diff --git a/aat/build.gradle b/aat/build.gradle
index c9d17ca4e2..e6799b3e43 100644
--- a/aat/build.gradle
+++ b/aat/build.gradle
@@ -6,7 +6,7 @@ dependencyCheck {
 }
 
 dependencies {
-    implementation (group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.0.3') {
+    implementation (group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.1.2') {
         exclude group: 'com.google.guava', module: 'guava'
     }
     implementation group: 'org.awaitility', name: 'awaitility', version: '3.1.6'
diff --git a/application/build.gradle b/application/build.gradle
index 5291c7b854..2dfb3828c6 100644
--- a/application/build.gradle
+++ b/application/build.gradle
@@ -31,7 +31,7 @@ dependencies {
         exclude group: 'com.google.guava', module: 'guava'
     }
     implementation "org.flywaydb:flyway-core:6.5.7"
-    runtimeOnly group: 'org.postgresql', name: 'postgresql', version: '42.5.1'
+    runtimeOnly group: 'org.postgresql', name: 'postgresql', version: '42.7.3'
 
     testImplementation project(":app-insights").sourceSets.main.output
     testImplementation project(":commons").sourceSets.main.output
diff --git a/build.gradle b/build.gradle
index 81674f4552..4b129ca6a7 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,6 +1,6 @@
 buildscript {
     ext {
-        springBootVersion = '2.7.12'
+        springBootVersion = '2.7.18'
     }
     dependencies {
         classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
@@ -9,19 +9,19 @@ buildscript {
 
 plugins {
     id 'application'
-    id "org.springframework.boot" version '2.1.0.RELEASE'
-    id 'io.spring.dependency-management' version '1.1.3'
-    id 'se.patrikerdes.use-latest-versions' version '0.2.7'
-    id 'com.github.ben-manes.versions' version '0.20.0'
-    id 'org.sonarqube' version '4.2.0.3129'
+    id "org.springframework.boot" version '2.7.18'
+    id 'io.spring.dependency-management' version '1.1.4'
+    id 'se.patrikerdes.use-latest-versions' version '0.2.18'
+    id 'com.github.ben-manes.versions' version '0.51.0'
+    id 'org.sonarqube' version '4.4.1.3373'
     id 'jacoco'
     id 'idea'
     id 'eclipse'
-    id 'com.github.kt3k.coveralls' version "2.8.2"
-    id 'com.github.spacialcircumstances.gradle-cucumber-reporting' version '0.1.23'
-    id 'info.solidsoft.pitest' version '1.5.1' apply(false)
-    id 'org.jetbrains.gradle.plugin.idea-ext' version "0.7"
-    id 'uk.gov.hmcts.java' version '0.12.43'
+    id 'com.github.kt3k.coveralls' version "2.12.2"
+    id 'com.github.spacialcircumstances.gradle-cucumber-reporting' version '0.1.25'
+    id 'info.solidsoft.pitest' version '1.15.0' apply(false)
+    id 'org.jetbrains.gradle.plugin.idea-ext' version "0.10"
+    id 'uk.gov.hmcts.java' version '0.12.60'
 }
 
 mainClassName = 'uk.gov.hmcts.ccd.definition.store.CaseDataAPIApplication'
@@ -46,19 +46,19 @@ ext['log4j2.version'] = '2.17.1'
 // end
 
 ext {
-    junitJupiterVersion = '5.7.0'
-    junitVintageVersion = '5.7.0'
-    springCloudVersion = '2021.0.3'
+    junitJupiterVersion = '5.10.2'
+    junitVintageVersion = '5.10.2'
+    springCloudVersion = '2021.0.9'
     springfoxSwaggerVersion = '3.0.0'
     hamcrestVersion = '1.3'
     powermockVersion = '2.0.9'
-    reformLogging= '6.0.1'
-    appInsightsVersion = '2.4.1'
+    reformLogging= '6.1.4'
+    appInsightsVersion = '2.6.4'
     restAssuredVersion = '4.3.0!!'
     groovyVersion = '3.0.17!!'
-    tomcatVersion = '9.0.82'
-    feignJackson = '11.6'
-    beftaFwVersion = '8.8.5'
+    tomcatVersion = '9.0.87'
+    feignJackson = '11.10'
+    beftaFwVersion = '8.10.1'
     limits = [
             'instruction': 99,
             'branch'     : 99,
@@ -91,14 +91,14 @@ allprojects {
     apply plugin: 'java'
 
