Fix vulnerability warning on maven plugin (#2621)

* Fix vulnerability warning on maven plugin

* Compile fixes

* Fix bootstrap dep

* Test fix

* Fix tests

* FIx deps

.lgtm.yml

@@ -0,0 +1,6 @@
+# Don't run the tests when doing LGTM analysis
+extraction:
+  java:
+    index:
+      build_command: mvn clean install -DskipTests
+

hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/5_4_0/changes.yaml

@@ -15,13 +15,15 @@
 <li>Gson (JPA): 2.8.5 -> 2.8.6</li>
 <li>Caffeine (JPA): 2.7.0 -> 3.0.1</li>
 <li>Hibernate (JPA): 5.4.26.Final -> 5.4.30.Final</li>
-<li>Hibernate Search (JPA): 6.0.0.Final -> 6.0.2.Final</li>
+<li>Hibernate Search (JPA): 6.0.0.Final -> 6.0.3.Final</li>
 <li>Spring (JPA): 5.3.3 -> 5.3.6</li>
 <li>Spring Batch (JPA): 4.2.3.RELEASE -> 4.3.2</li>
-<li>Spring Data (JPA): 2.4.2 -> 2.4.7</li>
+<li>Spring Data (JPA): 2.4.2 -> 2.5.0</li>
 <li>Commons DBCP2 (JPA): 2.7.0 -> 2.8.0</li>
+<li>ElasticSearch Client (JPA): 7.10.2 -> 7.12.1</li>
 <li>Thymeleaf (Testpage Overlay): 3.0.11.RELEASE -> 3.0.12.RELEASE</li>
 <li>JAnsi (CLI): 2.1.1 -> 2.3.2</li>
 <li>JArchivelib (CLI): 1.0.0 -> 1.1.0</li>
 </ul>
 "
+

hapi-fhir-jpaserver-base/pom.xml

@@ -353,6 +353,10 @@
 				</exclusion>
 			</exclusions>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.data</groupId>
+			<artifactId>spring-data-commons</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework</groupId>
 			<artifactId>spring-messaging</artifactId>

hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/search/SearchCoordinatorSvcImpl.java

@@ -1298,6 +1298,11 @@ public class SearchCoordinatorSvcImpl implements ISearchCoordinatorSvc {
 			public Pageable first() {
 				return null;
 			}
+
+			@Override
+			public Pageable withPage(int theI) {
+				return null;
+			}
 		};
 
 		return page;

hapi-fhir-jpaserver-base/src/test/java/ca/uhn/fhir/jpa/stresstest/GiantTransactionPerfTest.java

@@ -391,6 +391,11 @@ public class GiantTransactionPerfTest {
 			throw new UnsupportedOperationException();
 		}
 
+		@Override
+		public void deleteAllById(Iterable<? extends Long> ids) {
+
+		}
+
 		@Override
 		public void deleteAll(Iterable<? extends ResourceHistoryTable> entities) {
 			throw new UnsupportedOperationException();
@@ -432,11 +437,26 @@ public class GiantTransactionPerfTest {
 			throw new UnsupportedOperationException();
 		}
 
+		@Override
+		public <S extends ResourceHistoryTable> List<S> saveAllAndFlush(Iterable<S> entities) {
+			throw new UnsupportedOperationException();
+		}
+
 		@Override
 		public void deleteInBatch(Iterable<ResourceHistoryTable> entities) {
 			throw new UnsupportedOperationException();
 		}
 
+		@Override
+		public void deleteAllInBatch(Iterable<ResourceHistoryTable> entities) {
+			throw new UnsupportedOperationException();
+		}
+
+		@Override
+		public void deleteAllByIdInBatch(Iterable<Long> ids) {
+			throw new UnsupportedOperationException();
+		}
+
 		@Override
 		public void deleteAllInBatch() {
 			throw new UnsupportedOperationException();
@@ -447,6 +467,11 @@ public class GiantTransactionPerfTest {
 			throw new UnsupportedOperationException();
 		}
 
