Do 20230607 commons beanutils bump (#1297)

* Move property to module

* Document dependency exclusions, RELEASE_NOTES

RELEASE_NOTES.md

@@ -4,4 +4,4 @@
 
 ## Other code changes
 
-* no changes
+* Update commons-beanutils and apache.poi dependencies

org.hl7.fhir.validation/pom.xml

@@ -14,6 +14,7 @@
 
     <properties>
         <checkstyle_config_location>${project.parent.basedir}</checkstyle_config_location>
+        <info_cqframework_version>1.5.12</info_cqframework_version>
     </properties>
 
     <dependencies>
@@ -132,6 +133,13 @@
             <groupId>info.cqframework</groupId>
             <artifactId>model</artifactId>
             <version>${info_cqframework_version}</version>
+            <exclusions>
+                <!-- exclude this in favor of 1.9.4 for security reasons -->
+                <exclusion>
+                    <groupId>commons-beanutils</groupId>
+                    <artifactId>commons-beanutils</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>info.cqframework</groupId>
@@ -153,7 +161,11 @@
             <artifactId>qdm</artifactId>
             <version>${info_cqframework_version}</version>
         </dependency>
-
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+            <version>1.9.4</version>
+        </dependency>
         <!-- OkHttpDependency -->
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>

pom.xml

@@ -27,7 +27,6 @@
         <maven_clean_version>3.1.0</maven_clean_version>
         <okhttp.version>4.10.0</okhttp.version>
         <jacoco_version>0.8.9</jacoco_version>
-        <info_cqframework_version>1.5.12</info_cqframework_version>
         <lombok_version>1.18.22</lombok_version>
         <byte_buddy_version>1.12.14</byte_buddy_version>
         <apache_poi_version>5.2.1</apache_poi_version>
@@ -177,7 +176,8 @@
                 <artifactId>poi-ooxml</artifactId>
                 <version>${apache_poi_version}</version>
                 <exclusions>
-                    <exclusion>  <!-- declare the exclusion here -->
+                    <!-- exclude this because it collides with the needed poi-ooxml-full-->
+                    <exclusion>
                         <groupId>org.apache.poi</groupId>
                         <artifactId>poi-ooxml-lite</artifactId>
                     </exclusion>