[T2.20] Other minor deps (171 CVEs across ~50 GAVs)

[natechadwick-intsof]

Summary

Catch-all bucket for GAVs that do not fit any other T2.x sub-task (commons-net, dom4j, jdom, jaxen, json, jsoup, gson, guava, httpclient, netty, jackson-dataformat-*, BouncyCastle JDK15to18 pin, Shiro 1.13.0 pin, jackrabbit-jcr-commons <2.21 pin, etc.). All CVEs are pinned at the latest Java 1.8 line; residual CVEs close when the Java 11+ migration epic lands. Per-GAV mitigations documented in docs/SECURITY-MITIGATIONS.md T2.20 entry.

Mitigation matrix

See docs/SECURITY-MITIGATIONS.md T2.20 entry for the per-GAV mitigation table.

OWASP suppressions

Per-GAV suppressions are in owasp-suppressions.xml with notes describing the per-GAV disposition.

Closing evidence

• docs/SECURITY-MITIGATIONS.md T2.20 entry
• owasp-suppressions.xml

References

• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73

[natechadwick-intsof]

Closing this sub-task

Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on main:

• Merged PR(s) referenced in the sub-task body
• docs/SECURITY-MITIGATIONS.md has the per-GAV mitigation table for this sub-task
• owasp-suppressions.xml has per-GAV <suppress> entries with <notes> describing the mitigation, pointing back at this issue and the merged PR(s)

No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.