Устранить уязвимости backend-образа

backend/Dockerfile

@@ -16,7 +16,10 @@ RUN mvn org.apache.maven.plugins:maven-dependency-plugin:3.6.1:copy \
 
 FROM eclipse-temurin:17-jre-alpine@sha256:02320dd4ce20e243dfb915c686089cf9315c763084fafbb12d5c9993aee18b57
 
-# Best practice: run as a non-root user
+# Устанавливаем исправления безопасности, опубликованные после сборки базового образа.
+RUN apk upgrade --no-cache
+
+# Запускаем приложение от непривилегированного пользователя.
 RUN addgroup -S spring && adduser -S spring -G spring
 USER spring:spring
 

backend/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.2.5</version>
+        <version>3.5.16</version>
         <relativePath/>
     </parent>
 
@@ -18,6 +18,7 @@
 
     <properties>
         <java.version>17</java.version>
+        <postgresql.version>42.7.12</postgresql.version>
     </properties>
 
     <dependencies>
@@ -44,6 +45,10 @@
             <groupId>org.flywaydb</groupId>
             <artifactId>flyway-core</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.flywaydb</groupId>
+            <artifactId>flyway-database-postgresql</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>

backend/src/test/java/com/magistr/app/controller/DepartmentWorkspaceControllerTest.java

@@ -15,6 +15,7 @@ import com.magistr.app.repository.DepartmentRepository;
 import com.magistr.app.repository.TeacherCreationRequestRepository;
 import com.magistr.app.repository.TeacherDepartmentAssignmentRepository;
 import com.magistr.app.repository.UserRepository;
+import com.magistr.app.service.BusinessTimeService;
 import com.magistr.app.service.ScheduleQueryService;
 import com.magistr.app.service.SubjectImportService;
 import com.magistr.app.service.TeacherDepartmentService;
@@ -22,7 +23,10 @@ import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 
+import java.time.Clock;
+import java.time.Instant;
 import java.time.LocalDate;
+import java.time.ZoneOffset;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -34,6 +38,12 @@ import static org.mockito.Mockito.when;
 
 class DepartmentWorkspaceControllerTest {
 
+    private static final LocalDate TODAY = LocalDate.of(2026, 7, 29);
+    private static final BusinessTimeService BUSINESS_TIME = new BusinessTimeService(
+            Clock.fixed(Instant.parse("2026-07-29T09:00:00Z"), ZoneOffset.UTC),
+            ZoneOffset.UTC
+    );
+
     @AfterEach
     void clearAuthContext() {
         AuthContext.clear();
@@ -71,7 +81,7 @@ class DepartmentWorkspaceControllerTest {
         TeacherDepartmentService teacherDepartmentService = mock(TeacherDepartmentService.class);
         User assignedTeacher = user(10L, "assigned", "Петров Препод Петрович", 2L);
         User directTeacher = user(11L, "direct", "Препод Тест Тестович", 1L);
-        when(teacherDepartmentService.findTeachersForDepartmentAtDate(1L, LocalDate.now()))
+        when(teacherDepartmentService.findTeachersForDepartmentAtDate(1L, TODAY))
                 .thenReturn(List.of(directTeacher, assignedTeacher));
         DepartmentWorkspaceController controller = new DepartmentWorkspaceController(
                 mock(SubjectRepository.class),
@@ -82,7 +92,8 @@ class DepartmentWorkspaceControllerTest {
                 mock(TeacherCreationRequestRepository.class),
                 mock(ScheduleQueryService.class),
                 teacherDepartmentService,
-                mock(SubjectImportService.class)
+                mock(SubjectImportService.class),
+                BUSINESS_TIME
         );
 
         List<UserResponse> teachers = controller.getTeachers(1L);

backend/src/test/java/com/magistr/app/controller/TeacherSubjectControllerTest.java

@@ -9,12 +9,15 @@ import com.magistr.app.model.User;
 import com.magistr.app.repository.SubjectRepository;
 import com.magistr.app.repository.TeacherSubjectRepository;
 import com.magistr.app.repository.UserRepository;
+import com.magistr.app.service.BusinessTimeService;
 import com.magistr.app.service.TeacherDepartmentService;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 
-import java.time.LocalDate;
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.Map;
 import java.util.Optional;
 
@@ -25,6 +28,11 @@ import static org.mockito.Mockito.when;
 
 class TeacherSubjectControllerTest {
 
+    private static final BusinessTimeService BUSINESS_TIME = new BusinessTimeService(
+            Clock.fixed(Instant.parse("2026-07-29T09:00:00Z"), ZoneOffset.UTC),
+            ZoneOffset.UTC
+    );
+
     @AfterEach
     void clearAuthContext() {
         AuthContext.clear();
@@ -46,13 +54,14 @@ class TeacherSubjectControllerTest {
         when(teacherDepartmentService.hasAssignmentAtDate(
                 teacher.getId(),
                 1L,
-                LocalDate.now()
+                BUSINESS_TIME.today()
         )).thenReturn(true);
         TeacherSubjectController controller = new TeacherSubjectController(
                 teacherSubjectRepository,
                 userRepository,
                 subjectRepository,
-                teacherDepartmentService
+                teacherDepartmentService,
+                BUSINESS_TIME
         );
         AuthContext.setCurrentUser(new AuthenticatedUser(1L, "кафедра", Role.DEPARTMENT, 1L));