Merge branch 'develop' into fb_reviewLocal

Author: labkey-jeckels

CLAUDE.md

@@ -74,7 +74,14 @@ Dual database support (PostgreSQL and MS SQL Server). Configuration lives in `se
 
 Mix of JSPs, React (via `@labkey/components`, `@labkey/premium`), ExtJS, and vanilla JS. Modules with TypeScript have their own `package.json` and use Webpack builds (via `@labkey/build`). TypeScript code is linted and formatted with `@labkey/eslint-config`. Node.js and npm versions are pinned in `gradle.properties` and downloaded during build.
 
-The path to the local copy of the `@labkey/components` package is located in the `LABKEY_UI_COMPONENTS_HOME` environment variable. The path to the local copy of `@labkey/premium` is located in the `LABKEY_UI_PREMIUM_HOME` environment variable. The local copies of the packages may contain changes related to the current branches in any of the modules that have an NPM build. For example there may be changes to the `@labkey/components` package that affect the package in the `server/modules/platform/core` module.
+We keep local copies of the `@labkey` packages in the `clientAPIs/` directory. You can find the following packages in this directory:
+- `@labkey/api`: `clientAPIs/labkey-api-js/`
+- `@labkey/components`: `clientAPIs/labkey-ui-components/packages/components/`
+- `@labkey/build`: `clientAPIs/labkey-ui-components/packages/build/`
+- `@labkey/eslint-config`: `clientAPIs/labkey-ui-components/packages/eslint-config/`
+- `@labkey/premium`: `clientAPIs/labkey-ui-premium/`
+
+The local copies of the packages may contain changes related to the current branches in any of the modules that have an NPM build. For example there may be changes to the `@labkey/components` package that affect the package in the `server/modules/platform/core` module. These packages are not required to be present to build the project, so they may not be available. If they are not present, you can assume that there are no changes in those packages relevant to the current branch. If you suspect an issue is with one of the packages, but it is not present you may prompt the user to check out a local copy of the relevant package.
 
 ### Distributions
 

build.gradle

@@ -79,7 +79,6 @@ allprojects {
     configurations
             {
                 driver
-                utilities
             }
     configurations.configureEach {
         // exclude log4j 1.x, which may come in transitively, from all configurations to avoid its potential vulnerabilities
@@ -88,17 +87,11 @@ allprojects {
         exclude group: "org.springframework.boot", module:"spring-boot-starter-logging"
     }
     configurations.driver.setDescription("Dependencies used for Gradle SetUpProperties task")
-    configurations.utilities.setDescription("Utility binaries for use on Windows platform")
 
     dependencies
             {
                 driver "org.postgresql:postgresql:${postgresqlDriverVersion}"
                 driver "com.microsoft.sqlserver:mssql-jdbc:${mssqlJdbcVersion}"
-
-                if (SystemUtils.IS_OS_WINDOWS)
-                {
-                    utilities "org.labkey.tools.windows:utils:${windowsUtilsVersion}@zip"
-                }
             }
 
     // We apply the base module here so we get the configurations (in particular external and modules)

gradle.properties

@@ -47,9 +47,6 @@ buildFromSource=true
 labkeyVersion=26.5-SNAPSHOT
 labkeyClientApiVersion=7.2.0
 
-# Version numbers for the various binary artifacts that are included when
-# deploying via deployApp or deployDist and when creating distributions.
-windowsUtilsVersion=1.0
 # Uncomment the following line to download proteomics binaries
 #includeProteomicsBinaries
 linuxProteomicsBinariesVersion=2.0
@@ -59,7 +56,7 @@ windowsProteomicsBinariesVersion=1.0
 # The current version numbers for the gradle plugins.
 artifactoryPluginVersion=5.2.5
 gradleNodePluginVersion=7.1.0
-gradlePluginsVersion=8.0.0
+gradlePluginsVersion=8.1.0
 owaspDependencyCheckPluginVersion=12.2.1
 
 # Versions of node and npm to use during the build. If set, these versions
@@ -167,15 +164,14 @@ googleOauthClientVersion=1.39.0
 googleProtocolBufVersion=3.25.9
 
 graphSupportVersion=1.5.2
+grpcVersion=1.80.0
 
 # Cloud and SequenceAnalysis bring gson in as a transitive dependency.
 # We resolve to the later version here to keep things consistent
 # Note: Current jclouds seems to require 2.8.9; attempting to upgrade to 2.9.0 cratered the S3 test suite with many
 # "java.lang.NoSuchMethodError: 'void com.google.gson.internal.ConstructorConstructor.<init>(java.util.Map)'" errors
 gsonVersion=2.8.9
 
-grpcVersion=1.80.0
-
 guavaVersion=33.6.0-jre
 
 # Note: You won't find usages in the product sources; this property is used by the gradle plugin.
@@ -268,7 +264,7 @@ modelContextProtocolVersion=1.1.1
 
 mssqlJdbcVersion=13.4.0.jre11
 
-# Netty - transitive dependency via azure-core-http-netty; force to mitigate multiple CVEs in older versions
+# Netty - transitive dependency via azure-core-http-netty; force for CVE-2026-33871, CVE-2026-33870
 nettyVersion=4.2.12.Final
 # Reactor - transitive dependency via azure-core; force for version consistency across modules
 reactorCoreVersion=3.8.1

server/build.gradle

@@ -39,9 +39,9 @@ dependencies
 
 configurations
         {
-            binaries.extendsFrom(utilities)
+            binaries
         }
-configurations.binaries.setDescription("Utility and proteomics binaries")
+configurations.binaries.setDescription("Proteomics binaries")
 
 if (project.hasProperty('includeProteomicsBinaries'))
 {