Rel 7 0 CVE (#5663)

* Bump json-path

* Pin parrson

* Bump elastic

* Bump spring version

* Exclude JDBC

hapi-fhir-converter/pom.xml

@@ -23,6 +23,13 @@
  <groupId>ca.uhn.hapi.fhir</groupId>
  <artifactId>org.hl7.fhir.convertors</artifactId>
  <version>${fhir_core_version}</version>
+ <exclusions>
+ <!-- Exclude JDBC since it appears entirely unused, and has a CVE -->
+ <exclusion>
+ <groupId>org.xerial</groupId>
+ <artifactId>sqlite-jdbc</artifactId>
+ </exclusion>
+ </exclusions>
  </dependency>
 
  <!-- Server -->

pom.xml

@@ -976,7 +976,7 @@
  <swagger_version>2.2.19</swagger_version>
  <slf4j_version>2.0.9</slf4j_version>
  <log4j_to_slf4j_version>2.19.0</log4j_to_slf4j_version>
- <spring_version>6.1.1</spring_version>
+ <spring_version>6.1.3</spring_version>
  <spring_data_bom_version>2023.1.0</spring_data_bom_version>
  <spring_batch_version>4.3.3</spring_batch_version>
  <spring_boot_version>3.2.0</spring_boot_version>
@@ -989,7 +989,7 @@
  <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
  <ebay_cors_filter_version>1.0.1</ebay_cors_filter_version>
  <elastic_apm_version>1.44.0</elastic_apm_version>
- <elasticsearch_version>8.11.1</elasticsearch_version>
+ <elasticsearch_version>8.12.0</elasticsearch_version>
  <ucum_version>1.0.8</ucum_version>
 
  <!-- CQL Support -->
@@ -1082,7 +1082,7 @@
  <dependency>
  <groupId>com.jayway.jsonpath</groupId>
  <artifactId>json-path</artifactId>
- <version>2.8.0</version>
+ <version>2.9.0</version>
  </dependency>
  <dependency>
  <groupId>com.jayway.jsonpath</groupId>
@@ -1358,6 +1358,11 @@
  <artifactId>elasticsearch-java</artifactId>
  <version>${elasticsearch_version}</version>
  </dependency>
+ <dependency>
+ <groupId>org.eclipse.parsson</groupId>
+ <artifactId>parsson</artifactId>
+ <version>1.0.5</version>
+ </dependency>
  <dependency>
  <groupId>com.google.code.gson</groupId>
  <artifactId>gson</artifactId>