From d63d3cab46d7e961f8a2a8f958881124d6284dff Mon Sep 17 00:00:00 2001
From: Tadgh <garygrantgraham@gmail.com>
Date: Sun, 4 Feb 2024 14:45:26 -0800
Subject: [PATCH] Rel 7 0 CVE (#5663)

* Bump json-path

* Pin parrson

* Bump elastic

* Bump spring version

* Exclude JDBC
---
 hapi-fhir-converter/pom.xml |  7 +++++++
 pom.xml                     | 11 ++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/hapi-fhir-converter/pom.xml b/hapi-fhir-converter/pom.xml
index 1b7b23f8ae3..02d21d6d15a 100644
--- a/hapi-fhir-converter/pom.xml
+++ b/hapi-fhir-converter/pom.xml
@@ -23,6 +23,13 @@
 			<groupId>ca.uhn.hapi.fhir</groupId>
 			<artifactId>org.hl7.fhir.convertors</artifactId>
 			<version>${fhir_core_version}</version>
+			<exclusions>
+				<!-- Exclude JDBC since it appears entirely unused, and has a CVE -->
+				<exclusion>
+					<groupId>org.xerial</groupId>
+					<artifactId>sqlite-jdbc</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<!-- Server -->
diff --git a/pom.xml b/pom.xml
index 611613f91b8..8e9a0f2c814 100644
--- a/pom.xml
+++ b/pom.xml
@@ -976,7 +976,7 @@
 		<swagger_version>2.2.19</swagger_version>
 		<slf4j_version>2.0.9</slf4j_version>
 		<log4j_to_slf4j_version>2.19.0</log4j_to_slf4j_version>
-		<spring_version>6.1.1</spring_version>
+		<spring_version>6.1.3</spring_version>
 		<spring_data_bom_version>2023.1.0</spring_data_bom_version>
 		<spring_batch_version>4.3.3</spring_batch_version>
 		<spring_boot_version>3.2.0</spring_boot_version>
@@ -989,7 +989,7 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<ebay_cors_filter_version>1.0.1</ebay_cors_filter_version>
 		<elastic_apm_version>1.44.0</elastic_apm_version>
-		<elasticsearch_version>8.11.1</elasticsearch_version>
+		<elasticsearch_version>8.12.0</elasticsearch_version>
 		<ucum_version>1.0.8</ucum_version>
 
 		<!-- CQL Support -->
@@ -1082,7 +1082,7 @@
 			<dependency>
 				<groupId>com.jayway.jsonpath</groupId>
 				<artifactId>json-path</artifactId>
-				<version>2.8.0</version>
+				<version>2.9.0</version>
 			</dependency>
 			<dependency>
 				<groupId>com.jayway.jsonpath</groupId>
@@ -1358,6 +1358,11 @@
 				<artifactId>elasticsearch-java</artifactId>
 				<version>${elasticsearch_version}</version>
 			</dependency>
+			<dependency>
+				<groupId>org.eclipse.parsson</groupId>
+				<artifactId>parsson</artifactId>
+				<version>1.0.5</version>
+			</dependency>
 			<dependency>
 				<groupId>com.google.code.gson</groupId>
 				<artifactId>gson</artifactId>