     ext {
-        elasticSearchVersion = '7.17.1'
+        elasticSearchVersion = '7.17.20'
     }
 
     dependencies {
         testImplementation ("org.springframework.boot:spring-boot-starter-test:${springBootVersion}"){
             exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
         }
-        implementation 'net.minidev:json-smart:2.4.7'
+        implementation 'net.minidev:json-smart:2.5.1'
     }
 
     // Global constraints
@@ -130,23 +130,23 @@ allprojects {
         implementation "org.apache.tomcat.embed:tomcat-embed-core:${tomcatVersion}"
         implementation "org.apache.tomcat.embed:tomcat-embed-el:${tomcatVersion}"
         implementation "org.apache.tomcat.embed:tomcat-embed-websocket:${tomcatVersion}"
-        implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13'
+        implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.14'
         implementation group: 'commons-fileupload', name: 'commons-fileupload', version: '1.5'
         // Overriding transitive dependency commons-compress due to CVE failures
-        implementation "org.apache.commons:commons-compress:1.21"
+        implementation "org.apache.commons:commons-compress:1.26.1"
         // CVE-2021-28170
-        implementation "org.glassfish:jakarta.el:4.0.1"
+        implementation "org.glassfish:jakarta.el:4.0.2"
 
         // CVE-2021-42550
-        implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.10'
-        implementation group: 'ch.qos.logback', name: 'logback-core', version: '1.2.10'
+        implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.5.4'
+        implementation group: 'ch.qos.logback', name: 'logback-core', version: '1.5.4'
 
         testImplementation "io.rest-assured:xml-path:${restAssuredVersion}"
         testImplementation "io.rest-assured:json-path:${restAssuredVersion}"
         testImplementation "org.codehaus.groovy:groovy:${groovyVersion}"
         testImplementation "org.codehaus.groovy:groovy-xml:${groovyVersion}"
         testImplementation "org.codehaus.groovy:groovy-json:${groovyVersion}"
-        testImplementation 'com.github.hmcts:fortify-client:1.3.0:all'
+        testImplementation 'com.github.hmcts:fortify-client:1.4.1:all'
     }
 
     configurations.all {
@@ -181,7 +181,7 @@ java {
 }
 
 jacoco {
-    toolVersion = "0.8.8"
+    toolVersion = "0.8.12"
 }
 
 
@@ -228,30 +228,30 @@ subprojects { subproject ->
     }
 
     dependencies {
-        implementation group: 'org.apache.poi', name: 'poi', version: '5.2.2'
-        implementation group: 'org.apache.poi', name: 'poi-ooxml', version: '5.2.2'
-        implementation group: 'org.apache.poi', name: 'poi-scratchpad', version: '5.2.2'
+        implementation group: 'org.apache.poi', name: 'poi', version: '5.2.5'
+        implementation group: 'org.apache.poi', name: 'poi-ooxml', version: '5.2.5'
+        implementation group: 'org.apache.poi', name: 'poi-scratchpad', version: '5.2.5'
         implementation group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
-        implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '9.21'
+        implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '9.37.3'
 
-        implementation group: 'com.google.code.gson', name: 'gson', version: '2.9.0'
+        implementation group: 'com.google.code.gson', name: 'gson', version: '2.10.1'
         implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: reformLogging
         implementation group: 'com.microsoft.azure', name: 'applicationinsights-logging-logback', version: appInsightsVersion
         implementation group: 'com.microsoft.azure', name: 'applicationinsights-spring-boot-starter', version: appInsightsVersion
 
-        implementation group: 'io.jsonwebtoken', name: 'jjwt', version:'0.9.1'
-        implementation (group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.0.3') {
+        implementation group: 'io.jsonwebtoken', name: 'jjwt', version:'0.12.5'
+        implementation (group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.1.2') {
             exclude group: 'com.google.guava', module: 'guava'
         }
-        implementation (group: 'com.github.hmcts', name: 'idam-java-client', version: '2.0.1') {
+        implementation (group: 'com.github.hmcts', name: 'idam-java-client', version: '2.1.1') {
             exclude group: 'com.google.guava', module: 'guava'
         }
 
