Apache HttpClient Cache (from http://hc.apache.org/httpcomponents-client, http://hc.apache.org/httpcomponents-client-ga)
@@ -46,11 +44,11 @@ The following software have components provided under the terms of this license:
 - Apache Log4j API (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api)
 - Apache Log4j Core (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core)
 - Apache Log4j JUL Handler (from https://logging.apache.org/log4j/3.x/)
+- Apache Log4j SLF4J 2.0 Binding (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-slf4j2-impl)
 - Apache Log4j SLF4J Binding (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-slf4j-impl)
 - Apache Log4j to SLF4J Adapter (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-to-slf4j)
 - AssertJ Core (from https://assertj.github.io/doc/#assertj-core)
 - Asynchronous Http Client (from https://repo1.maven.org/maven2/org/asynchttpclient/async-http-client)
- Asynchronous Http Client Netty Utils (from https://repo1.maven.org/maven2/org/asynchttpclient/async-http-client-netty-utils)
 - Awaitility (from http://awaitility.org)
 - BSON (from http://bsonspec.org, https://bsonspec.org)
 - BSON Record Codec (from <https://www.mongodb.com/>, https://www.mongodb.com/)
@@ -58,8 +56,6 @@ The following software have components provided under the terms of this license:
 - Byte Buddy (without dependencies) (from https://repo1.maven.org/maven2/net/bytebuddy/byte-buddy)
 - Byte Buddy Java agent (from https://repo1.maven.org/maven2/net/bytebuddy/byte-buddy-agent)
 - ClassMate (from http://github.com/cowtowncoder/java-classmate)
- Collections (from https://repo1.maven.org/maven2/commons-collections/commons-collections)
- Commons Digester (from http://commons.apache.org/digester/)
 - Commons Lang (from http://commons.apache.org/lang/)
 - Converter: Jackson (from https://github.com/square/retrofit, https://repo1.maven.org/maven2/com/squareup/retrofit2/converter-jackson)
 - Core functionality for the Reactor Netty library (from https://github.com/reactor/reactor-netty)
@@ -84,23 +80,20 @@ The following software have components provided under the terms of this license:
 - JSON library from Android SDK (from http://developer.android.com/sdk)
 - JSONassert (from http://github.com/skyscreamer/yoga, https://github.com/skyscreamer/JSONassert)
 - JSR107 API and SPI (from https://github.com/jsr107/jsr107spec)
+- JSpecify annotations (from http://jspecify.org/)
 - Jackson dataformat: CBOR (from http://github.com/FasterXML/jackson-dataformats-binary)
 - Jackson datatype: JSR310 (from http://wiki.fasterxml.com/JacksonModuleJSR310, https://repo1.maven.org/maven2/com/fasterxml/jackson/datatype/jackson-datatype-jsr310)
 - Jackson datatype: Joda (from http://wiki.fasterxml.com/JacksonModuleJoda, https://github.com/FasterXML/jackson-datatype-joda)
 - Jackson datatype: jdk8 (from https://repo1.maven.org/maven2/com/fasterxml/jackson/datatype/jackson-datatype-jdk8)
- Jackson module: Afterburner (from http://wiki.fasterxml.com/JacksonHome, https://github.com/FasterXML/jackson-modules-base)
 - Jackson-annotations (from http://github.com/FasterXML/jackson, http://wiki.fasterxml.com/JacksonHome, https://github.com/FasterXML/jackson)
 - Jackson-core (from http://wiki.fasterxml.com/JacksonHome, https://github.com/FasterXML/jackson-core)
- Jackson-dataformat-XML (from http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding, https://github.com/FasterXML/jackson-dataformat-xml)
 - Jackson-dataformat-YAML (from https://github.com/FasterXML/jackson, https://github.com/FasterXML/jackson-dataformats-text)
 - Jackson-module-parameter-names (from https://repo1.maven.org/maven2/com/fasterxml/jackson/module/jackson-module-parameter-names)
 - Jakarta Dependency Injection (from https://github.com/eclipse-ee4j/injection-api)
 - Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet)
 - Jakarta Validation API (from https://beanvalidation.org)
- Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api)
 - Java Native Access (from https://github.com/java-native-access/jna, https://github.com/twall/jna)
 - Java Native Access Platform (from https://github.com/java-native-access/jna)
