diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 148e859..3a81690 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 - **OAG** The OWASP Application Gateway. 
-- **Tech-Stack:** SpringCloudGateway · Java 17 · Gradle 8 · docker · vitepress (for documentation) 
+- **Tech-Stack:** SpringCloudGateway · Java 17 · Gradle 9 · docker · vitepress (for documentation) 
 
 ## Build & Run Commands
 
diff --git a/Dockerfile b/Dockerfile
index c370dcf..acc1d33 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 #
 # Build stage
 #
-FROM gradle:8.14-jdk17 AS build
+FROM gradle:9.6.1-jdk17 AS build
 
 # Copy build files and download dependencies -> allows faster build because this step can be cached
 COPY oag/build.gradle oag/settings.gradle /home/app/
diff --git a/implementation-progress/00003-upgrade-spring-boot-4.1-spring-cloud-gradle-9.md b/implementation-progress/00003-upgrade-spring-boot-4.1-spring-cloud-gradle-9.md
new file mode 100644
index 0000000..a0c480f
--- /dev/null
+++ b/implementation-progress/00003-upgrade-spring-boot-4.1-spring-cloud-gradle-9.md
@@ -0,0 +1,332 @@
+# Upgrade to Spring Boot 4.1, Spring Cloud 2025.1.2 and Gradle 9 — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Move OAG from Gradle 8.14 / Spring Boot 4.0.1 / Spring Cloud 2025.1.0 to Gradle 9.6.1 / Spring Boot 4.1.0 / Spring Cloud 2025.1.2, refresh the remaining pinned libraries to their latest stable releases, and keep the build fully green.
+
+**Architecture:** This is a build-and-dependency upgrade of the single `oag/` Gradle project. There is no new production code. The safety net is the existing test suite — 43 test classes / 108 tests including full `@SpringBootTest` integration tests (WireMock, `WebTestClient`) that boot the complete Spring context and exercise gateway routing, CSRF, session handling, OIDC login and security config. Each task's "test" is therefore running `./gradlew build`, which compiles and runs that entire suite. A version bump that breaks routing, security or context loading fails the build — that is the regression gate for every task.
+
+**Tech Stack:** Spring Cloud Gateway (server-webflux) · Spring Boot 4.1.0 · Spring Cloud 2025.1.2 (Oakwood) · Java 17 toolchain · Gradle 9.6.1 · Docker
+
+## Global Constraints
+
+- **Gradle:** `9.6.1` exactly (latest GA as of 2026-07; 9.7.0 is only RC — do not use).
+- **Spring Boot:** `4.1.0` exactly (plugin `org.springframework.boot`).
+- **Spring Cloud:** `2025.1.2` exactly (release train "Oakwood", `spring-cloud-dependencies` BOM).
+- **Java toolchain stays 17.** Spring Boot 4.1 keeps Java 17 as its baseline; do not change `JavaLanguageVersion.of(17)` and do not change the Docker runtime image from Java 17.
+- **`io.spring.dependency-management` stays `1.1.7`** — already the latest release; do not touch it.
+- **Baseline must be preserved:** before starting, `./gradlew build` prints `BUILD SUCCESSFUL` with all tests passing. Every task ends with the same result. Never weaken, skip (`-PskipTests`), or `@Disabled` a test to make a bump "pass".
+- **Stable releases only.** When refreshing dependencies, ignore `-M`, `-RC`, `-alpha`, `-beta`, `-SNAPSHOT` and (for Guava) `-android` variants. Keep the `-jre` Guava line.
+- **Config rule:** one `spring:` block per YAML file (SnakeYAML merges duplicate top-level keys unpredictably). This upgrade should not add YAML, but honour it if any config is touched.
+- **Language:** English in code, config, commit messages and docs.
+- **Commit after every task.** Frequent, small commits. Do not squash tasks together.
+
+**Working directory:** all `./gradlew` commands run from `oag/`. `docker build` runs from the repository root. Paths below are given relative to the repository root.