+		@Override
+		public ResourceHistoryTable getById(Long theLong) {
+			throw new UnsupportedOperationException();
+		}
+
 		@Override
 		public <S extends ResourceHistoryTable> Optional<S> findOne(Example<S> example) {
 			return Optional.empty();

hapi-fhir-jpaserver-cql/src/main/java/ca/uhn/fhir/cql/dstu3/listener/ElmCacheResourceChangeListener.java

@@ -1,5 +1,25 @@
 package ca.uhn.fhir.cql.dstu3.listener;
 
+/*-
+ * #%L
+ * HAPI FHIR JPA Server - Clinical Quality Language
+ * %%
+ * Copyright (C) 2014 - 2021 Smile CDR, Inc.
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;

hapi-fhir-jpaserver-cql/src/main/java/ca/uhn/fhir/cql/r4/listener/ElmCacheResourceChangeListener.java

@@ -1,5 +1,25 @@
 package ca.uhn.fhir.cql.r4.listener;
 
+/*-
+ * #%L
+ * HAPI FHIR JPA Server - Clinical Quality Language
+ * %%
+ * Copyright (C) 2014 - 2021 Smile CDR, Inc.
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;

hapi-fhir-structures-r4/pom.xml

@@ -139,19 +139,16 @@
 		<dependency>
 			<groupId>org.apache.poi</groupId>
 			<artifactId>poi</artifactId>
-			<version>4.0.1</version>
 			<optional>true</optional>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.poi</groupId>
 			<artifactId>poi-ooxml</artifactId>
-			<version>4.0.1</version>
 			<optional>true</optional>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.poi</groupId>
-			<artifactId>ooxml-schemas</artifactId>
-			<version>1.4</version>
+			<artifactId>poi-ooxml-schemas</artifactId>
 			<optional>true</optional>
 		</dependency>
 		<dependency>

hapi-fhir-structures-r5/pom.xml

@@ -113,13 +113,11 @@
 		<dependency>
 			<groupId>org.apache.poi</groupId>
 			<artifactId>poi</artifactId>
-			<version>4.0.1</version>
 			<optional>true</optional>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.poi</groupId>
 			<artifactId>poi-ooxml</artifactId>
-			<version>4.0.1</version>
 			<optional>true</optional>
 		</dependency>
 		<dependency>

hapi-fhir-testpage-overlay/src/main/webapp/WEB-INF/templates/tmpl-head.html

@@ -11,11 +11,11 @@
 
    <!-- JQuery and Bootstrap -->
    <script th:src="@{/resources/jquery/dist/jquery.js}"></script>
-   <link rel="stylesheet" th:href="@{/resources/bootstrap/dist/css/bootstrap.css}" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css"/>
+   <link rel="stylesheet" th:href="@{/resources/bootstrap/dist/css/bootstrap.css}"/>
    <link rel="stylesheet" media="screen" th:href="@{/resources/font-awesome/css/fontawesome.min.css}" />
    <script th:src="@{/resources/font-awesome/js/all.min.js}" data-auto-replace-svg="nest"></script>
    <link rel="stylesheet" media="screen" th:href="@{/resources/awesome-bootstrap-checkbox/awesome-bootstrap-checkbox.css}" />
-   <script th:src="@{/resources/bootstrap/dist/js/bootstrap.min.js}" src="https://maxcdn.bootstrapcdn.com/bootstrap/4.2.1/js/bootstrap.min.js"></script>
+   <script th:src="@{/resources/bootstrap/dist/js/bootstrap.min.js}"></script>
    <!--<script th:src="@{/resources/bootstrap/js/tab.js}"></script>-->
 
