Address multiple known security vulnerabilities

core/annotation/src/test/java/datawave/annotation/util/v1/SegmentUtilsJsonTest.java

@@ -124,7 +124,7 @@ public void testFromMalformedJsonOne() {
                 "Expected an exception from malformed json");
         //@formatter:on
         System.out.println(e.getMessage());
-        assertTrue(e.getMessage().contains("Expect an array"));
+        assertTrue(e.getMessage().contains("Expected an array"));
 
     }
 

core/utils/common-utils/pom.xml

@@ -10,7 +10,6 @@
     <name>${project.artifactId}</name>
     <properties>
         <spotbugs.excludes.file>${project.basedir}/src/main/spotbugs/excludes.xml</spotbugs.excludes.file>
-        <version.spring-security-core>5.7.2</version.spring-security-core>
     </properties>
     <dependencyManagement>
         <dependencies>

docs/pom.xml

@@ -162,7 +162,7 @@
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-core</artifactId>
-            <version>${version.springframework}</version>
+            <version>${version.spring-security-core}</version>
         </dependency>
         <dependency>
             <groupId>org.wildfly</groupId>

pom.xml

@@ -59,7 +59,7 @@
         <version.caffeine>3.1.0</version.caffeine>
         <version.commons-beanutils>1.9.4</version.commons-beanutils>
         <version.commons-cli>1.4</version.commons-cli>
-        <version.commons-codec>1.12</version.commons-codec>
+        <version.commons-codec>1.17.1</version.commons-codec>
         <version.commons-collections>3.2.2</version.commons-collections>
         <version.commons-collections4>4.3</version.commons-collections4>
         <version.commons-configuration>1.10</version.commons-configuration>
@@ -100,7 +100,7 @@
         <version.httpcomponents-httpcore>4.4.8</version.httpcomponents-httpcore>
         <version.in-memory-accumulo>4.0.4</version.in-memory-accumulo>
         <version.infinispan>9.4.21.Final</version.infinispan>
-        <version.jackson>2.13.5</version.jackson>
+        <version.jackson>2.17.2</version.jackson>
         <version.jackson-mapper-asl>1.9.13</version.jackson-mapper-asl>
         <version.jakarta>2.3.3</version.jakarta>
         <version.javassist>3.24.0-GA</version.javassist>
@@ -128,18 +128,19 @@
         <version.minlog>1.2</version.minlog>
         <version.mockito>2.23.0</version.mockito>
         <version.mysql-connector>9.3.0</version.mysql-connector>
-        <version.netty>4.1.42.Final</version.netty>
+        <version.netty>4.1.115.Final</version.netty>
         <version.objenesis>2.1</version.objenesis>
         <version.picketbox>5.0.3.Final</version.picketbox>
         <version.powermock>2.0.9</version.powermock>
         <version.proto-google-common-protos>2.61.0</version.proto-google-common-protos>
-        <version.protobuf>3.16.3</version.protobuf>
-        <version.protobuf-java-util>3.16.3</version.protobuf-java-util>
+        <version.protobuf>3.25.5</version.protobuf>
+        <version.protobuf-java-util>3.25.5</version.protobuf-java-util>
         <version.protostuff>1.6.2</version.protostuff>
         <version.saxon-he>12.4</version.saxon-he>
         <version.slf4j>2.0.17</version.slf4j>
         <version.spotify-dns>3.1.5</version.spotify-dns>
-        <version.spring>5.2.2.RELEASE</version.spring>
+        <version.spring>5.3.39</version.spring>
+        <version.spring-security-core>5.8.16</version.spring-security-core>
         <version.springframework>${version.spring}</version.springframework>
         <version.stream>2.9.6</version.stream>
         <version.thrift>0.17.0</version.thrift>

web-services/common/src/main/java/datawave/configuration/spring/ThreadSafeClassPathXmlApplicationContext.java

@@ -24,6 +24,7 @@
 import org.springframework.core.env.ConfigurableEnvironment;
 import org.springframework.core.io.ProtocolResolver;
 import org.springframework.core.io.Resource;
+import org.springframework.core.metrics.ApplicationStartup;
 
 /**
  * A delegating wrapper around {@link ConfigurableApplicationContext}. This implements all methods of {@link ConfigurableApplicationContext}, delegating each
@@ -76,6 +77,16 @@ public ConfigurableEnvironment getEnvironment() {
         return lockAndRead(configurableApplicationContext::getEnvironment);
     }
 
+    @Override
+    public void setApplicationStartup(ApplicationStartup applicationStartup) {
+        lockAndWrite(() -> configurableApplicationContext.setApplicationStartup(applicationStartup));
+    }
+
+    @Override
+    public ApplicationStartup getApplicationStartup() {
+        return lockAndRead(configurableApplicationContext::getApplicationStartup);
+    }
+
     @Override
     public void setEnvironment(ConfigurableEnvironment environment) {
         lockAndWrite(() -> configurableApplicationContext.setEnvironment(environment));
@@ -116,6 +127,11 @@ public void addApplicationListener(ApplicationListener<?> listener) {
         lockAndWrite(() -> configurableApplicationContext.addApplicationListener(listener));
     }
 
+    @Override
+    public void setClassLoader(ClassLoader classLoader) {
+        lockAndWrite(() -> configurableApplicationContext.setClassLoader(classLoader));
+    }
+
     @Override
     public void addProtocolResolver(ProtocolResolver protocolResolver) {
         lockAndWrite(() -> configurableApplicationContext.addProtocolResolver(protocolResolver));
@@ -231,6 +247,16 @@ public String[] getBeanDefinitionNames() {
         return lockAndRead(configurableApplicationContext::getBeanDefinitionNames);
     }
 
+    @Override
+    public <T> ObjectProvider<T> getBeanProvider(Class<T> requiredType, boolean allowEagerInit) {
+        return lockAndRead(() -> configurableApplicationContext.getBeanProvider(requiredType, allowEagerInit));
+    }
+
+    @Override
+    public <T> ObjectProvider<T> getBeanProvider(ResolvableType requiredType, boolean allowEagerInit) {
+        return lockAndRead(() -> configurableApplicationContext.getBeanProvider(requiredType, allowEagerInit));
+    }
+
     @Override
     public String[] getBeanNamesForType(ResolvableType resolvableType) {
         return lockAndRead(() -> configurableApplicationContext.getBeanNamesForType(resolvableType));
@@ -276,6 +302,12 @@ public <A extends Annotation> A findAnnotationOnBean(String beanName, Class<A> a
         return lockAndRead(() -> configurableApplicationContext.findAnnotationOnBean(beanName, annotationType));
     }
 
+    @Override
+    public <A extends Annotation> A findAnnotationOnBean(String beanName, Class<A> annotationType, boolean allowFactoryBeanInit)
+                    throws NoSuchBeanDefinitionException {
+        return lockAndRead(() -> configurableApplicationContext.findAnnotationOnBean(beanName, annotationType, allowFactoryBeanInit));
+    }
+
     @Override
     public BeanFactory getParentBeanFactory() {
         return lockAndRead(configurableApplicationContext::getParentBeanFactory);

web-services/pom.xml

@@ -49,7 +49,7 @@
         <version.geronimo-stax>1.0.1</version.geronimo-stax>
         <version.jms>1.1</version.jms>
         <version.mrunit>1.0.0</version.mrunit>
-        <version.protobuf>3.16.3</version.protobuf>
+        <version.protobuf>3.25.5</version.protobuf>
     </properties>
     <dependencyManagement>
         <dependencies>