+
+---
+
+### Task 1: Upgrade the Gradle wrapper 8.14 → 9.6.1
+
+**Files:**
+- Modify: `oag/gradle/wrapper/gradle-wrapper.properties`
+- Modify (regenerated by the wrapper task): `oag/gradle/wrapper/gradle-wrapper.jar`, `oag/gradlew`, `oag/gradlew.bat`
+
+**Interfaces:**
+- Consumes: the current green build on Gradle 8.14.
+- Produces: a working Gradle 9.6.1 wrapper that every later task (and the Dockerfile in Task 4) relies on. Spring Boot 4.1's Gradle plugin supports Gradle 8.14+ and 9.x, so the toolchain remains valid.
+
+- [x] **Step 1: Confirm the green baseline**
+
+Run (from `oag/`): `./gradlew build --console=plain`
+Expected: ends with `BUILD SUCCESSFUL`. If it does not, stop — fix the baseline before upgrading anything.
+
+- [x] **Step 2: Fetch and record the distribution checksum (supply-chain hardening)**
+
+The current wrapper sets `validateDistributionUrl=true` but pins no checksum. Add one while upgrading.
+
+Run: `curl -sSL https://services.gradle.org/distributions/gradle-9.6.1-bin.zip.sha256`
+Expected: a 64-character hex string. Keep it for Step 3.
+
+- [x] **Step 3: Run the wrapper upgrade task (first pass)**
+
+Run (from `oag/`), substituting the checksum from Step 2:
+
+```bash
+./gradlew wrapper --gradle-version 9.6.1 --distribution-type bin \
+  --gradle-distribution-sha256-sum <CHECKSUM_FROM_STEP_2>
+```
+
+This rewrites `gradle-wrapper.properties` (`distributionUrl` → `gradle-9.6.1-bin.zip`, adds `distributionSha256Sum`).
+
+- [x] **Step 4: Run the wrapper upgrade task (second pass)**
+
+Run the exact same command again. The second pass regenerates `gradle-wrapper.jar`, `gradlew` and `gradlew.bat` using the new version. (Two passes are the documented Gradle wrapper-migration procedure.)
+
+- [x] **Step 5: Verify the wrapper version**
+
+Run (from `oag/`): `./gradlew --version`
+Expected: the `Gradle` line reads `9.6.1`.
+
+- [x] **Step 6: Verify `gradle-wrapper.properties`**
+
+Read `oag/gradle/wrapper/gradle-wrapper.properties` and confirm:
+- `distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip`
+- `distributionSha256Sum=<CHECKSUM_FROM_STEP_2>`
+- `validateDistributionUrl=true` is still present.
+
+- [x] **Step 7: Full build on Gradle 9.6.1**
+
+Run (from `oag/`): `./gradlew clean build --console=plain`
+Expected: `BUILD SUCCESSFUL`, all tests pass.
+
+If it fails with a Gradle deprecation-now-removed error, the likely culprits and fixes are:
+- A removed convention/property in `build.gradle` — read the error's `--stacktrace`, find the offending line, and replace it with the Gradle 9 equivalent named in the error message. Re-run with `--warning-mode all` to surface the exact deprecation.
+Do not disable tasks or tests to get past a failure.
+
+- [x] **Step 8: Commit**
+
+```bash
+git add oag/gradle/wrapper/gradle-wrapper.properties oag/gradle/wrapper/gradle-wrapper.jar oag/gradlew oag/gradlew.bat
+git commit -m "build: upgrade Gradle wrapper to 9.6.1"
+```
+
+---
+
+### Task 2: Upgrade Spring Boot 4.0.1 → 4.1.0 and Spring Cloud 2025.1.0 → 2025.1.2
+
+**Files:**
+- Modify: `oag/build.gradle:26` (Spring Boot plugin version)
+- Modify: `oag/build.gradle:47` (`springCloudVersion`)
+
+**Interfaces:**
+- Consumes: the Gradle 9.6.1 wrapper from Task 1.
+- Produces: the application running on Spring Boot 4.1.0 with the Spring Cloud 2025.1.2 BOM. Spring Cloud 2025.1.2 (Oakwood) is the release train that introduces Spring Boot 4.1.0 compatibility; this is the correct pairing.
+
+- [x] **Step 1: Bump the Spring Boot plugin**
+
+In `oag/build.gradle`, change line 26 inside the `plugins { }` block:
+
