Merge pull request #10407 from eclipse/fix/12.0.x/transitive-dep-warnings

Address transitive dependencies with open CVEs

jetty-ee8/jetty-ee8-home/pom.xml

@@ -400,6 +400,10 @@
       <groupId>org.eclipse.jetty.ee8</groupId>
       <artifactId>jetty-ee8-glassfish-jstl</artifactId>
       <exclusions>
+        <exclusion>
+          <groupId>xalan</groupId>
+          <artifactId>xalan</artifactId>
+        </exclusion>
         <exclusion>
           <groupId>javax.el</groupId>
           <artifactId>el-api</artifactId>
@@ -410,6 +414,10 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>xalan</groupId>
+      <artifactId>xalan</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.eclipse.jetty.ee8</groupId>
       <artifactId>jetty-ee8-plus</artifactId>

jetty-ee8/pom.xml

@@ -256,6 +256,11 @@
           <artifactId>javax.servlet.jsp.jstl</artifactId>
           <version>1.2.5</version>
         </dependency>
+        <dependency>
+          <groupId>xalan</groupId>
+          <artifactId>xalan</artifactId>
+          <version>2.7.3</version>
+        </dependency>
         <dependency>
           <groupId>org.eclipse.jetty.toolchain</groupId>
           <artifactId>jetty-javax-websocket-api</artifactId>

jetty-integrations/jetty-gcloud/jetty-gcloud-session-manager/pom.xml

@@ -42,6 +42,11 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java</artifactId>
+      <version>3.22.2</version>
+    </dependency>
   </dependencies>
 
   <build>

pom.xml

@@ -46,7 +46,7 @@
     <build-support.version>1.5</build-support.version>
     <checkstyle.version>10.6.0</checkstyle.version>
     <commons-codec.version>1.16.0</commons-codec.version>
-    <commons.compress.version>1.23.0</commons.compress.version>
+    <commons-compress.version>1.23.0</commons-compress.version>
     <commons.io.version>2.13.0</commons.io.version>
     <commons-lang3.version>3.13.0</commons-lang3.version>
     <conscrypt.version>2.5.2</conscrypt.version>
@@ -112,6 +112,7 @@
     <maven.resolver.version>1.9.15</maven.resolver.version>
     <maven.version>3.9.0</maven.version>
     <mongodb.version>3.12.11</mongodb.version>
+    <netty.version>4.1.95.Final</netty.version>
     <openpojo.version>0.9.1</openpojo.version>
     <org.osgi.annotation.version>8.1.0</org.osgi.annotation.version>
     <org.osgi.core.version>8.0.0</org.osgi.core.version>
@@ -146,7 +147,7 @@
     <taglibs-standard-spec.version>1.2.5</taglibs-standard-spec.version>
     <testcontainers.version>1.18.3</testcontainers.version>
     <wildfly.common.version>1.6.0.Final</wildfly.common.version>
-    <wildfly.elytron.version>2.2.1.Final</wildfly.elytron.version>
+    <wildfly.elytron.version>1.20.4.Final</wildfly.elytron.version>
     <xmemcached.version>2.4.7</xmemcached.version>
 
     <!-- some maven plugins versions -->
@@ -1009,6 +1010,16 @@
         <artifactId>commons-codec</artifactId>
         <version>${commons-codec.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-compress</artifactId>
+        <version>${commons-compress.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.avro</groupId>
+        <artifactId>avro</artifactId>
+        <version>${apache.avro.version}</version>
+      </dependency>
       <dependency>
         <groupId>io.grpc</groupId>
         <artifactId>grpc-core</artifactId>
@@ -1127,6 +1138,11 @@
         <artifactId>maven-plugin-tools-api</artifactId>
         <version>${maven.plugin-tools.version}</version>
       </dependency>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-handler</artifactId>
+        <version>${netty.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.awaitility</groupId>
         <artifactId>awaitility</artifactId>
@@ -1672,6 +1688,11 @@
         <artifactId>jboss-threads</artifactId>
         <version>${jboss-threads.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.wildfly.security</groupId>
+        <artifactId>wildfly-elytron</artifactId>
+        <version>${wildfly.elytron.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit</groupId>
         <artifactId>junit-bom</artifactId>