Dependency updates to eliminate vulnerabilities discovered by dependency-check

Eliminated all CRITICAL and HIGH except for CVE-2016-1000027 (which more or less forbids the use of Spring since 2016 -- it's moderately controversial.

@road

requested review from @bjsousa, @ERIC.SCHOVILLE, @lyle, and @NUWAN.KUMARASIRI

assigned to @bhill6

added 1 commit

• 0e176e85 - Version number updates since I forgot that this thing has 5 pom files.

Compare with previous version

dependency-check-report.html latest dependency check report after updates.

added 1 commit

• 9de23040 - One more dependency update

Compare with previous version

added 1 commit

• 79eec30f - Removing log4j dependencies from test and substituting logback as the slf4j...

Compare with previous version

added 1 commit

• 771a1889 - fix for CWE-93 issue in sample code raised by SAST

Compare with previous version

added 1 commit

• 00866503 - another fix for CWE-93 issue in sample code raised by SAST

Compare with previous version

added 1 commit

• 8db88ca0 - reorganized gitlab-ci for scanning

Compare with previous version

resolved all threads

Interesting. It seems that adding the Security/SAST-IaC.latest.gitlab-ci.yml scans caused it to scan the dependency-check-report.html files and treat them like code (triggering a slew of new CRITICALS).

Since we don't really need the maven OWASP scans with the gitlab ones available, I'm going to remove that from the pom file to avoid this stranger error that it caused.

added 1 commit

• 9e8b8594 - removing maven-dependency-check plugin to avoid false positives from gitlab scans

Compare with previous version

added 1 commit

• 7a0bacde - changes from code review

Compare with previous version

added 1 commit

• 0b83cff8 - removed unused cvs-suppressions file

Compare with previous version