-        compileOnly 'org.projectlombok:lombok:1.18.28'
-        annotationProcessor 'org.projectlombok:lombok:1.18.28'
+        compileOnly 'org.projectlombok:lombok:1.18.32'
+        annotationProcessor 'org.projectlombok:lombok:1.18.32'
 
-        testCompileOnly 'org.projectlombok:lombok:1.18.28'
-        testAnnotationProcessor 'org.projectlombok:lombok:1.18.28'
+        testCompileOnly 'org.projectlombok:lombok:1.18.32'
+        testAnnotationProcessor 'org.projectlombok:lombok:1.18.32'
 
         implementation "org.springframework.security:spring-security-web"
         implementation "org.springframework.security:spring-security-config"
@@ -263,32 +263,32 @@ subprojects { subproject ->
         implementation('org.springframework.boot:spring-boot-starter-web')
         implementation('org.springframework.boot:spring-boot-starter-data-jpa')
 
-        implementation group: 'com.zaxxer', name: 'HikariCP', version: '4.0.2'
-        implementation group: 'org.jooq', name: 'jool-java-8', version: '0.9.14'
+        implementation group: 'com.zaxxer', name: 'HikariCP', version: '4.0.3'
+        implementation group: 'org.jooq', name: 'jool-java-8', version: '0.9.15'
         implementation "org.elasticsearch:elasticsearch:${elasticSearchVersion}"
         implementation "org.elasticsearch.client:elasticsearch-rest-high-level-client:${elasticSearchVersion}"
-        implementation group: 'com.github.ben-manes.caffeine', name: 'caffeine', version: '2.7.0'
+        implementation group: 'com.github.ben-manes.caffeine', name: 'caffeine', version: '2.9.3'
         implementation('org.springframework.boot:spring-boot-starter-cache')
 
         implementation 'org.flywaydb:flyway-core:6.5.7'
 
         implementation group: 'javax.inject', name: 'javax.inject', version: '1'
 
-        implementation (group: 'com.microsoft.azure', name: 'azure-storage', version: '8.0.0') {
+        implementation (group: 'com.microsoft.azure', name: 'azure-storage', version: '8.6.6') {
             exclude group: 'com.google.guava', module: 'guava'
         }
-        implementation group: 'org.bouncycastle', name: 'bcpkix-jdk15to18', version: '1.77'
+        implementation group: 'org.bouncycastle', name: 'bcpkix-jdk15to18', version: '1.78'
 
         // CVE-2021-29425
-        implementation group: 'commons-io', name: 'commons-io', version: '2.8.0'
-        implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-bootstrap', version: '3.1.7'
+        implementation group: 'commons-io', name: 'commons-io', version: '2.16.1'
+        implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-bootstrap', version: '3.1.8'
         implementation "org.springframework.cloud:spring-cloud-starter-bootstrap"
         implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '3.1.9'
 