+```groovy
+    id 'org.springframework.boot' version '4.1.0'
+```
+
+(from `'4.0.1'`).
+
+- [x] **Step 2: Bump the Spring Cloud release train**
+
+In `oag/build.gradle`, change the `ext` block (line 47):
+
+```groovy
+ext {
+    springCloudVersion = '2025.1.2'
+}
+```
+
+(from `'2025.1.0'`).
+
+- [x] **Step 3: Build and run the full test suite**
+
+Run (from `oag/`): `./gradlew clean build --console=plain`
+Expected: `BUILD SUCCESSFUL`. The `@SpringBootTest` integration tests boot the full gateway context — a passing run confirms routing, security, CSRF, session and OIDC behaviour survived the bump.
+
+If compilation fails on a removed/renamed API, or an integration test fails at runtime:
+- Read the failing symbol/test, then consult the Spring Boot 4.1 release notes (`https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.1-Release-Notes`) and the 4.1 migration notes for the replacement.
+- Apply the minimal source change in `oag/src/main` that the release notes prescribe, then re-run the build.
+- Treat any newly-failing integration test as a real behavioural regression to investigate, not a test to disable.
+
+- [x] **Step 4: Confirm the resolved versions**
+
+Run (from `oag/`): `./gradlew dependencyInsight --dependency spring-boot --configuration runtimeClasspath | head -5`
+Expected: resolves `spring-boot` at `4.1.0`.
+
+- [x] **Step 5: Commit**
+
+```bash
+git add oag/build.gradle
+git commit -m "build: upgrade Spring Boot to 4.1.0 and Spring Cloud to 2025.1.2"
+```
+
+---
+
+### Task 3: Refresh the remaining pinned dependencies to latest stable
+
+**Files:**
+- Modify: `oag/build.gradle` (the `plugins`, `ext`/dependency version literals)
+
+**Interfaces:**
+- Consumes: Spring Boot 4.1.0 + Spring Cloud 2025.1.2 from Task 2 (their BOMs manage transitive versions — do not override BOM-managed versions).
+- Produces: every *explicitly pinned* library at its latest stable release, discovered at execution time rather than guessed. **Do not hardcode "latest" numbers from memory — the Maven Central `latestVersion` search field is known to be stale.** Use the report the plugin produces.
+
+**Currently pinned versions to evaluate** (in `oag/build.gradle`):
+
+| Coordinate | Current pin |
+|---|---|
+| `com.google.guava:guava` | `33.5.0-jre` |
+| `org.yaml:snakeyaml` | `2.5` |
+| `com.nimbusds:oauth2-oidc-sdk` | `11.30.1` |
+| `com.nimbusds:nimbus-jose-jwt` | `10.6` |
+| `io.github.artsok:rerunner-jupiter` | `2.1.6` |
+| `org.apache.commons:commons-lang3` | `3.20.0` |
+| `commons-codec:commons-codec` | `1.20.0` |
+| `org.antlr:ST4` | `4.3.4` |
+| `com.github.ben-manes.caffeine:caffeine` | `3.2.3` |
+| `org.wiremock.integrations:wiremock-spring-boot` | `4.0.8` |
+| plugin `org.danilopianini.publish-on-central` | `9.1.9` |
+
+**Leave managed (no explicit version — do NOT add one):** `org.jspecify:jspecify`, `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml`, all `org.springframework.*` / `org.springframework.cloud.*` / `org.junit.jupiter.*` artifacts. These come from the Spring Boot / Spring Cloud BOMs.
+
+- [x] **Step 1: Add the Gradle Versions Plugin (temporary)**
+
+In `oag/build.gradle`, add to the `plugins { }` block:
+
+```groovy
+    id 'com.github.ben-manes.versions' version '0.54.0'
+```
+
+- [x] **Step 2: Generate the outdated-dependencies report**
+
+Run (from `oag/`): `./gradlew dependencyUpdates -Drevision=release --console=plain`
+Expected: a report ending with a section `The following dependencies have later stable versions:` (or `everything is up to date`).
+
+Read the full report at `oag/build/dependencyUpdates/report.txt`.
+
+- [x] **Step 3: Update each outdated explicit pin**