- JavaBeans Activation Framework (from <http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp>, http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp, https://repo1.maven.org/maven2/com/sun/activation/javax.activation)
 - Javassist (from http://www.javassist.org/, https://www.javassist.org/)
 - JetBrains Java Annotations (from https://github.com/JetBrains/java-annotations)
 - Jetty :: Utilities (from http://jetty.mortbay.org, http://www.eclipse.org/jetty, https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-util, https://repo1.maven.org/maven2/org/mortbay/jetty/jetty-util)
@@ -115,11 +108,9 @@ The following software have components provided under the terms of this license:
 - Microsoft Azure Java Core Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure Netty HTTP Client Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure SDK for SQL API of Azure Cosmos DB Service (from https://github.com/Azure/azure-sdk-for-java)
- Microsoft Azure client library for Identity (from https://github.com/Azure/azure-sdk-for-java)
 - Mockito (from http://mockito.org, https://github.com/mockito/mockito)
 - MongoDB Driver (from https://www.mongodb.com/)
 - MongoDB Java Driver (from http://mongodb.org/, http://www.mongodb.org, https://www.mongodb.com/)
- Netty Reactive Streams Implementation (from https://repo1.maven.org/maven2/com/typesafe/netty/netty-reactive-streams)
 - Netty/Buffer (from https://repo1.maven.org/maven2/io/netty/netty-buffer)
 - Netty/Codec (from https://repo1.maven.org/maven2/io/netty/netty-codec)
 - Netty/Codec/DNS (from https://repo1.maven.org/maven2/io/netty/netty-codec-dns)
@@ -150,7 +141,6 @@ The following software have components provided under the terms of this license:
 - Okio (from https://github.com/square/okio/, https://repo1.maven.org/maven2/com/squareup/okio/okio)
 - OpenCensus (from https://github.com/census-instrumentation/opencensus-java)
 - OpenTelemetry Java (from https://github.com/open-telemetry/opentelemetry-java)
- OpenTelemetry Semantic Conventions Java (from https://github.com/open-telemetry/semantic-conventions-java)
 - Plexus Common Utilities (from http://plexus.codehaus.org/plexus-utils, https://codehaus-plexus.github.io/plexus-utils/, https://repo1.maven.org/maven2/org/codehaus/plexus/plexus-utils)
 - PowerMock (from http://www.powermock.org, https://repo1.maven.org/maven2/org/powermock/powermock-api-mockito)
 - Proton-J (from https://repo1.maven.org/maven2/org/apache/qpid/proton-j)
@@ -198,7 +188,6 @@ The following software have components provided under the terms of this license:
 - Swagger UI (from <http://webjars.org>, http://webjars.org, https://www.webjars.org)
 - Vavr (from http://vavr.io, https://www.vavr.io)
 - Vavr Match (from http://vavr.io)
- Woodstox (from https://github.com/FasterXML/woodstox)
 - error-prone annotations (from https://repo1.maven.org/maven2/com/google/errorprone/error_prone_annotations)
 - io.grpc:grpc-api (from https://github.com/grpc/grpc-java)
 - io.grpc:grpc-context (from https://github.com/grpc/grpc-java)
@@ -207,7 +196,6 @@ The following software have components provided under the terms of this license:
 - java-cloudant (from https://cloudant.com)
 - javatuples (from http://www.javatuples.org)
 - javax.annotation API (from http://jcp.org/en/jsr/detail?id=250)
- javax.inject (from http://code.google.com/p/atinject/, https://repo1.maven.org/maven2/org/glassfish/hk2/external/javax.inject)
 - jose4j (from https://bitbucket.org/b_c/jose4j/)
 - json-path (from http://code.google.com/p/json-path/, https://github.com/jayway/JsonPath)
 - micrometer-commons (from https://github.com/micrometer-metrics/micrometer)
@@ -238,6 +226,7 @@ The following software have components provided under the terms of this license:
 - tomcat-embed-core (from http://tomcat.apache.org/)
 - tomcat-embed-el (from http://tomcat.apache.org/, https://tomcat.apache.org/)
 - tomcat-embed-websocket (from http://tomcat.apache.org/, https://tomcat.apache.org/)
+- webjars-locator-lite (from https://webjars.org)
 ========================================================================
 BSD-2-Clause
@@ -252,7 +241,6 @@ The following software have components provided under the terms of this license:
 - MinLog (from https://github.com/EsotericSoftware/minlog)
