Security: Remediate vulnerability package issues

[sidhdirenge]

No description provided.

[gemini-code-assist]

Code Review

This pull request updates several subproject commits and adds multiple dependencies to the pom.xml file. The review feedback identifies a critical structural issue where the new dependencies are placed directly under <dependencyManagement> instead of inside a <dependencies> block, which will cause Maven build failures. Additionally, the reviewer points out several dependency issues, including a vulnerable version of commons-io (CVE-2024-47554), a version mismatch between Jackson libraries, and recommended upgrades for Guava and json-smart to address known bugs.

I am having trouble creating individual review comments. Click here to see my feedback.

pom.xml (795-849)

The newly added <dependency> elements are placed directly under <dependencyManagement> instead of being enclosed within the <dependencies> block. In Maven, all <dependency> declarations inside <dependencyManagement> must reside within a single <dependencies> element. This invalid structure will cause Maven POM parsing and build failures.

To resolve this, please move the closing </dependencies> tag (currently on line 793) to the end of the newly added dependencies (just before </dependencyManagement> on line 850).

pom.xml (1262-1316)

The newly added <dependency> elements are placed directly under <dependencyManagement> instead of being enclosed within the <dependencies> block. In Maven, all <dependency> declarations inside <dependencyManagement> must reside within a single <dependencies> element. This invalid structure will cause Maven POM parsing and build failures.

To resolve this, please move the closing </dependencies> tag (currently on line 1260) to the end of the newly added dependencies (just before </dependencyManagement> on line 1317).

pom.xml (845-849)

The version 2.7 of commons-io is vulnerable to CVE-2024-47554 (Uncontrolled Resource Consumption / Denial of Service in XmlStreamReader). It is highly recommended to upgrade to a non-vulnerable version such as 2.14.0 or higher (e.g., 2.18.0).

      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>2.18.0</version>
      </dependency>

pom.xml (1313-1317)

The version 2.7 of commons-io is vulnerable to CVE-2024-47554 (Uncontrolled Resource Consumption / Denial of Service in XmlStreamReader). It is highly recommended to upgrade to a non-vulnerable version such as 2.14.0 or higher (e.g., 2.18.0).

      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>2.18.0</version>
      </dependency>

pom.xml (820-824)

While version 32.0.0-android resolves the security vulnerability, the Guava maintainers recommend using version 32.0.1-android or higher because 32.0.0-android contains known issues that break certain functionality on Windows platforms.

      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>32.0.1-android</version>
      </dependency>

pom.xml (1287-1291)

While version 32.0.0-android resolves the security vulnerability, the Guava maintainers recommend using version 32.0.1-android or higher because 32.0.0-android contains known issues that break certain functionality on Windows platforms.

      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>32.0.1-android</version>
      </dependency>

pom.xml (835-839)

Although version 2.4.9 resolves the main denial of service vulnerability (CVE-2023-1370), the maintainers recommend upgrading to 2.4.10 or higher to address a remaining bug in 2.4.9.

      <dependency>
        <groupId>net.minidev</groupId>
        <artifactId>json-smart</artifactId>
        <version>2.4.10</version>
      </dependency>

pom.xml (1302-1306)

Although version 2.4.9 resolves the main denial of service vulnerability (CVE-2023-1370), the maintainers recommend upgrading to 2.4.10 or higher to address a remaining bug in 2.4.9.

      <dependency>
        <groupId>net.minidev</groupId>
        <artifactId>json-smart</artifactId>
        <version>2.4.10</version>
      </dependency>

pom.xml (815-819)

There is a version mismatch between jackson-databind (2.18.9) and jackson-core (2.18.6). To prevent potential runtime incompatibilities or classpath issues, it is recommended to align the versions of all Jackson dependencies to 2.18.9.

      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>2.18.9</version>
      </dependency>

pom.xml (1282-1286)

There is a version mismatch between jackson-databind (2.18.9) and jackson-core (2.18.6). To prevent potential runtime incompatibilities or classpath issues, it is recommended to align the versions of all Jackson dependencies to 2.18.9.

      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>2.18.9</version>
      </dependency>