Bumping OkHttp to 4.11, Jackson to 2.14.3

And a few other patch upgrades. Also set version to 6.2-SNAPSHOT in preparation for a 6.2.1 release.

Author: rjrudin

examples/build.gradle

@@ -19,13 +19,16 @@ dependencies {
 	api 'io.github.rburgst:okhttp-digest:2.7'
 	api 'org.slf4j:slf4j-api:1.7.36'
 	api 'com.fasterxml.jackson.core:jackson-databind:2.14.1'
+
+	// hsqldb 2.6+ requires Java 11+
 	api 'org.hsqldb:hsqldb:2.5.2'
+
 	api 'org.jdom:jdom2:2.0.6.1'
-	api 'dom4j:dom4j:1.6.1'
+	api 'org.dom4j:dom4j:2.1.3'
 	api 'com.google.code.gson:gson:2.10'
 	api 'net.sourceforge.htmlcleaner:htmlcleaner:2.26'
 	api 'com.opencsv:opencsv:4.6'
-	api 'org.springframework:spring-jdbc:5.3.24'
+	api 'org.springframework:spring-jdbc:5.3.27'
 	api 'org.apache.commons:commons-lang3:3.12.0'
 	api 'org.apache.httpcomponents:httpclient:4.5.14'
 }

gradle.properties

@@ -1,5 +1,5 @@
 group=com.marklogic
-version=6.3-SNAPSHOT
+version=6.2-SNAPSHOT
 describedName=MarkLogic Java Client API
 publishUrl=file:../marklogic-java/releases
 

marklogic-client-api/build.gradle

@@ -12,40 +12,44 @@ description = "The official MarkLogic Java client API."
 dependencies {
 	if (JavaVersion.current().isJava9Compatible()) {
 		implementation 'javax.xml.bind:jaxb-api:2.3.1'
-		implementation 'org.glassfish.jaxb:jaxb-runtime:2.3.2'
+		implementation 'org.glassfish.jaxb:jaxb-runtime:2.3.8'
 		implementation 'org.glassfish.jaxb:jaxb-core:2.3.0.1'
 	}
-	implementation 'com.squareup.okhttp3:okhttp:4.10.0'
-	implementation 'com.squareup.okhttp3:logging-interceptor:4.10.0'
+	implementation 'com.squareup.okhttp3:okhttp:4.11.0'
+	implementation 'com.squareup.okhttp3:logging-interceptor:4.11.0'
 	implementation 'io.github.rburgst:okhttp-digest:2.7'
 	implementation 'com.sun.mail:javax.mail:1.6.2'
 	implementation 'javax.ws.rs:javax.ws.rs-api:2.1.1'
 	implementation 'org.slf4j:slf4j-api:1.7.36'
-	implementation 'com.fasterxml.jackson.core:jackson-core:2.14.1'
-	implementation 'com.fasterxml.jackson.core:jackson-annotations:2.14.1'
-	implementation 'com.fasterxml.jackson.core:jackson-databind:2.14.1'
-	implementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.14.1'
+	implementation 'com.fasterxml.jackson.core:jackson-core:2.14.3'
+	implementation 'com.fasterxml.jackson.core:jackson-annotations:2.14.3'
+	implementation 'com.fasterxml.jackson.core:jackson-databind:2.14.3'
+	implementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.14.3'
 
 	// Only used by extras (which some examples then depend on)
+	// Forcing codec version to avoid vulnerability with older version in httpclient
+	compileOnly 'commons-codec:commons-codec:1.15'
 	compileOnly 'org.apache.httpcomponents:httpclient:4.5.14'
 	compileOnly 'org.jdom:jdom2:2.0.6.1'
-	compileOnly 'dom4j:dom4j:1.6.1'
+	compileOnly 'org.dom4j:dom4j:2.1.3'
 	compileOnly 'com.google.code.gson:gson:2.10'
 
-	testImplementation 'org.junit.jupiter:junit-jupiter:5.9.1'
-	testImplementation 'org.xmlunit:xmlunit-legacy:2.9.0'
+	testImplementation 'org.junit.jupiter:junit-jupiter:5.9.3'
+	// Forcing junit version to avoid vulnerability with older version in xmlunit
+	testImplementation 'junit:junit:4.13.1'
+	testImplementation 'org.xmlunit:xmlunit-legacy:2.9.1'
 	testImplementation project(':examples')
 
 	// Allows talking to the Manage API. It depends on the Java Client itself, which will usually be a slightly older
 	// version, but that should not have any impact on the tests.
-	testImplementation "com.marklogic:ml-app-deployer:4.5.1"
+	testImplementation "com.marklogic:ml-app-deployer:4.5.2"
 
 	// Starting with mockito 5.x, Java 11 is required, so sticking with 4.x as we have to support Java 8.
 	testImplementation "org.mockito:mockito-core:4.11.0"
 	testImplementation "org.mockito:mockito-inline:4.11.0"
-	testImplementation "com.squareup.okhttp3:mockwebserver:4.10.0"
+	testImplementation "com.squareup.okhttp3:mockwebserver:4.11.0"
 
-	testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.14.1'
+	testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.14.3'
 	testImplementation 'ch.qos.logback:logback-classic:1.3.5'
 // schema validation issue with testImplementation 'xerces:xercesImpl:2.12.0'
 	testImplementation 'org.opengis.cite.xerces:xercesImpl-xsd11:2.12-beta-r1667115'

pom.xml

@@ -11,7 +11,7 @@ It is not intended to be used to build this project.
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.marklogic</groupId>
   <artifactId>marklogic-client-api</artifactId>
-  <version>6.1-SNAPSHOT</version>
+  <version>6.2-SNAPSHOT</version>
   <dependencies>
     <dependency>
       <groupId>javax.xml.bind</groupId>
@@ -22,7 +22,7 @@ It is not intended to be used to build this project.
     <dependency>
       <groupId>org.glassfish.jaxb</groupId>
       <artifactId>jaxb-runtime</artifactId>
-      <version>2.3.2</version>
+      <version>2.3.8</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
@@ -34,13 +34,13 @@ It is not intended to be used to build this project.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>okhttp</artifactId>
-      <version>4.10.0</version>
+      <version>4.11.0</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>logging-interceptor</artifactId>
-      <version>4.10.0</version>
+      <version>4.11.0</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
@@ -70,25 +70,25 @@ It is not intended to be used to build this project.
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.14.1</version>
+      <version>2.14.3</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-annotations</artifactId>
-      <version>2.14.1</version>
+      <version>2.14.3</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.14.1</version>
+      <version>2.14.3</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.dataformat</groupId>
       <artifactId>jackson-dataformat-csv</artifactId>
-      <version>2.14.1</version>
+      <version>2.14.3</version>
       <scope>runtime</scope>
     </dependency>
   </dependencies>