 - Plexus Common Utilities (from http://plexus.codehaus.org/plexus-utils, https://codehaus-plexus.github.io/plexus-utils/, https://repo1.maven.org/maven2/org/codehaus/plexus/plexus-utils)
 - ReflectASM (from https://github.com/EsotericSoftware/reflectasm)
- Stax2 API (from http://github.com/FasterXML/stax2-api)
 ========================================================================
 BSD-3-Clause
@@ -265,7 +253,6 @@ The following software have components provided under the terms of this license:
 - FindBugs-jsr305 (from http://findbugs.sourceforge.net/)
 - Hamcrest (from http://hamcrest.org/JavaHamcrest/)
 - Hamcrest Core (from http://hamcrest.org/, http://hamcrest.org/JavaHamcrest/, https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core)
- Jackson module: Afterburner (from http://wiki.fasterxml.com/JacksonHome, https://github.com/FasterXML/jackson-modules-base)
 - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api)
 - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca)
 - Jakarta Messaging API (from https://projects.eclipse.org/projects/ee4j.jms)
@@ -279,13 +266,6 @@ The following software have components provided under the terms of this license:
 - ReflectASM (from https://github.com/EsotericSoftware/reflectasm)
 - Spring Core (from http://www.springframework.org, https://github.com/spring-projects/spring-framework, https://repo1.maven.org/maven2/org/springframework/spring-core)
-========================================================================
-BouncyCastle
-========================================================================
-The following software have components provided under the terms of this license:
- Microsoft Azure client library for Identity (from https://github.com/Azure/azure-sdk-for-java)
 ========================================================================
 CC-BY-2.5
 ========================================================================
@@ -313,8 +293,6 @@ CDDL-1.0
 The following software have components provided under the terms of this license:
 - Apache Log4j Core (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core)
- Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api)
- JavaBeans Activation Framework (from <http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp>, http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp, https://repo1.maven.org/maven2/com/sun/activation/javax.activation)
 - javax.annotation API (from http://jcp.org/en/jsr/detail?id=250)
 ========================================================================
@@ -322,8 +300,6 @@ CDDL-1.1
 ========================================================================
 The following software have components provided under the terms of this license:
- Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api)
- JavaBeans Activation Framework (from <http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp>, http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp, https://repo1.maven.org/maven2/com/sun/activation/javax.activation)
 - javax.annotation API (from http://jcp.org/en/jsr/detail?id=250)
 - tomcat-embed-core (from http://tomcat.apache.org/)
@@ -340,6 +316,7 @@ EDL-1.0
 ========================================================================
 The following software have components provided under the terms of this license:
+- Jakarta Activation (from https://repo1.maven.org/maven2/com/sun/activation/jakarta.activation)
 - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api)
 ========================================================================
@@ -392,8 +369,6 @@ The following software have components provided under the terms of this license:
 - Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet)
 - Jakarta Validation API (from https://beanvalidation.org)
 - Jakarta XML Binding API (from https://repo1.maven.org/maven2/jakarta/xml/bind/jakarta.xml.bind-api, https://repo1.maven.org/maven2/org/jboss/spec/javax/xml/bind/jboss-jaxb-api_2.3_spec)
- Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api)
- JavaBeans Activation Framework (from <http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp>, http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp, https://repo1.maven.org/maven2/com/sun/activation/javax.activation)
