Fix jetty-bom in dependency management

.github/dependabot.yml

@@ -26,6 +26,9 @@ updates:
     - dependency-name: "tools.jackson.core:jackson-databind"
     # this dependency monitors convergence conflicts, so we pin a specific version
     - dependency-name: "com.squareup.okio:okio-jvm"
+    # https://github.com/jetty/jetty.project/issues/15657
+    - dependency-name: "org.eclipse.jetty:*"
+      versions: ["<=12.1.12"]
 
   groups:
     minor-java-dependencies:

integration-tests/pom.xml

@@ -10,10 +10,6 @@
   <modelVersion>4.0.0</modelVersion>
   <artifactId>integration-tests</artifactId>
 
-  <properties>
-    <jetty.http2-client.version>12.1.12</jetty.http2-client.version>
-  </properties>
-
   <dependencies>
     <dependency>
       <groupId>org.whispersystems.textsecure</groupId>
@@ -39,7 +35,6 @@
     <dependency>
       <groupId>org.eclipse.jetty.http2</groupId>
       <artifactId>jetty-http2-client-transport</artifactId>
-      <version>${jetty.http2-client.version}</version>
     </dependency>
   </dependencies>
 

pom.xml

@@ -65,6 +65,7 @@
     <httpclient.version>4.5.14</httpclient.version>
     <jackson.version>2.22.2</jackson.version>
     <java-otp.version>1.0.0</java-otp.version>
+    <jetty.version>12.1.9</jetty.version>
     <junit-pioneer.version>2.3.0</junit-pioneer.version>
     <jsr305.version>3.0.2</jsr305.version>
     <kotlin.version>2.4.10</kotlin.version>
@@ -109,6 +110,7 @@
   <dependencyManagement>
     <!-- note: order matters, and earlier declarations take precedence -->
     <dependencies>
+      <!-- use a pinned version of jackson, rather than Dropwizard's BOM -->
       <dependency>
         <groupId>com.fasterxml.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
@@ -116,6 +118,22 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- use a pinned version of jetty, rather than Dropwizard's BOM -->
+      <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-bom</artifactId>
+        <version>${jetty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <!-- use a pinned version of jetty, rather than Dropwizard's BOM -->
+      <dependency>
+        <groupId>org.eclipse.jetty.ee10</groupId>
+        <artifactId>jetty-ee10-bom</artifactId>
+        <version>${jetty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-bom</artifactId>

service/pom.xml

@@ -23,7 +23,6 @@
     <opentelemetry-logback-appender-1.0.version>2.30.0-alpha</opentelemetry-logback-appender-1.0.version>
     <storekit.version>5.2.0</storekit.version>
     <webauthn4j.version>0.31.9.RELEASE</webauthn4j.version>
-    <jetty.http2-client.version>12.1.12</jetty.http2-client.version>
   </properties>
 
   <dependencies>
@@ -147,7 +146,6 @@
       <groupId>org.eclipse.jetty.http2</groupId>
       <artifactId>jetty-http2-client-transport</artifactId>
       <scope>test</scope>
-      <version>${jetty.http2-client.version}</version>
     </dependency>
     <dependency>
       <groupId>io.dropwizard</groupId>