Merge branch 'fix-vulnerabilities' into 'master'

Fix security vulnerabilities

See merge request !66

NOTICE

@@ -77,6 +77,7 @@ The following software have components provided under the terms of this license:
 - Jackson-dataformat-Smile (from http://github.com/FasterXML/jackson-dataformat-smile)
 - Jackson-dataformat-YAML (from https://github.com/FasterXML/jackson)
 - Jackson-datatype-Joda (from http://wiki.fasterxml.com/JacksonModuleJoda)
+- Jackson-datatype-Joda (from http://wiki.fasterxml.com/JacksonModuleJoda)
 - Jackson-datatype-jdk8 (from )
 - Jackson-module-JAXB-annotations (from http://wiki.fasterxml.com/JacksonJAXBAnnotations)
 - Jackson-module-parameter-names (from )
@@ -107,7 +108,6 @@ The following software have components provided under the terms of this license:
 - Mockito (from http://www.mockito.org)
 - Mockito (from http://mockito.org)
 - Netty/Buffer (from http://netty.io/)
-- Netty/Codec (from )
 - Netty/Common (from )
 - Netty/Handler (from )
 - Netty/Resolver (from )
@@ -462,7 +462,6 @@ The following software have components provided under the terms of this license:
 
 - OSGi resource locator (from )
 - Project Lombok (from https://projectlombok.org)
-- SnakeYAML (from http://www.snakeyaml.org)
 - jakarta.annotation-api (from https://projects.eclipse.org/projects/ee4j.ca)
 - javax.ws.rs-api (from http://jax-rs-spec.java.net)
 

pom.xml

@@ -54,6 +54,16 @@
                 <groupId>org.opengroup.osdu</groupId>
                 <artifactId>os-core-common</artifactId>
                 <version>${osdu.oscorecommon.version}</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>io.netty</groupId>
+                        <artifactId>netty-codec</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>com.fasterxml.jackson.core</groupId>
+                        <artifactId>jackson-databind</artifactId>
+                    </exclusion>
+                </exclusions>
             </dependency>
         </dependencies>
     </dependencyManagement>
@@ -65,6 +75,11 @@
             <version>1.18.12</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>1.26</version>
+        </dependency>
     </dependencies>
 
     <build>

provider/register-azure/pom.xml

@@ -54,6 +54,16 @@
             <groupId>org.opengroup.osdu</groupId>
             <artifactId>core-lib-azure</artifactId>
             <version>${osdu.corelibazure.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>com.fasterxml.woodstox</groupId>
+                    <artifactId>woodstox-core</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.simpleframework</groupId>
+                    <artifactId>simple-xml</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.opengroup.osdu</groupId>

register-core/pom.xml

@@ -44,6 +44,10 @@
                     <groupId>org.springframework.boot</groupId>
                     <artifactId>spring-boot-starter-tomcat</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.yaml</groupId>
+                    <artifactId>snakeyaml</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
@@ -99,6 +103,10 @@
                     <groupId>com.google.guava</groupId>
                     <artifactId>guava</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.yaml</groupId>
+                    <artifactId>snakeyaml</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -110,7 +118,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-joda</artifactId>
-            <version>2.9.9</version>
+            <version>2.11.3</version>
         </dependency>
         <dependency>
             <groupId>joda-time</groupId>