 - javax.annotation API (from http://jcp.org/en/jsr/detail?id=250)
 - tomcat-embed-core (from http://tomcat.apache.org/)
@@ -409,7 +384,6 @@ LGPL-2.1-only
 ========================================================================
 The following software have components provided under the terms of this license:
- Java Native Access Platform (from https://github.com/java-native-access/jna)
 - Javassist (from http://www.javassist.org/, https://www.javassist.org/)
 - Logback Classic Module (from http://logback.qos.ch, https://repo1.maven.org/maven2/ch/qos/logback/logback-classic)
 - Logback Contrib :: JSON :: Classic (from https://repo1.maven.org/maven2/ch/qos/logback/contrib/logback-json-classic)
@@ -431,6 +405,7 @@ MIT
 ========================================================================
 The following software have components provided under the terms of this license:
+- Apache HttpClient Cache (from http://hc.apache.org/httpcomponents-client, http://hc.apache.org/httpcomponents-client-ga)
 - Azure Java Client Authentication Library for AutoRest (from https://github.com/Azure/autorest-clientruntime-for-java)
 - Azure Java Client Runtime for ARM (from https://github.com/Azure/autorest-clientruntime-for-java)
 - Azure Java Client Runtime for AutoRest (from https://github.com/Azure/autorest-clientruntime-for-java)
@@ -440,10 +415,13 @@ The following software have components provided under the terms of this license:
 - Jackson-core (from http://wiki.fasterxml.com/JacksonHome, https://github.com/FasterXML/jackson-core)
 - Java Client Runtime for AutoRest (from https://github.com/Azure/autorest-clientruntime-for-java)
 - Java JWT (from http://www.jwt.io, https://github.com/auth0/java-jwt)
+- Lettuce (from http://github.com/lettuce-io/lettuce-core, http://github.com/mp911de/lettuce/wiki, https://github.com/lettuce-io/lettuce-core/wiki)
 - Microsoft Application Insights Java Agent (from https://github.com/Microsoft/ApplicationInsights-Java)
+- Microsoft Azure Identity Brokered Authentication Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure Java Core AMQP Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure Java Core Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure Java JSON Library (from https://github.com/Azure/azure-sdk-for-java)
+- Microsoft Azure Java XML Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure Management Java Core Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure Netty HTTP Client Library (from https://github.com/Azure/azure-sdk-for-java)
 - Microsoft Azure SDK annotations (from https://github.com/Microsoft/java-api-annotations)
@@ -480,12 +458,15 @@ The following software have components provided under the terms of this license:
 - Spring Data for Azure Cosmos DB SQL API (from https://github.com/Azure/azure-sdk-for-java/tree/master/sdk/cosmos/azure-spring-data-cosmos, https://github.com/Azure/azure-sdk-for-java/tree/master/sdk/spring/azure-spring-data-cosmos)
 - System Stubs Core (from https://repo1.maven.org/maven2/uk/org/webcompere/system-stubs-core)
 - adal4j (from https://github.com/AzureAD/azure-activedirectory-library-for-java)
+- javamsalruntime (from https://github.com/AzureAD/microsoft-authentication-library-for-cpp)
 - micrometer-commons (from https://github.com/micrometer-metrics/micrometer)
 - micrometer-core (from https://github.com/micrometer-metrics/micrometer)
 - mockito-inline (from http://mockito.org, https://github.com/mockito/mockito)
 - mockito-junit-jupiter (from https://github.com/mockito/mockito)
 - msal4j (from https://github.com/AzureAD/microsoft-authentication-library-for-java)
+- msal4j-brokers (from https://github.com/AzureAD/microsoft-authentication-library-for-java)
 - msal4j-persistence-extension (from https://github.com/AzureAD/microsoft-authentication-extensions-for-java, https://github.com/AzureAD/microsoft-authentication-library-for-java)
+- webjars-locator-lite (from https://webjars.org)
 ========================================================================
 WTFPL

--- a/legal-core/pom.xml
+++ b/legal-core/pom.xml
@@ -17,7 +17,7 @@
 	<dependencies>
 		<dependency>
 			<groupId>org.opengroup.osdu</groupId>
-			<artifactId>os-core-common-spring6</artifactId>
