Dependencies frozen since 2019-2020, no update visibility

[lgnap]

Context

Most of the dependency chain dates from 2019-2020 and has not moved since — with the notable
exception of Log4j, brought to 2.17.1. So the question has been addressed once, but only for
that one case.

Dependency	Version	Note
io.vertx:*	3.9.0 (May 2020)	3.x is end-of-life; vertx-web 3.9.x is affected by CVE-2023-24815 (path traversal in StaticHandler, on Windows), fixed in 4.3.8
com.google.code.gson	2.8.5 (2018)	CVE-2022-25647 (deserialization, DoS), fixed in 2.8.9
react-scripts	3.0.1 (2019)	pulls a very old build dependency tree
react / react-dom	16.8.6
node	v12.3.1 (web-ui/pom.xml:24)	EOL since April 2022; also pinned in .github/workflows/ci.yml
yarn	v1.16.0 (web-ui/pom.xml:25)
net.bytebuddy	1.10.6
org.usb4java	1.3.0
log4j-*	2.17.1	current, nothing to do
commons-io	2.16.1	recent
commons-compress	1.27.0	recent

StaticHandler is in use (MainVerticle.java:90), which makes CVE-2023-24815 relevant rather
than purely theoretical — subject to confirming the exact exploitation path, which is worth
checking before drawing conclusions.

None of this is urgent in itself for a desktop tool. The real problem is the lack of
visibility: nothing in the project signals that a dependency has aged or that an advisory
has been published, so the gap widens without anyone having decided that it should.

Description

Two distinct things, not to be conflated:

1. Make staleness visible — cheap, and worth doing first.
2. Close the gap, dependency by dependency, in order of risk.

The Vert.x 3.9 → 4.x upgrade is by far the heaviest: mountSubRouter, BridgeOptions,
SockJSHandler.bridge, the package of Vert.x's Logger/LoggerFactory, and the listen
signature have all changed. It deserves its own issue once this one is scoped; this issue is
for deciding, not for doing all of it.

Affected files

• .github/dependabot.yml — to be created
• pom.xml — dependencyManagement (gson, byte-buddy)
• web-ui/pom.xml — vertx.version, node.version, yarn.version
• web-ui/javascript/package.json, yarn.lock
• .github/workflows/ci.yml — the Node version used by the web-ui-tests job
• TESTING.md — if the test command changes

Implementation plan

1. Add .github/dependabot.yml (maven and npm ecosystems, monthly cadence, minor updates
   grouped to limit noise).
2. Enable GitHub security alerts on the repository.
3. Gson 2.8.5 → 2.11: no risk expected, usage is plain serialization/deserialization. Do this
   first.
4. Node 12 → 20 LTS together with react-scripts 3.0.1 → 5.x — the two are coupled and cannot
   be done separately. Check the JS suite (57 tests) still passes.
5. Vert.x 3.9 → 4.x: scope the effort, open a dedicated issue. Do not attempt it here.
6. At each step, verify that mvn package produces a working bundle — the PR workflow
   deliberately skips the frontend goals, so it does not cover this.

Acceptance criteria

• Dependabot configured and active
• Gson up to date
• Node and react-scripts on supported versions, JS suite green
• The Vert.x upgrade is scoped and tracked in a dedicated issue
• mvn package produces a working bundle (verified by hand, outside the PR workflow)
• CI green on Linux and Windows, plus the Web UI job

Complexity

M for steps 1 to 4. The Vert.x upgrade on its own is L.