         // To avoid compiler warnings about @API annotations in JUnit5 code.
-        testImplementation 'org.apiguardian:apiguardian-api:1.0.0'
-        testImplementation "org.postgresql:postgresql:42.5.1"
-        testImplementation "org.testcontainers:postgresql:1.17.2"
+        testImplementation 'org.apiguardian:apiguardian-api:1.1.2'
+        testImplementation "org.postgresql:postgresql:42.7.3"
+        testImplementation "org.testcontainers:postgresql:1.19.7"
         testImplementation "org.hamcrest:hamcrest-core:${hamcrestVersion}"
         testImplementation "org.hamcrest:hamcrest-library:${hamcrestVersion}"
         testImplementation "org.junit.jupiter:junit-jupiter-api:${junitJupiterVersion}"
@@ -296,43 +296,43 @@ subprojects { subproject ->
         testRuntimeOnly "org.junit.vintage:junit-vintage-engine:${junitVintageVersion}"
         testImplementation "org.junit.jupiter:junit-jupiter-params:${junitJupiterVersion}"
         testImplementation('org.springframework.boot:spring-boot-starter-test')
-        testImplementation('org.springframework.cloud:spring-cloud-starter-contract-stub-runner:2.1.0.RELEASE') {
+        testImplementation('org.springframework.cloud:spring-cloud-starter-contract-stub-runner:2.2.6.RELEASE') {
             exclude group: 'com.github.tomakehurst', module: 'wiremock-standalone'
             exclude group: 'commons-beanutils', module: 'commons-beanutils'
         }
-        testImplementation ('com.github.tomakehurst:wiremock-jre8:2.25.1')
-        testImplementation ('org.springframework.cloud:spring-cloud-contract-wiremock:2.2.1.RELEASE') {
+        testImplementation ('com.github.tomakehurst:wiremock-jre8:2.35.2')
+        testImplementation ('org.springframework.cloud:spring-cloud-contract-wiremock:2.2.6.RELEASE') {
             exclude group: 'commons-beanutils', module: 'commons-beanutils'
         }
-        testImplementation ("org.mockito:mockito-core:3.6.0") {
+        testImplementation ("org.mockito:mockito-core:3.12.4") {
             exclude group: 'org.hamcrest'
         }
 
         testImplementation "org.mockito:mockito-all:1.10.19"
-        testImplementation 'org.mockito:mockito-junit-jupiter:3.6.0'
+        testImplementation 'org.mockito:mockito-junit-jupiter:3.12.4'
         testImplementation 'com.github.npathai:hamcrest-optional:2.0.0'
         testImplementation group: 'org.hamcrest', name: 'hamcrest-junit', version: '2.0.0.0'
         testImplementation "io.github.openfeign:feign-jackson:${feignJackson}"
         testImplementation 'io.github.openfeign.form:feign-form:3.8.0'
-        testImplementation "org.exparity:hamcrest-date:2.0.4"
+        testImplementation "org.exparity:hamcrest-date:2.0.8"
         testImplementation "io.rest-assured:rest-assured:${restAssuredVersion}"
         testImplementation group: 'org.powermock', name: 'powermock-api-mockito2', version: powermockVersion
         testImplementation group: 'org.powermock', name: 'powermock-module-junit4', version: powermockVersion
 
-        testImplementation group: 'com.github.hmcts', name: 'ccd-test-definitions', version: '7.21.13'
+        testImplementation group: 'com.github.hmcts', name: 'ccd-test-definitions', version: '7.21.21'
 
         implementation group: 'com.github.hmcts', name: 'befta-fw', version: beftaFwVersion
 
         testImplementation group: 'commons-lang', name: 'commons-lang', version: '2.6'
 
         // https://mvnrepository.com/artifact/junit/junit
-        implementation group: 'junit', name: 'junit', version: '4.13.1'
-        testImplementation group: 'junit', name: 'junit', version: '4.13.1'
-        testImplementation 'info.solidsoft.gradle.pitest:gradle-pitest-plugin:1.4.0'
+        implementation group: 'junit', name: 'junit', version: '4.13.2'
+        testImplementation group: 'junit', name: 'junit', version: '4.13.2'
+        testImplementation 'info.solidsoft.gradle.pitest:gradle-pitest-plugin:1.15.0'
         implementation group: 'com.google.guava', name: 'guava', version: '32.1.3-jre'
         implementation 'javax.validation:validation-api:2.0.1.Final'
-        implementation 'io.swagger:swagger-annotations:1.6.6'
-        implementation 'com.vladmihalcea:hibernate-types-52:2.16.3'
+        implementation 'io.swagger:swagger-annotations:1.6.14'
+        implementation 'com.vladmihalcea:hibernate-types-52:2.21.1'
         implementation group: 'commons-collections', name: 'commons-collections', version: '3.2.2'
 
