Merge pull request #717 from hmcts/DTSRD-295

addresses CVE-2023-20873,  CVE-2023-20862

build.gradle

@@ -18,7 +18,7 @@ plugins {
     id "info.solidsoft.pitest" version '1.7.0'
     id 'io.spring.dependency-management' version '1.1.0'
     id 'org.sonarqube' version '3.3'
-    id 'org.springframework.boot' version '2.7.7'
+    id 'org.springframework.boot' version '2.7.11'
     id "org.flywaydb.flyway" version '8.5.4'
     id 'au.com.dius.pact' version '4.1.7' // do not change, otherwise serenity report fails
     id 'org.owasp.dependencycheck' version '8.0.1'
@@ -37,7 +37,7 @@ def versions = [
   reformLogging      : '6.0.1',
   serenity           : '2.0.76',
   sonarPitest        : '0.5',
-  springBoot         : '2.7.7',
+  springBoot         : '2.7.11',
   pact_version       : '4.1.7',
   launchDarklySdk    : '5.10.7',
   restAssured        : '4.3.3',
@@ -342,7 +342,7 @@ dependencies {
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-jdbc'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: versions.springBoot
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-cache', version: versions.springBoot
-  implementation group: 'org.springframework.security', name: 'spring-security-core', version: '5.7.5'
+  implementation group: 'org.springframework.security', name: 'spring-security-core', version: '5.7.8'
 
   implementation group: 'org.springframework', name: 'spring-aop', version: versions.springVersion
   implementation group: 'org.springframework', name: 'spring-aspects', version: versions.springVersion