update dependencies starting with jakarta.el

[macfarla]

Signed-off-by: Sally MacFarlane macfarla.github@gmail.com

Addresses CVE-2021-28170

• update jakarta-el version

Addresses CVE-2022-38752

• update snakeyaml to 1.33
• adds suppression for snakeyaml 1.33 since the NIST page says https://nvd.nist.gov/vuln/detail/CVE-2022-38752 "excluding snakeyaml 1.32"

Updates jackson-databind to 2.14.0-rc1 to address CVE-2022-42003

• 2.14.0 hasn't been released yet https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind

Documentation

• I thought about documentation and added the doc-change-required label to this PR if updates are required.

Changelog

• I thought about adding a changelog entry, and added one if I deemed necessary.

[macfarla]

https://stackoverflow.com/questions/58557741/gradle-plugin-uses-a-older-different-version-of-a-java-library-used-in-the-code

[macfarla]

this is a new (unrelated) CVE since yesterday

One or more dependencies were identified with known vulnerabilities in tessera-dist:

snakeyaml-1.31.jar (pkg:maven/org.yaml/snakeyaml@1.31, cpe:2.3:a:snakeyaml_project:snakeyaml:1.31:*:*:*:*:*:*:*, cpe:2.3:a:yaml_project:yaml:1.31:*:*:*:*:*:*:*) : CVE-2022-38752

[macfarla]

this required #1487 to be resolved for security advisories build step to pass

[macfarla]

Still with snakeyaml 1.33

One or more dependencies were identified with known vulnerabilities in tessera-dist:

snakeyaml-1.33.jar (pkg:maven/org.yaml/snakeyaml@1.33, cpe:2.3:a:snakeyaml_project:snakeyaml:1.33:::::::, cpe:2.3:a:yaml_project:yaml:1.33:::::::) : CVE-2022-38752

[macfarla]

I added a suppression for the snakeyaml 1.33 CVE since the NIST page says https://nvd.nist.gov/vuln/detail/CVE-2022-38752 excluding snakeyaml 1.32

[mark-terry]

Are the rc versions explicitly required?

[macfarla]

2.14.0 hasn't been released yet https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind

[mark-terry]

LGTM.