     }
diff --git a/charts/ccd-definition-store-api/Chart.yaml b/charts/ccd-definition-store-api/Chart.yaml
index 412c46a5ee..72afbd3b34 100644
--- a/charts/ccd-definition-store-api/Chart.yaml
+++ b/charts/ccd-definition-store-api/Chart.yaml
@@ -2,11 +2,11 @@ description: Helm chart for the HMCTS CCD Definition Store
 name: ccd-definition-store-api
 apiVersion: v2
 home: https://github.com/hmcts/ccd-definition-store-api
-version: 1.6.16
+version: 1.6.17
 maintainers:
   - name: HMCTS CCD Dev Team
     email: ccd-devops@HMCTS.NET
 dependencies:
   - name: java
-    version: 5.0.0
+    version: 5.2.0
     repository: 'https://hmctspublic.azurecr.io/helm/v1/repo/'
diff --git a/commons/build.gradle b/commons/build.gradle
index 2a8c69308e..016163ff5e 100644
--- a/commons/build.gradle
+++ b/commons/build.gradle
@@ -16,7 +16,7 @@ bootJar {
 }
 
 def versions = [
-        jackson         : '2.16.0'
+        jackson         : '2.17.0'
 ]
 
 dependencies {
diff --git a/domain/build.gradle b/domain/build.gradle
index 0a197a203e..bb5fe78421 100644
--- a/domain/build.gradle
+++ b/domain/build.gradle
@@ -34,7 +34,7 @@ bootJar {
 
 ext {
     mapstructGenSourceDir = 'build/classes/java/main'
-    orgMapstructVersion='1.3.0.Final'
+    orgMapstructVersion='1.5.5.Final'
 }
 
 dependencies {
@@ -42,8 +42,8 @@ dependencies {
     implementation (project(':repository')) {
         exclude group: 'org.mapstruct', module: 'mapstruct'
     }
-    implementation "org.apache.commons:commons-lang3:3.11"
-    implementation (group: 'commons-validator', name: 'commons-validator', version: '1.6') {
+    implementation "org.apache.commons:commons-lang3:3.14.0"
+    implementation (group: 'commons-validator', name: 'commons-validator', version: '1.8.0') {
         exclude group: 'commons-beanutils', module: 'commons-beanutils'
     }
     implementation "org.mapstruct:mapstruct-jdk8:${orgMapstructVersion}"
diff --git a/elastic-search-support/build.gradle b/elastic-search-support/build.gradle
index df2f99255e..8c561555a3 100644
--- a/elastic-search-support/build.gradle
+++ b/elastic-search-support/build.gradle
@@ -18,16 +18,16 @@ dependencies {
     implementation project(':domain')
     implementation project(':repository')
     implementation "org.elasticsearch.client:elasticsearch-rest-high-level-client:${elasticSearchVersion}"
-    implementation group: 'com.google.code.gson', name: 'gson', version: '2.9.0'
+    implementation group: 'com.google.code.gson', name: 'gson', version: '2.10.1'
 
     // need these for command line to pass in the gradle version,
     // intellij does not need the next 2 lines though
     testImplementation project(path: ':domain', configuration: 'testOutput')
     testImplementation project(":domain").sourceSets.main.output
     testImplementation project(":repository").sourceSets.test.output
-    testImplementation group: 'org.skyscreamer', name: 'jsonassert', version: '1.5.0'
-    testImplementation "org.testcontainers:elasticsearch:1.19.3"
-    testImplementation "org.testcontainers:junit-jupiter:1.19.3"
+    testImplementation group: 'org.skyscreamer', name: 'jsonassert', version: '1.5.1'
+    testImplementation "org.testcontainers:elasticsearch:1.19.7"
+    testImplementation "org.testcontainers:junit-jupiter:1.19.7"
 }
 
 pitest {
diff --git a/excel-importer/build.gradle b/excel-importer/build.gradle
index c98e866b18..31595807d1 100644
--- a/excel-importer/build.gradle
+++ b/excel-importer/build.gradle
@@ -25,9 +25,9 @@ dependencies {
     testImplementation project(":repository").sourceSets.test.output
 
     implementation "org.springframework.boot:spring-boot-starter-web"
-    implementation "org.apache.commons:commons-collections4:4.1"
-    implementation "org.apache.commons:commons-lang3:3.11"
-    implementation "org.apache.poi:poi-ooxml:5.2.2"
+    implementation "org.apache.commons:commons-collections4:4.4"
+    implementation "org.apache.commons:commons-lang3:3.14.0"
+    implementation "org.apache.poi:poi-ooxml:5.2.5"
 }
 
 bootJar {
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index e708b1c023..e6441136f3 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 84a0b92f9a..b82aa23a4f 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
index 4f906e0c81..1aa94a4269 100755
--- a/gradlew
+++ b/gradlew
@@ -1,7 +1,7 @@
-#!/usr/bin/env sh
+#!/bin/sh
 