 

hapi-tinder-plugin/pom.xml

@@ -36,7 +36,7 @@
 		<dependency>
 			<groupId>ca.uhn.hapi.fhir</groupId>
 			<artifactId>hapi-fhir-structures-dstu2</artifactId>
-			<version>2.2</version>
+			<version>5.3.0</version>
 			<exclusions>
 				<exclusion>
 					<groupId>ca.uhn.hapi.fhir</groupId>
@@ -47,7 +47,7 @@
 		<dependency>
 			<groupId>ca.uhn.hapi.fhir</groupId>
 			<artifactId>hapi-fhir-structures-dstu2.1</artifactId>
-			<version>3.3.0</version>
+			<version>5.3.0</version>
 			<exclusions>
 				<exclusion>
 					<groupId>ca.uhn.hapi.fhir</groupId>
@@ -97,7 +97,7 @@
 		<dependency>
 			<artifactId>commons-lang</artifactId>
 			<groupId>commons-lang</groupId>
-			<version>2.5</version>
+			<version>2.6</version>
 		</dependency>
 
 		<dependency>
@@ -188,7 +188,7 @@
 		<dependency>
 			<groupId>org.apache.ant</groupId>
 			<artifactId>ant</artifactId>
-			<version>1.10.8</version>
+			<version>1.10.10</version>
 		</dependency>
 		
 		<!-- This is just used for  -->
@@ -199,15 +199,10 @@
 			<scope>test</scope>
 		</dependency>
 
-		<!-- 
-		Android includes an old version of commons-codec, so 
-		we compile against the old version to make sure we can compile
-		against it 
-		-->
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
-			<version>1.1</version>
+			<version>1.15</version>
 		</dependency>
 
 

hapi-tinder-plugin/src/main/java/ca/uhn/fhir/tinder/TinderJpaRestServerMojo.java

@@ -1,20 +1,35 @@
 package ca.uhn.fhir.tinder;
 
-import java.io.*;
-import java.util.*;
-
-import org.apache.commons.lang.WordUtils;
-import org.apache.maven.model.Resource;
-import org.apache.maven.plugin.*;
-import org.apache.maven.plugins.annotations.*;
-import org.apache.maven.plugins.annotations.Mojo;
-import org.apache.maven.project.MavenProject;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-
 import ca.uhn.fhir.context.FhirContext;
 import ca.uhn.fhir.context.FhirVersionEnum;
-import ca.uhn.fhir.tinder.parser.*;
+import ca.uhn.fhir.tinder.parser.BaseStructureSpreadsheetParser;
+import ca.uhn.fhir.tinder.parser.ResourceGeneratorUsingModel;
+import ca.uhn.fhir.tinder.parser.ResourceGeneratorUsingSpreadsheet;
+import org.apache.commons.lang.WordUtils;
+import org.apache.maven.model.Resource;
+import org.apache.maven.plugin.AbstractMojo;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.Component;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.project.MavenProject;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.apache.velocity.runtime.RuntimeConstants;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Properties;
+import java.util.TreeSet;
 
 @Mojo(name = "generate-jparest-server", defaultPhase = LifecyclePhase.GENERATE_SOURCES)
 public class TinderJpaRestServerMojo extends AbstractMojo {
@@ -32,7 +47,7 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 
 	@Parameter(required = true)
 	private String packageBase;
-	
+
 	@Parameter(required = true)
 	private String configPackageBase;
 
@@ -70,12 +85,12 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 		} else {
 			throw new MojoFailureException("Unknown version configured: " + version);
 		}
-		
+
 		if (baseResourceNames == null || baseResourceNames.isEmpty()) {
 			baseResourceNames = new ArrayList<>();
-			
-			ourLog.info("No resource names supplied, going to use all resources from version: {}",fhirContext.getVersion().getVersion());
-			
+
+			ourLog.info("No resource names supplied, going to use all resources from version: {}", fhirContext.getVersion().getVersion());
+
 			Properties p = new Properties();
 			try {
 				p.load(fhirContext.getVersion().getFhirVersionPropertiesFile());
@@ -83,10 +98,10 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 				throw new MojoFailureException("Failed to load version property file", e);
 			}
 
-			ourLog.debug("Property file contains: {}",p);
+			ourLog.debug("Property file contains: {}", p);
 