+			<artifactId>os-core-common</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>org.javassist</groupId>

--- a/pom.xml
+++ b/pom.xml
@@ -8,7 +8,7 @@
        <maven.compiler.source>17</maven.compiler.source>
        <docker.image.prefix>opendes</docker.image.prefix>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <os-core-common.version>0.27.0-rc1</os-core-common.version>
+        <os-core-common.version>3.3.0</os-core-common.version>
        <snakeyaml.version>2.0</snakeyaml.version>
        <resilience4jVersion>1.7.0</resilience4jVersion>
        <openapi.version>1.6.14</openapi.version>
@@ -83,14 +83,14 @@
            </dependency>
            <dependency>
                <groupId>org.opengroup.osdu</groupId>
-                <artifactId>os-core-common-spring6</artifactId>
+                <artifactId>os-core-common</artifactId>
                <version>${os-core-common.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.opengroup.osdu</groupId>
-                <artifactId>os-core-common-spring6</artifactId>
+                <artifactId>os-core-common</artifactId>
                <version>${os-core-common.version}</version>
                <exclusions>
                    <exclusion>

--- a/provider/legal-azure/pom.xml
+++ b/provider/legal-azure/pom.xml
@@ -16,180 +16,163 @@
  -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <parent>
-        <artifactId>legal-service</artifactId>
-        <groupId>org.opengroup.osdu.legal</groupId>
-        <version>0.28.0-SNAPSHOT</version>
-        <relativePath>../../pom.xml</relativePath>
-    </parent>
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>legal-azure</artifactId>
+  <modelVersion>4.0.0</modelVersion>
-    <packaging>jar</packaging>
+  <artifactId>legal-azure</artifactId>
-    <properties>
+  <description>Legal service on Azure</description>
-        <azure.appservice.resourcegroup />
+  <packaging>jar</packaging>
-        <azure.appservice.plan />
-        <azure.appservice.appname />
-        <azure.appservice.subscription />
-        <core-lib-azure-spring6.version>0.27.0-rc7</core-lib-azure-spring6.version>
-        <osdu.legal-core.version>0.28.0-SNAPSHOT</osdu.legal-core.version>
-        <woodstox-core.version>6.4.0</woodstox-core.version>
-        <argLine>--add-opens java.base/java.lang=ALL-UNNAMED</argLine>
-        <spring-cloud-azure-starter-active-directory.version>5.13.0</spring-cloud-azure-starter-active-directory.version>
-        <spring-framework-version>6.1.13</spring-framework-version>
-    </properties>
-    <dependencies>
+  <parent>
-        <dependency>
+    <artifactId>legal-service</artifactId>
-            <groupId>org.opengroup.osdu.legal</groupId>
+    <groupId>org.opengroup.osdu.legal</groupId>
-            <artifactId>legal-core</artifactId>
+    <version>0.28.0-SNAPSHOT</version>
-            <version>${osdu.legal-core.version}</version>
+    <relativePath>../../pom.xml</relativePath>
-            <exclusions>
+  </parent>
-                <exclusion>
-                    <artifactId>os-core-common-spring6</artifactId>
-                    <groupId>org.opengroup.osdu</groupId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>jakarta.inject</groupId>
-            <artifactId>jakarta.inject-api</artifactId>
-            <version>2.0.1</version>
-        </dependency>
-        <dependency>
-            <groupId>jakarta.servlet</groupId>
-            <artifactId>jakarta.servlet-api</artifactId>
-            <version>6.0.0</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>com.azure.spring</groupId>
-            <artifactId>spring-cloud-azure-starter-active-directory</artifactId>
-            <version>${spring-cloud-azure-starter-active-directory.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-webmvc</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-security</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-oauth2-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-oauth2-jose</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.opengroup.osdu</groupId>
-            <artifactId>core-lib-azure-spring6</artifactId>
-            <version>${core-lib-azure-spring6.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>org.projectlombok</groupId>
