Update Mend: high confidence minor and patch dependency updates

distribution/tools/ansi-console/build.gradle

@@ -18,7 +18,7 @@ dependencies {
   testImplementation project(":test:framework")
 
   // multi-platform (Windows too) terminal detection and output formatting
-  api "org.fusesource.jansi:jansi:2.4.0"
+  api "org.fusesource.jansi:jansi:2.4.2"
 }
 
 // the code and tests in this project cover console initialization

distribution/tools/geoip-cli/build.gradle

@@ -18,6 +18,6 @@ dependencies {
   compileOnly project(":libs:elasticsearch-cli")
   compileOnly project(":libs:elasticsearch-x-content")
   testImplementation project(":test:framework")
-  testImplementation "org.apache.commons:commons-compress:1.26.1"
-  testImplementation "commons-io:commons-io:2.15.1"
+  testImplementation "org.apache.commons:commons-compress:1.28.0"
+  testImplementation "commons-io:commons-io:2.20.0"
 }

distribution/tools/plugin-cli/build.gradle

@@ -25,8 +25,8 @@ dependencies {
   implementation project(":libs:elasticsearch-plugin-api")
   implementation project(":libs:elasticsearch-plugin-scanner")
   // TODO: asm is picked up from the plugin scanner, we should consolidate so it is not defined twice
-  implementation 'org.ow2.asm:asm:9.7'
-  implementation 'org.ow2.asm:asm-tree:9.7'
+  implementation 'org.ow2.asm:asm:9.9'
+  implementation 'org.ow2.asm:asm-tree:9.9'
 
   api "org.bouncycastle:bcpg-fips:1.0.7.1"
   api "org.bouncycastle:bc-fips:1.0.2.4"

gradle/build.versions.toml

@@ -1,49 +1,49 @@
 [versions]
-asm = "9.6"
-jackson = "2.15.0"
+asm = "9.9"
+jackson = "2.20.0"
 junit5 = "5.8.1"
 spock = "2.1-groovy-3.0"
 
