JCRVLT-863 Bump minimum required JR2 version to 2.20.18

README.md

@@ -33,7 +33,7 @@ Java 11 or higher
 Runtime Dependencies
 --------------------
 
-- Jackrabbit 2.20.17+ (JCR Commons, SPI, SPI Commons)
+- Jackrabbit 2.20.18+ (JCR Commons, SPI, SPI Commons)
 - Oak Jackrabbit API 1.22.4+
 - Commons IO 2.18.0+
 - Commons Collections 4.5.0+

parent/pom.xml

@@ -93,7 +93,7 @@ Apache Jackrabbit FileVault is a project of the Apache Software Foundation.</des
     <!-- CI-friendly version, https://maven.apache.org/maven-ci-friendly.html -->
     <revision>4.3.0-SNAPSHOT</revision>
     <!-- for dependencies used for calculating OSGi import-package version ranges the minimally supported version should be used to be backwards compatible in OSGi containers -->
-    <jackrabbit.min.version>2.20.17</jackrabbit.min.version>
+    <jackrabbit.min.version>2.20.18</jackrabbit.min.version>
     <!-- for embedded dependencies the newest version should be used (also used for testing) -->
     <jackrabbit.max.version>2.22.5</jackrabbit.max.version>
     <!-- for dependencies used for calculating OSGi import-package version ranges the minimally supported version should be used to be backwards compatible in OSGi containers -->
@@ -518,7 +518,7 @@ Bundle-Category: jackrabbit
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>12.2.2</version>
+          <version>13.0.0</version>
           <executions>
             <execution>
               <goals>

suppressions.xml

@@ -29,55 +29,13 @@
        <packageUrl regex="true">^pkg:maven/org\.apache\.sling/org\.apache\.sling\.jcr\.api@.*$</packageUrl>
        <cve>CVE-2015-2944</cve>
     </suppress>
-    <suppress>
-       <notes><![CDATA[
-       file name: h2-2.1.212.jar, only 1.4.197 is affected, see https://github.com/jeremylong/DependencyCheck/issues/4555
-       ]]></notes>
-       <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
-       <vulnerabilityName>CVE-2018-14335</vulnerabilityName>
-    </suppress>
-    <suppress>
-       <notes><![CDATA[
-       false positive for Oak classes e.g. for CVE-2021-40690
-       ]]></notes>
-       <packageUrl regex="true">^pkg:maven/org\.apache\.jackrabbit/oak-.*@.*$</packageUrl>
-       <cpe>cpe:/a:apache:xml_security_for_java</cpe>
-    </suppress>
     <suppress>
        <notes><![CDATA[
        false positive: org.apache.sling.jcr.api-2.0.4.jar only Sling API and Sling Commons Logging affected
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.sling/org\.apache\.sling\.jcr\.api@.*$</packageUrl>
        <cve>CVE-2022-32549</cve>
     </suppress>
-    <suppress>
-       <notes><![CDATA[
-       file name: h2-2.1.212.jar, usage in FileVault not affected, see https://github.com/h2database/h2database/issues/3686
-       ]]></notes>
-       <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
-       <cve>CVE-2022-45868</cve>
-    </suppress>
-    <suppress>
-       <notes><![CDATA[
-       file name: diffutils-1.2.1.jar, wrong match for pattern cpe:2.3:a:utils_project:utils:1.2.1:*:*:*:*:*:*:*
-       ]]></notes>
-       <packageUrl regex="true">^pkg:maven/com\.googlecode\.java\-diff\-utils/diffutils@.*$</packageUrl>
-       <cve>CVE-2021-4277</cve>
-    </suppress>
-    <suppress>
-       <notes><![CDATA[
-       file name: org.apache.felix.utils-1.11.8.jar, wrong match for pattern cpe:2.3:a:utils_project:utils:1.2.1:*:*:*:*:*:*:*
-       ]]></notes>
-       <packageUrl regex="true">^pkg:maven/org\.apache\.felix/org\.apache\.felix\.utils@.*$</packageUrl>
-       <cve>CVE-2021-4277</cve>
-    </suppress>
-    <suppress>
-       <notes><![CDATA[
-       file name: plexus-utils-3.3.0.jar, wrong match for pattern cpe:2.3:a:utils_project:utils:1.2.1:*:*:*:*:*:*:*
-       ]]></notes>
-       <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
-       <cve>CVE-2021-4277</cve>
-    </suppress>
     <suppress>
        <notes><![CDATA[
        file name: jackrabbit-jcr-commons-2.20.17.jar with JNDI usage, not used in FileVault