-            <artifactId>lombok</artifactId>
-            <version>1.18.28</version>
-        </dependency>
-        <!--explicitly load latest compatible version with security fix in it-->
+  <properties>
-        <dependency>
+    <core-lib-azure.version>2.0.2</core-lib-azure.version>
-            <groupId>com.fasterxml.woodstox</groupId>
+    <gson.version>2.11.0</gson.version>
-            <artifactId>woodstox-core</artifactId>
+    <!-- Plugin Versions -->
-            <version>${woodstox-core.version}</version>
+    <surefire-plugin.version>3.0.0</surefire-plugin.version>
-        </dependency>
+    <jacoco-plugin.version>0.8.12</jacoco-plugin.version>
+  </properties>
-        <!-- test -->
+  <dependencyManagement>
-        <dependency>
+    <dependencies>
-            <groupId>org.springframework.boot</groupId>
+      <!-- Core Azure Library -->
-            <artifactId>spring-boot-starter-test</artifactId>
+      <dependency>
-            <scope>test</scope>
+        <groupId>org.opengroup.osdu</groupId>
-        </dependency>
+        <artifactId>core-lib-azure</artifactId>
-        <dependency>
+        <version>${core-lib-azure.version}</version>
-            <groupId>junit</groupId>
+        <type>pom</type>
-            <artifactId>junit</artifactId>
+        <scope>import</scope>
-            <version>4.13.1</version>
+      </dependency>
-            <scope>test</scope>
-        </dependency>
    </dependencies>
+  </dependencyManagement>
+  <dependencies>
+    <!-- OSDU Dependencies -->
+    <dependency>
+      <groupId>org.opengroup.osdu.legal</groupId>
+      <artifactId>legal-core</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.opengroup.osdu</groupId>
+      <artifactId>core-lib-azure</artifactId>
+      <version>${core-lib-azure.version}</version>
+    </dependency>
+    <!-- Spring Dependencies -->
+    <!-- Versions managed by parent pom -->
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.springframework.boot</groupId>
+          <artifactId>spring-boot-starter-logging</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.logging.log4j</groupId>
+          <artifactId>log4j-to-slf4j</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.springdoc</groupId>
+      <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
+    </dependency>
-    <build>
+    <!-- Project Dependencies -->
-        <plugins>
+    <dependency>
-            <plugin>
+      <groupId>com.azure.spring</groupId>
-                <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-cloud-azure-starter-active-directory</artifactId>
-                <artifactId>spring-boot-maven-plugin</artifactId>
+      <!-- Version managed by azure core library -->
-                <executions>
+    </dependency>
-                    <execution>
+    <dependency>
-                        <goals>
+        <groupId>com.google.code.gson</groupId>
-                            <goal>repackage</goal>
+        <artifactId>gson</artifactId>
-                        </goals>
+        <version>${gson.version}</version>
-                        <configuration>
+    </dependency>
-                            <classifier>spring-boot</classifier>
-                            <mainClass>
+    <!-- Test Scoped Dependencies -->
-                                org.opengroup.osdu.legal.azure.LegalApplication
+    <!-- Versions managed by parent pom unless otherwise specified -->
-                            </mainClass>
+    <dependency>
-                        </configuration>
+      <groupId>org.springframework.boot</groupId>
-                    </execution>
+      <artifactId>spring-boot-starter-test</artifactId>
-                </executions>
+      <scope>test</scope>
-            </plugin>
+    </dependency>
-            <plugin>
+    <dependency>
-            <groupId>com.microsoft.azure</groupId>
+      <groupId>junit</groupId>
-            <artifactId>azure-webapp-maven-plugin</artifactId>
+      <artifactId>junit</artifactId>
-            <version>1.7.0</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+  <!-- Build Configuration -->
+  <build>
+    <plugins>
+      <!-- Spring Boot Maven Plugin -->
+      <plugin>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <goals>