 			TreeSet<String> keys = new TreeSet<>();
-			for(Object next : p.keySet()) {
+			for (Object next : p.keySet()) {
 				keys.add((String) next);
 			}
 			for (String next : keys) {
@@ -94,7 +109,7 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 					baseResourceNames.add(next.substring("resource.".length()).toLowerCase());
 				}
 			}
-			
+
 			if (fhirContext.getVersion().getVersion() == FhirVersionEnum.DSTU3) {
 				baseResourceNames.remove("conformance");
 			}
@@ -110,9 +125,9 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 			}
 			baseResourceNames.removeAll(excludeResourceNames);
 		}
-		
+
 		ourLog.info("Including the following resources: {}", baseResourceNames);
-		
+
 		File configPackageDirectoryBase = new File(targetDirectory, configPackageBase.replace(".", File.separatorChar + ""));
 		configPackageDirectoryBase.mkdirs();
 		File packageDirectoryBase = new File(targetDirectory, packageBase.replace(".", File.separatorChar + ""));
@@ -126,7 +141,7 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 
 			gen.setFilenameSuffix("ResourceProvider");
 			gen.setTemplate("/vm/jpa_resource_provider.vm");
-			gen.writeAll(packageDirectoryBase, null,packageBase);
+			gen.writeAll(packageDirectoryBase, null, packageBase);
 
 			// gen.setFilenameSuffix("ResourceTable");
 			// gen.setTemplate("/vm/jpa_resource_table.vm");
@@ -151,17 +166,17 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 			} else {
 				ctx.put("resourcePackage", "ca.uhn.fhir.model." + version + ".resource");
 			}
-			
+
 			String capitalize = WordUtils.capitalize(version);
 			if ("Dstu".equals(capitalize)) {
-				capitalize="Dstu1";
+				capitalize = "Dstu1";
 			}
 			ctx.put("versionCapitalized", capitalize);
 
 			VelocityEngine v = new VelocityEngine();
-			v.setProperty("resource.loader", "cp");
-			v.setProperty("cp.resource.loader.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
-			v.setProperty("runtime.references.strict", Boolean.TRUE);
+			v.setProperty(RuntimeConstants.RESOURCE_LOADERS, "cp");
+			v.setProperty("resource.loader.cp.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
+			v.setProperty("runtime.strict_mode.enable", Boolean.TRUE);
 
 
 			/*
@@ -174,7 +189,7 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 			OutputStreamWriter w = new OutputStreamWriter(new FileOutputStream(f, false), "UTF-8");
 			v.evaluate(ctx, w, "", templateReader);
 			w.close();
-			
+
 			Resource resource = new Resource();
 			resource.setDirectory(targetResourceDirectory.getAbsolutePath());
 			resource.addInclude(targetResourceSpringBeansFile);
@@ -218,12 +233,12 @@ public class TinderJpaRestServerMojo extends AbstractMojo {
 		mojo.packageBase = "ca.uhn.fhir.jpa.rp.r4";
 		mojo.configPackageBase = "ca.uhn.fhir.jpa.config";
 		mojo.baseResourceNames = new ArrayList<String>(Arrays.asList(
-				"bundle",
-				"observation",
+			"bundle",
+			"observation",
 //				"communicationrequest"
-				"binary",
-				"structuredefinition"
-				));
+			"binary",
+			"structuredefinition"
+		));
 		mojo.targetDirectory = new File("target/generated/valuesets");
 		mojo.targetResourceDirectory = new File("target/generated/valuesets");
 		mojo.targetResourceSpringBeansFile = "tmp_beans.xml";

hapi-tinder-plugin/src/main/java/ca/uhn/fhir/tinder/TinderResourceGeneratorMojo.java

@@ -11,8 +11,13 @@ import org.apache.maven.plugins.annotations.Mojo;
 import org.apache.maven.plugins.annotations.Parameter;
 import org.apache.velocity.VelocityContext;
 import org.apache.velocity.app.VelocityEngine;
+import org.apache.velocity.runtime.RuntimeConstants;
 
-import java.io.*;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
 
 @Mojo(name = "generate-resource", defaultPhase = LifecyclePhase.GENERATE_RESOURCES)
 public class TinderResourceGeneratorMojo extends AbstractGeneratorMojo {
@@ -45,9 +50,9 @@ public class TinderResourceGeneratorMojo extends AbstractGeneratorMojo {
 			ctx.put("versionCapitalized", configuration.getVersionCapitalized());
 