 #
-# Copyright 2015 the original author or authors.
+# Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,67 +17,99 @@
 #
 
 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
 warn () {
     echo "$*"
-}
+} >&2
 
 die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac
 
 CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
@@ -87,9 +119,9 @@ CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -98,88 +130,120 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
 fi
 
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 
 # For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
     # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
         fi
-        i=`expr $i + 1`
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
     done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
-    esac
 fi
 
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
 
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
 
 exec "$JAVACMD" "$@"
diff --git a/gradlew.bat b/gradlew.bat
index ac1b06f938..7101f8e467 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -14,7 +14,7 @@
 @rem limitations under the License.
 @rem
 
-@if "%DEBUG%" == "" @echo off
+@if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
 @rem  Gradle startup script for Windows
@@ -25,7 +25,8 @@
 if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -40,13 +41,13 @@ if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -56,11 +57,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -75,13 +76,15 @@ set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal
diff --git a/infrastructure/.terraform-version b/infrastructure/.terraform-version
index d4c4950a37..27f9cd322b 100644
--- a/infrastructure/.terraform-version
+++ b/infrastructure/.terraform-version
@@ -1 +1 @@
-1.3.9
+1.8.0
diff --git a/integration-tests/build.gradle b/integration-tests/build.gradle
index 517cf965d0..e5b2b25d3a 100644
--- a/integration-tests/build.gradle
+++ b/integration-tests/build.gradle
@@ -23,7 +23,7 @@ dependencies {
     testImplementation ("io.springfox:springfox-boot-starter:${springfoxSwaggerVersion}") {
         exclude group: 'com.google.guava', module: 'guava'
     }
-    testImplementation  group: 'org.postgresql', name: 'postgresql', version: '42.4.1'
+    testImplementation  group: 'org.postgresql', name: 'postgresql', version: '42.7.3'
 }
 
 // To help obscure gradle problem
diff --git a/repository/build.gradle b/repository/build.gradle
index c05255897d..4c6a677c5c 100644
--- a/repository/build.gradle
+++ b/repository/build.gradle
@@ -28,24 +28,24 @@ dependencies {
     implementation("org.springframework.boot:spring-boot-starter-data-jpa") {
         exclude group: 'org.apache.tomcat', module: 'tomcat-jdbc'
     }
-    implementation (group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.0.3') {
+    implementation (group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.1.2') {
         exclude group: 'com.google.guava', module: 'guava'
     }
     implementation "commons-beanutils:commons-beanutils:1.9.4"
-    implementation "org.apache.commons:commons-lang3:3.11"
+    implementation "org.apache.commons:commons-lang3:3.14.0"
     implementation ("io.springfox:springfox-boot-starter:${springfoxSwaggerVersion}") {
         exclude group: 'com.google.guava', module: 'guava'
     }
-    implementation "com.google.guava:guava:30.0-jre"
+    implementation "com.google.guava:guava:30.1.1-jre"
     implementation "javax.validation:validation-api:2.0.1.Final"
-    implementation "org.hibernate.validator:hibernate-validator:6.0.20.Final"
+    implementation "org.hibernate.validator:hibernate-validator:6.2.5.Final"
     implementation "org.glassfish:javax.el:3.0.0"
     implementation "org.flywaydb:flyway-core:6.5.7"
     testImplementation "org.assertj:assertj-core"
     testImplementation project(":commons").sourceSets.main.output
-    implementation group: 'com.vladmihalcea', name: 'hibernate-types-52', version: '2.9.13'
+    implementation group: 'com.vladmihalcea', name: 'hibernate-types-52', version: '2.21.1'
 
-    testImplementation group: 'com.vladmihalcea', name: 'db-util', version: '1.0.5'
+    testImplementation group: 'com.vladmihalcea', name: 'db-util', version: '1.0.7'
 }
 
 pitest {