+              <goal>repackage</goal>
+            </goals>
            <configuration>
-            <schemaVersion>V2</schemaVersion>
+              <classifier>spring-boot</classifier>
-            <authentication>
+              <mainClass>org.opengroup.osdu.legal.azure.LegalApplication</mainClass>
-                <serverId>azure-auth</serverId>
-            </authentication>
-            <subscriptionId>${azure.appservice.subscription}</subscriptionId>
-            <resourceGroup>${azure.appservice.resourcegroup}</resourceGroup>
-            <appServicePlanName>${azure.appservice.plan}</appServicePlanName>
-            <appName>${azure.appservice.appname}</appName>
-            <appSettings>
-                <property>
-                    <name>JAVA_OPTS</name>
-                    <value>-Dserver.port=80</value>
-                </property>
-            </appSettings>
-                <deployment>
-                    <resources>
-                        <resource>
-                            <directory>${project.basedir}/target</directory>
-                            <includes>
-                                <include>*spring-boot.jar</include>
-                            </includes>
-                        </resource>
-                    </resources>
-                </deployment>
            </configuration>
-            </plugin>
+          </execution>
-            <plugin>
+        </executions>
-                <groupId>org.jacoco</groupId>
+      </plugin>
-                <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.10</version>
+      <!-- Surefire Plugin -->
-                <configuration>
+      <plugin>
-                    <excludes>
+        <groupId>org.apache.maven.plugins</groupId>
-                        <exclude>org/opengroup/osdu/legal/azure/LegalApplication.class</exclude>
+        <artifactId>maven-surefire-plugin</artifactId>
-                        <exclude>**/**Config*</exclude>
+        <version>${surefire-plugin.version}</version>
-                    </excludes>
+        <dependencies>
-                </configuration>
+					<dependency>
-                <executions>
+						<groupId>org.junit.vintage</groupId>
-                    <execution>
+						<artifactId>junit-vintage-engine</artifactId>
-                        <goals>
+						<version>5.9.1</version>
-                            <goal>prepare-agent</goal>
+					</dependency>
-                        </goals>
+				</dependencies>
-                    </execution>
+        <configuration>
-                    <execution>
+          <argLine>@{argLine} --add-opens java.base/java.lang=ALL-UNNAMED</argLine>
-                        <id>report</id>
+        </configuration>
-                        <phase>prepare-package</phase>
+      </plugin>
-                        <goals>
-                            <goal>report</goal>
+      <!-- JaCoCo Plugin -->
-                        </goals>
+      <plugin>
-                    </execution>
+        <groupId>org.jacoco</groupId>
-                </executions>
+        <artifactId>jacoco-maven-plugin</artifactId>
-            </plugin>
+        <version>${jacoco-plugin.version}</version>
-        </plugins>
+        <configuration>
-    </build>
+          <excludes>
+            <exclude>org/opengroup/osdu/legal/azure/LegalApplication.class</exclude>
+            <exclude>**/**Config*</exclude>
+          </excludes>
+        </configuration>
+        <executions>
+          <execution>
+            <goals>
+              <goal>prepare-agent</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>report</id>
+            <phase>prepare-package</phase>
+            <goals>
+              <goal>report</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
 </project>
--- a/provider/legal-ibm/pom.xml
+++ b/provider/legal-ibm/pom.xml
@@ -25,6 +25,11 @@
 			<artifactId>os-core-lib-ibm</artifactId>
 			<version>${os-core-lib-ibm.version}</version>
 		</dependency>
+		<dependency>
+			<groupId>org.opengroup.osdu</groupId>
+			<artifactId>os-core-common-spring6</artifactId>
+			<version>0.26.0</version>
+		</dependency>
 		<dependency>
 			<groupId>net.minidev</groupId>
 			<artifactId>json-smart</artifactId>