 			VelocityEngine v = new VelocityEngine();
-			v.setProperty("resource.loader", "cp");
-			v.setProperty("cp.resource.loader.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
-			v.setProperty("runtime.references.strict", Boolean.TRUE);
+			v.setProperty(RuntimeConstants.RESOURCE_LOADERS, "cp");
+			v.setProperty("resource.loader.cp.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
+			v.setProperty("runtime.strict_mode.enable", Boolean.TRUE);
 
 			InputStream templateIs = ResourceGeneratorUsingSpreadsheet.class.getResourceAsStream(templateName);
 			InputStreamReader templateReader = new InputStreamReader(templateIs);

hapi-tinder-plugin/src/main/java/ca/uhn/fhir/tinder/VelocityHelper.java

@@ -74,8 +74,8 @@ public class VelocityHelper {
 					result.setProperty(RuntimeConstants.FILE_RESOURCE_LOADER_PATH, path);
 				}
 			} else {
-				result.setProperty("resource.loader", "cp");
-				result.setProperty("cp.resource.loader.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
+				result.setProperty(RuntimeConstants.RESOURCE_LOADERS, "cp");
+				result.setProperty("resource.loader.cp.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
 			}
 		}
 		

hapi-tinder-plugin/src/main/java/ca/uhn/fhir/tinder/parser/BaseStructureParser.java

@@ -12,7 +12,14 @@ import ca.uhn.fhir.tinder.TinderResourceGeneratorMojo;
 import ca.uhn.fhir.tinder.TinderStructuresMojo;
 import ca.uhn.fhir.tinder.ValueSetGenerator;
 import ca.uhn.fhir.tinder.VelocityHelper;
-import ca.uhn.fhir.tinder.model.*;
+import ca.uhn.fhir.tinder.model.BaseElement;
+import ca.uhn.fhir.tinder.model.BaseRootType;
+import ca.uhn.fhir.tinder.model.Child;
+import ca.uhn.fhir.tinder.model.Composite;
+import ca.uhn.fhir.tinder.model.Extension;
+import ca.uhn.fhir.tinder.model.Resource;
+import ca.uhn.fhir.tinder.model.ResourceBlock;
+import ca.uhn.fhir.tinder.model.SimpleChild;
 import ca.uhn.fhir.tinder.model.SimpleSetter.Parameter;
 import com.google.common.base.Charsets;
 import org.apache.commons.io.FileUtils;
@@ -23,14 +30,30 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.maven.plugin.MojoFailureException;
 import org.apache.velocity.VelocityContext;
 import org.apache.velocity.app.VelocityEngine;
+import org.apache.velocity.runtime.RuntimeConstants;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
-import java.io.*;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
 import java.lang.annotation.Annotation;
 import java.lang.reflect.Constructor;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.TreeSet;
 
 import static org.apache.commons.lang.StringUtils.defaultString;
 import static org.apache.commons.lang.StringUtils.isNotBlank;
@@ -311,7 +334,7 @@ public abstract class BaseStructureParser {
 		return myTemplateFile;
 	}
 
-	public void setTemplateFile (File theTemplateFile) {
+	public void setTemplateFile(File theTemplateFile) {
 		myTemplateFile = theTemplateFile;
 	}
 
@@ -569,7 +592,7 @@ public abstract class BaseStructureParser {
 			fos.flush();
 		}
 	}
-	
+
 	public void writeAll(File theOutputDirectory, File theResourceOutputDirectory, String thePackageBase) throws MojoFailureException {
 		writeAll(TargetType.SOURCE, theOutputDirectory, theResourceOutputDirectory, thePackageBase);
 	}
@@ -674,9 +697,9 @@ public abstract class BaseStructureParser {
 				ctx.put("versionCapitalized", capitalize);
 