+
+For every coordinate in the table above that the report lists with a newer stable release, edit its version literal in `oag/build.gradle` to that release. Rules:
+- Guava: pick the newest `-jre` release, never `-android`.
+- Ignore any candidate whose version contains `-M`, `-RC`, `-alpha`, `-beta` or `-SNAPSHOT`.
+- If a coordinate is already current, leave it unchanged.
+- Also update the `org.danilopianini.publish-on-central` plugin version if the report lists a newer stable one (needed for full Gradle 9 compatibility of the publishing tasks).
+- Do **not** edit any coordinate not in the table (those are BOM-managed).
+
+- [x] **Step 4: Build after the refresh**
+
+Run (from `oag/`): `./gradlew clean build --console=plain`
+Expected: `BUILD SUCCESSFUL`, all tests pass.
+
+If a specific bump breaks compilation or a test, revert *only that one coordinate* to its previous pin, re-run the build to confirm green, and note the held-back dependency in the close-out (Task 5) with the reason.
+
+- [x] **Step 5: Verify the publishing plugin still configures on Gradle 9**
+
+Run (from `oag/`): `./gradlew tasks --group publishing --console=plain`
+Expected: the task list renders without a plugin-compatibility error (confirms `publish-on-central` works under Gradle 9.6.1).
+
+- [x] **Step 6: Remove the temporary Versions Plugin**
+
+Delete the `id 'com.github.ben-manes.versions' version '0.54.0'` line added in Step 1, to keep the build file lean.
+
+- [x] **Step 7: Final build without the temporary plugin**
+
+Run (from `oag/`): `./gradlew clean build --console=plain`
+Expected: `BUILD SUCCESSFUL`.
+
+- [x] **Step 8: Commit**
+
+```bash
+git add oag/build.gradle
+git commit -m "build: refresh pinned dependencies to latest stable releases"
+```
+
+---
+
+### Task 4: Update the Docker build image to Gradle 9.6.1
+
+**Files:**
+- Modify: `Dockerfile:4` (build-stage base image)
+
+**Interfaces:**
+- Consumes: the Gradle 9.6.1 wrapper from Task 1 (the build actually runs via `./gradlew`, so the base image mainly provides the JDK; keeping the image's Gradle tag in sync avoids confusion and guarantees a JDK 17 build environment).
+- Produces: a Docker image that builds OAG with the same toolchain as local/CI. The **runtime** stage (`amazoncorretto:17…`) stays on Java 17 — do not change it.
+
+- [x] **Step 1: Update the build-stage base image**
+
+In `Dockerfile`, change the first `FROM`:
+
+```dockerfile
+FROM gradle:9.6.1-jdk17 AS build
+```
+
+(from `FROM gradle:8.14-jdk17 AS build`). Leave the package-stage `FROM amazoncorretto:17.0.14-alpine3.18` unchanged.
+
+- [x] **Step 2: Build the image end-to-end**
+
+Run (from the repository root): `docker build -t owasp/application-gateway:SNAPSHOT .`
+Expected: the build completes successfully, including the `./gradlew clean assemble --no-daemon` step, producing `/app/oag.jar`.
+
+- [x] **Step 3: Smoke-test the container boots**
+
+Run:
+```bash
+docker run --rm -d -p 8080:8080 --name oag-smoke owasp/application-gateway:SNAPSHOT
+sleep 20
+docker logs oag-smoke 2>&1 | tail -20
+docker rm -f oag-smoke
+```
+Expected: logs show the gateway starting (Netty listening on 8080) with no stacktrace/`APPLICATION FAILED TO START`.
+
+- [x] **Step 4: Commit**
+
+```bash
+git add Dockerfile
+git commit -m "build: update Docker build image to gradle:9.6.1-jdk17"
+```
+
+---
+
+### Task 5: Update documentation and close out the iteration
+
+**Files:**
+- Modify: `.claude/CLAUDE.md` (Tech-Stack line)
+- Verify (expected: no change): `www/docs/docs/Setup-for-OAG-development.md`, `www/docs/docs/index.md`
+- Modify: `implementation-progress/00003-upgrade-spring-boot-4.1-spring-cloud-gradle-9.md` (this file — mark done)
