build: update Gradle and patch SDK dependency vulnerabilities (#52)

* chore(deps): bump gradle-wrapper from 9.6.1 to 9.7.0

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.6.1...v9.7.0)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build: patch SDK dependency vulnerabilities

* build: fix Kotlin toolchain vulnerability

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kriptoburak <kriptoburak@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/codeql.yml

@@ -41,14 +41,14 @@ jobs:
           cache-cleanup: always
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: java-kotlin
           build-mode: manual
           queries: security-extended
 
       - name: Build analyzed sources
-        run: ./gradlew clean classes --no-daemon --no-build-cache
+        run: sed -i 's/2.4.20-Beta2/2.4.10/g' buildSrc/build.gradle.kts ./*/gradle.lockfile && ./gradlew clean classes --write-verification-metadata sha256 --no-daemon --no-build-cache
 
       - name: Analyze
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/scorecard.yml

@@ -42,6 +42,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: results.sarif

build.gradle.kts

@@ -58,6 +58,9 @@ allprojects {
             "org.apache.commons:commons-lang3:3.20.0",
             "org.apache.logging.log4j:log4j-api:2.26.1",
             "org.apache.logging.log4j:log4j-core:2.26.1",
+            "org.apache.httpcomponents.client5:httpclient5:5.6.4",
+            "org.apache.httpcomponents.core5:httpcore5:5.4.3",
+            "org.apache.httpcomponents.core5:httpcore5-h2:5.4.3",
             "org.jsoup:jsoup:1.23.1",
             "org.xmlunit:xmlunit-core:2.13.0",
             "org.xmlunit:xmlunit-legacy:2.13.0",
@@ -82,19 +85,25 @@ val coverageExecutionData =
     fileTree(rootDir) {
         include("x-twitter-scraper-java*/build/jacoco/test.exec")
     }
+val coverageProjects =
+    subprojects.filterNot { it.name == "x-twitter-scraper-java-proguard-test" }
 val allCoverageClasses =
-    fileTree(rootDir) {
-        include("x-twitter-scraper-java*/build/classes/java/main/**/*.class")
-        include("x-twitter-scraper-java*/build/classes/kotlin/main/**/*.class")
-    }
+    files(
+        coverageProjects.flatMap { project ->
+            listOf(
+                project.layout.buildDirectory.dir("classes/java/main"),
+                project.layout.buildDirectory.dir("classes/kotlin/main"),
+            )
+        }
+    )
 val generatedSourceHeaderPrefix = "// File generated from our OpenAPI spec"
 val generatedSourceHeaderLineLimit = 12
 val maintainedGeneratedSources =
     setOf(
         "x-twitter-scraper-java-core/src/main/kotlin/com/x_twitter_scraper/api/core/http/RetryingHttpClient.kt"
     )
 val generatedCoverageExclusions =
-    subprojects.associateWith { project ->
+    coverageProjects.associateWith { project ->
         listOf("src/main/java", "src/main/kotlin").flatMap { sourcePath ->
             val sourceRoot = project.file(sourcePath)
             if (!sourceRoot.isDirectory) {
@@ -124,7 +133,7 @@ val generatedCoverageExclusions =
     }
 val maintainedCoverageClasses =
     files(
-        subprojects.flatMap { project ->
+        coverageProjects.flatMap { project ->
             val exclusions = generatedCoverageExclusions.getValue(project)
             listOf(
                 project.fileTree(project.layout.buildDirectory.dir("classes/java/main")) {
@@ -138,17 +147,15 @@ val maintainedCoverageClasses =
     )
 val coverageSources =
     files(
-        subprojects.flatMap { project ->
+        coverageProjects.flatMap { project ->
             listOf(
                 project.layout.projectDirectory.dir("src/main/java"),
                 project.layout.projectDirectory.dir("src/main/kotlin"),
             )
         }
     )
 val testTasks =
-    subprojects
-        .filterNot { it.name == "x-twitter-scraper-java-proguard-test" }
-        .map { "${it.path}:test" }
+    coverageProjects.map { "${it.path}:test" }
 
 val coverageReport =
     tasks.register<JacocoReport>("coverageReport") {

buildSrc/build.gradle.kts

@@ -4,6 +4,12 @@
 
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
+buildscript {
+    configurations.classpath {
+        resolutionStrategy.force("org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.20-Beta2")
+    }
+}
+
 plugins {
     `kotlin-dsl`
 }
@@ -53,6 +59,6 @@ configurations.configureEach {
 
 dependencies {
     implementation("org.jetbrains.dokka:dokka-gradle-plugin:2.2.0")
-    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.0")
+    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.20-Beta2")
     implementation("com.vanniktech:gradle-maven-publish-plugin:0.37.0")
 }