 				VelocityEngine v = new VelocityEngine();
-				v.setProperty("resource.loader", "cp");
-				v.setProperty("cp.resource.loader.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
-				v.setProperty("runtime.references.strict", Boolean.TRUE);
+				v.setProperty(RuntimeConstants.RESOURCE_LOADERS, "cp");
+				v.setProperty("resource.loader.cp.class", "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
+				v.setProperty("runtime.strict_mode.enable", Boolean.TRUE);
 
 				InputStream templateIs = ResourceGeneratorUsingSpreadsheet.class.getResourceAsStream("/vm/fhirversion_properties.vm");
 				InputStreamReader templateReader = new InputStreamReader(templateIs);

pom.xml

@@ -789,7 +789,7 @@
 		<flexmark_version>0.50.40</flexmark_version>
 		<flyway_version>6.5.4</flyway_version>
 		<hibernate_version>5.4.30.Final</hibernate_version>
-		<hibernate_search_version>6.0.2.Final</hibernate_search_version>
+		<hibernate_search_version>6.0.3.Final</hibernate_search_version>
 		<!-- Update lucene version when you update hibernate-search version -->
 		<lucene_version>8.7.0</lucene_version>
 		<hamcrest_version>2.2</hamcrest_version>
@@ -811,7 +811,7 @@
 		<log4j_to_slf4j_version>2.11.1</log4j_to_slf4j_version>
 		<spring_version>5.3.6</spring_version>
 		<!-- FYI: Spring Data JPA 2.1.9 causes test failures due to unexpected cascading deletes -->
-		<spring_data_version>2.4.7</spring_data_version>
+		<spring_data_version>2.5.0</spring_data_version>
 		<spring_batch_version>4.3.2</spring_batch_version>
 		<spring_boot_version>2.4.4</spring_boot_version>
 		<spring_retry_version>1.2.2.RELEASE</spring_retry_version>
@@ -1157,7 +1157,7 @@
 			<dependency>
 				<groupId>mysql</groupId>
 				<artifactId>mysql-connector-java</artifactId>
-				<version>8.0.20</version>
+				<version>8.0.24</version>
 			</dependency>
             <dependency>
                 <groupId>net.sourceforge.htmlunit</groupId>
@@ -1329,6 +1329,21 @@
 				<artifactId>maven-plugin-annotations</artifactId>
 				<version>3.6.0</version>
 			</dependency>
+			<dependency>
+				<groupId>org.apache.poi</groupId>
+				<artifactId>poi</artifactId>
+				<version>4.1.2</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.poi</groupId>
+				<artifactId>poi-ooxml</artifactId>
+				<version>4.1.2</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.poi</groupId>
+				<artifactId>poi-ooxml-schemas</artifactId>
+				<version>4.1.2</version>
+			</dependency>
 			<dependency>
 				<groupId>org.apache.velocity</groupId>
 				<artifactId>velocity-engine-core</artifactId>
@@ -1547,6 +1562,10 @@
 				</exclusions>
 			</dependency>
 			<dependency>
+				<!--
+				Be careful bumping this, you need to match the maximum version supported by Hibernate Search.
+				See: https://docs.jboss.org/hibernate/stable/search/reference/en-US/html_single/#getting-started-compatibility
+				-->
 				<groupId>org.elasticsearch.client</groupId>
 				<artifactId>elasticsearch-rest-high-level-client</artifactId>
 				<version>7.10.2</version>
@@ -1620,7 +1639,7 @@
 			<dependency>
 				<groupId>org.postgresql</groupId>
 				<artifactId>postgresql</artifactId>
-				<version>42.2.19</version>
+				<version>42.2.20</version>
 			</dependency>
 			<dependency>
 				<groupId>org.quartz-scheduler</groupId>
@@ -1751,6 +1770,12 @@
 				<groupId>org.webjars</groupId>
 				<artifactId>Eonasdan-bootstrap-datetimepicker</artifactId>
 				<version>4.17.47</version>
+				<exclusions>
+					<exclusion>
+						<groupId>*</groupId>
+						<artifactId>*</artifactId>
+					</exclusion>
+				</exclusions>
 			</dependency>
 			<dependency>
 				<groupId>org.webjars</groupId>