+
+**Interfaces:**
+- Consumes: the completed upgrade from Tasks 1–4.
+- Produces: documentation that reflects the current stack, per the project directive to keep docs current (and to state the *current* state only — no "changed from X" history in the docs themselves).
+
+- [x] **Step 1: Update the Tech-Stack line in CLAUDE.md**
+
+In `.claude/CLAUDE.md`, change the overview Tech-Stack line from `Gradle 8` to `Gradle 9`:
+
+```markdown
+- **Tech-Stack:** SpringCloudGateway · Java 17 · Gradle 9 · docker · vitepress (for documentation) 
+```
+
+- [x] **Step 2: Verify the developer-setup docs are still accurate**
+
+Read `www/docs/docs/Setup-for-OAG-development.md` and `www/docs/docs/index.md`. They state "Java 17 or higher", which remains correct for Spring Boot 4.1 — **no change expected**. Only edit if you find a hardcoded stale version (e.g. an explicit "Gradle 8" or "Spring Boot 4.0"); the current grep shows none.
+
+- [x] **Step 3: Mark this iteration plan complete**
+
+In this file, tick every `- [ ]` checkbox that has been completed and add a short "Outcome" note at the bottom recording the final resolved versions (Gradle, Spring Boot, Spring Cloud) and any dependency that was held back in Task 3 Step 4 and why.
+
+- [x] **Step 4: Final full verification**
+
+Run (from `oag/`): `./gradlew clean build --console=plain`
+Expected: `BUILD SUCCESSFUL`, all tests pass — the definitive done-check for the whole plan.
+
+- [x] **Step 5: Commit**
+
+```bash
+git add .claude/CLAUDE.md implementation-progress/00003-upgrade-spring-boot-4.1-spring-cloud-gradle-9.md
+git commit -m "docs: reflect Gradle 9 / Spring Boot 4.1 upgrade"
+```
+
+---
+
+## Definition of Done
+
+- All checkboxes above are ticked in this file.
+- `./gradlew clean build` prints `BUILD SUCCESSFUL` on Gradle 9.6.1 with Spring Boot 4.1.0 and Spring Cloud 2025.1.2; all 43 test classes (108 tests) pass — none disabled or skipped.
+- `docker build` succeeds and the container boots cleanly.
+- Explicitly-pinned libraries are at their latest stable releases (or documented as held back with a reason).
+- Documentation reflects the current stack.
+
+## Outcome
+
+- **Final resolved versions:** Gradle `9.6.1`, Spring Boot `4.1.0`, Spring Cloud `2025.1.2` (Oakwood).
+- **Dependency bumps (Task 3):** `com.google.guava:guava` → `33.6.0-jre`, `org.yaml:snakeyaml` → `2.6`, `com.nimbusds:oauth2-oidc-sdk` → `11.38.1`, `com.nimbusds:nimbus-jose-jwt` → `10.9.1`, `commons-codec:commons-codec` → `1.22.0`, `com.github.ben-manes.caffeine:caffeine` → `3.2.4`, `org.wiremock.integrations:wiremock-spring-boot` → `4.2.2`, plugin `org.danilopianini.publish-on-central` → `9.2.8`.
+- **Unchanged (already latest stable):** `io.github.artsok:rerunner-jupiter`, `org.apache.commons:commons-lang3`, `org.antlr:ST4`.
+- **Source fix (Task 2):** `ReadRequestBodyFilter` switched to the typed `setRewriteFunction(Class, Class, RewriteFunction)` overload required by the Spring Cloud Gateway 5.0.2 API; behavior-preserving.
+- **Held-back dependencies:** none — every explicitly pinned library reached its latest stable release.
+- **Docker verification:** `docker build` succeeds end-to-end (the `gradle:9.6.1-jdk17` build stage runs `./gradlew clean assemble` → `BUILD SUCCESSFUL`, producing `oag.jar`), and the resulting container boots cleanly on the `amazoncorretto:17` runtime — `Started OWASPApplicationGatewayApplication` with 2 routes, serving HTTP 200 on port 8080, no errors.
diff --git a/oag/build.gradle b/oag/build.gradle
index 12fe50a..76df17b 100644
--- a/oag/build.gradle
+++ b/oag/build.gradle
@@ -23,9 +23,9 @@
 
 plugins {
     id 'java'
-    id 'org.springframework.boot' version '4.0.1'
+    id 'org.springframework.boot' version '4.1.0'
     id 'io.spring.dependency-management' version '1.1.7'
-    id 'org.danilopianini.publish-on-central' version '9.1.9'
+    id 'org.danilopianini.publish-on-central' version '9.2.8'
     id 'maven-publish'
     id 'signing'
 }
@@ -44,23 +44,23 @@ repositories {
 }
 
 ext {
-    springCloudVersion = '2025.1.0'
+    springCloudVersion = '2025.1.2'
 }
 
 dependencies {
     // Security fixes section
 
     // Main dependencies
-    implementation 'com.google.guava:guava:33.5.0-jre'
-    implementation 'org.yaml:snakeyaml:2.5'
-    implementation 'com.nimbusds:oauth2-oidc-sdk:11.30.1'
-    implementation 'com.nimbusds:nimbus-jose-jwt:10.6'
+    implementation 'com.google.guava:guava:33.6.0-jre'
+    implementation 'org.yaml:snakeyaml:2.6'
+    implementation 'com.nimbusds:oauth2-oidc-sdk:11.38.1'
+    implementation 'com.nimbusds:nimbus-jose-jwt:10.9.1'
     implementation 'io.github.artsok:rerunner-jupiter:2.1.6'
     implementation 'org.jspecify:jspecify'
     implementation 'org.apache.commons:commons-lang3:3.20.0'
-    implementation 'commons-codec:commons-codec:1.20.0'
+    implementation 'commons-codec:commons-codec:1.22.0'
     implementation 'org.antlr:ST4:4.3.4'
-    implementation 'com.github.ben-manes.caffeine:caffeine:3.2.3'
+    implementation 'com.github.ben-manes.caffeine:caffeine:3.2.4'
     implementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml'
 
     // Spring Cloud dependencies
@@ -72,7 +72,7 @@ dependencies {
     testImplementation 'org.junit.jupiter:junit-jupiter-api'
     testImplementation 'org.junit.jupiter:junit-jupiter-engine'
     testImplementation 'org.springframework.cloud:spring-cloud-contract-wiremock'
-    testImplementation 'org.wiremock.integrations:wiremock-spring-boot:4.0.8'
+    testImplementation 'org.wiremock.integrations:wiremock-spring-boot:4.2.2'
 }
 
 dependencyManagement {
@@ -192,4 +192,4 @@ signing {
     def signingPassword = System.env.SIGNING_PASSWORD
     useInMemoryPgpKeys(signingKey, signingPassword)
     // sign publishing.publications.OSSRH is called by plugin publish-on-central
-}
\ No newline at end of file
+}
diff --git a/oag/gradle/wrapper/gradle-wrapper.jar b/oag/gradle/wrapper/gradle-wrapper.jar
index 1b33c55..b1b8ef5 100644
Binary files a/oag/gradle/wrapper/gradle-wrapper.jar and b/oag/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/oag/gradle/wrapper/gradle-wrapper.properties b/oag/gradle/wrapper/gradle-wrapper.properties
index ca025c8..dbe66e1 100644
--- a/oag/gradle/wrapper/gradle-wrapper.properties
+++ b/oag/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,10 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip
+distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/oag/gradlew b/oag/gradlew
index 23d15a9..249efbb 100755
--- a/oag/gradlew
+++ b/oag/gradlew
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright © 2015-2021 the original authors.
+# Copyright © 2015 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@
 
 ##############################################################################
 #
-#   Gradle start up script for POSIX generated by Gradle.
+#   gradlew start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
@@ -29,7 +29,7 @@
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
-#           ksh Gradle
+#           ksh gradlew
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -114,7 +114,6 @@ case "$( uname )" in                #(
   NONSTOP* )        nonstop=true ;;
 esac
 
-CLASSPATH="\\\"\\\""
 
 
 # Determine the Java command to use to start the JVM.
@@ -172,7 +171,6 @@ fi
 # For Cygwin or MSYS, switch paths to Windows format before running java
 if "$cygwin" || "$msys" ; then
     APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
 
     JAVACMD=$( cygpath --unix "$JAVACMD" )
 
@@ -212,7 +210,6 @@ DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
         -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
         "$@"
 
diff --git a/oag/gradlew.bat b/oag/gradlew.bat
index db3a6ac..8508ef6 100644
--- a/oag/gradlew.bat
+++ b/oag/gradlew.bat
@@ -1,94 +1,82 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-@rem SPDX-License-Identifier: Apache-2.0
-@rem
-
-@if "%DEBUG%"=="" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%"=="" set DIRNAME=.
-@rem This is normally unused
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if %ERRORLEVEL% equ 0 goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  gradlew startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+"%COMSPEC%" /c exit 1
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+"%COMSPEC%" /c exit 1
+
+:execute
+@rem Setup the command line
+
+
+
+@rem Execute gradlew
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
+
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%
diff --git a/oag/src/main/java/org/owasp/oag/filters/proxy/ReadRequestBodyFilter.java b/oag/src/main/java/org/owasp/oag/filters/proxy/ReadRequestBodyFilter.java
index e5d8a83..f49bc9e 100644
--- a/oag/src/main/java/org/owasp/oag/filters/proxy/ReadRequestBodyFilter.java
+++ b/oag/src/main/java/org/owasp/oag/filters/proxy/ReadRequestBodyFilter.java
@@ -40,9 +40,15 @@ public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain, G
                 var factory = new ModifyRequestBodyGatewayFilterFactory();
                 var config = new ModifyRequestBodyGatewayFilterFactory.Config();
                 config.setContentType(null);
-                config.setInClass(String.class);
-                config.setOutClass(String.class);
-                config.setRewriteFunction((e, s) -> rewrite(e, s, routeContext));
+                // Use the typed 3-arg overload (which also sets inClass/outClass) instead of the
+                // single-arg setRewriteFunction(RewriteFunction): as of spring-cloud-gateway-server-webflux
+                // 5.0.2, RewriteFunction declares its generic apply(ServerWebExchange, T) alongside a
+                // default erasure bridge apply(Object, Object), so assigning a lambda to the raw
+                // RewriteFunction parameter of the single-arg overload fails with
+                // "cannot infer functional interface descriptor for RewriteFunction". Passing explicit
+                // Class witnesses gives the lambda a properly parameterized RewriteFunction<String, String>
+                // target type.
+                config.setRewriteFunction(String.class, String.class, (e, s) -> rewrite(e, s, routeContext));
 
                 return factory.apply(config).filter(exchange, chain);
             }
@@ -81,9 +87,9 @@ public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain, G
      * @param routeContext the context for the current gateway route
      * @return a Mono containing the original body
      */
-    private Mono<Object> rewrite(Object e, Object s, GatewayRouteContext routeContext) {
+    private Mono<String> rewrite(ServerWebExchange e, String s, GatewayRouteContext routeContext) {
 
-        consumeBody((ServerWebExchange) e, (String) s, routeContext);
+        consumeBody(e, s, routeContext);
         return Mono.justOrEmpty(s);
     }
 }