 [libraries]
-ant = "org.apache.ant:ant:1.10.12"
+ant = "org.apache.ant:ant:1.10.15"
 antlrst4 = "org.antlr:ST4:4.3.4"
-apache-compress = "org.apache.commons:commons-compress:1.26.1"
+apache-compress = "org.apache.commons:commons-compress:1.28.0"
 apache-rat = "org.apache.rat:apache-rat:0.11"
 asm = { group = "org.ow2.asm", name="asm", version.ref="asm" }
 asm-tree = { group = "org.ow2.asm", name="asm-tree", version.ref="asm" }
-bytebuddy = "net.bytebuddy:byte-buddy:1.14.12"
-checkstyle = "com.puppycrawl.tools:checkstyle:10.3"
-commons-codec = "commons-codec:commons-codec:1.11"
-commmons-io = "commons-io:commons-io:2.2"
+bytebuddy = "net.bytebuddy:byte-buddy:1.17.8"
+checkstyle = "com.puppycrawl.tools:checkstyle:10.26.1"
+commons-codec = "commons-codec:commons-codec:1.19.0"
+commmons-io = "commons-io:commons-io:2.20.0"
 docker-compose = "com.avast.gradle:gradle-docker-compose-plugin:0.17.5"
 forbiddenApis = "de.thetaphi:forbiddenapis:3.6"
 gradle-enterprise = "com.gradle:develocity-gradle-plugin:3.17.4"
 hamcrest = "org.hamcrest:hamcrest:2.1"
-httpcore = "org.apache.httpcomponents:httpcore:4.4.12"
+httpcore = "org.apache.httpcomponents:httpcore:4.4.16"
 httpclient = "org.apache.httpcomponents:httpclient:4.5.14"
-idea-ext = "gradle.plugin.org.jetbrains.gradle.plugin.idea-ext:gradle-idea-ext:1.1.4"
-javaparser = "com.github.javaparser:javaparser-core:3.18.0"
-json-schema-validator = "com.networknt:json-schema-validator:1.0.72"
-json-assert = "org.skyscreamer:jsonassert:1.5.0"
+idea-ext = "gradle.plugin.org.jetbrains.gradle.plugin.idea-ext:gradle-idea-ext:1.3"
+javaparser = "com.github.javaparser:javaparser-core:3.27.1"
+json-schema-validator = "com.networknt:json-schema-validator:1.5.9"
+json-assert = "org.skyscreamer:jsonassert:1.5.3"
 jackson-core = { group = "com.fasterxml.jackson.core", name="jackson-core", version.ref="jackson" }
 jackson-databind = { group = "com.fasterxml.jackson.core", name="jackson-databind", version.ref="jackson" }
 jackson-dataformat-yaml = { group = "com.fasterxml.jackson.dataformat", name="jackson-dataformat-yaml", version.ref="jackson" }
 jackson-platform = { group = "com.fasterxml.jackson", name="jackson-bom", version.ref="jackson" }
-jna = "net.java.dev.jna:jna:5.10.0"
+jna = "net.java.dev.jna:jna:5.18.1"
 junit = "junit:junit:4.13.2"
 junit5-platform = { group = "org.junit", name="junit-bom", version.ref="junit5" }
 junit5-jupiter = { group = "org.junit.jupiter", name="junit-jupiter", version.ref="junit5" }
 junit5-platform-launcher = "org.junit.platform:junit-platform-launcher:1.8.1"
 junit5-vintage = { group = "org.junit.vintage", name="junit-vintage-engine", version.ref="junit5" }
-maven-model = "org.apache.maven:maven-model:3.6.2"
+maven-model = "org.apache.maven:maven-model:3.9.11"
 mockito-core = "org.mockito:mockito-core:1.9.5"
 nebula-info = "com.netflix.nebula:gradle-info-plugin:11.3.3"
-reflections = "org.reflections:reflections:0.9.12"
+reflections = "org.reflections:reflections:0.10.2"
 shadow-plugin = "com.github.breskeby:shadow:3b035f2"
-snakeyaml = { group = "org.yaml", name = "snakeyaml", version = { strictly = "2.0" } }
+snakeyaml = { group = "org.yaml", name = "snakeyaml", version = { strictly = "2.5" } }
 spock-core = { group = "org.spockframework", name="spock-core", version.ref="spock" }
 spock-junit4 = { group = "org.spockframework", name="spock-junit4", version.ref="spock" }
 spock-platform = { group = "org.spockframework", name="spock-bom", version.ref="spock" }
 spotless-plugin = "com.diffplug.spotless:spotless-plugin-gradle:6.25.0"
-wiremock = "com.github.tomakehurst:wiremock-jre8-standalone:2.23.2"
-xmlunit-core = "org.xmlunit:xmlunit-core:2.8.2"
+wiremock = "com.github.tomakehurst:wiremock-jre8-standalone:2.35.2"
+xmlunit-core = "org.xmlunit:xmlunit-core:2.10.4"

gradle/verification-metadata.xml

@@ -799,6 +799,11 @@
             <sha256 value="e2b3f8a191b0b401b75c2c4542d3d1719814a4212e6920fae4f2f940678bfd99" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.gradle" name="develocity-gradle-plugin" version="3.19.2">
+         <artifact name="develocity-gradle-plugin-3.19.2.jar">
+            <sha256 value="fc611e8858a901619831ea1d9efd289db7fea28a0ca3d091abdd363365d9512b" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.h2database" name="h2" version="1.4.197">
          <artifact name="h2-1.4.197.jar">
             <sha256 value="37f5216e14af2772930dff9b8734353f0a80e89ba3f33e065441de6537c5e842" origin="Generated by Gradle"/>
@@ -1241,6 +1246,11 @@
             <sha256 value="675f60bd11a82d481736591fe4054c66471fa5463d45616652fd71585792ba87" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="commons-io" name="commons-io" version="2.20.0">
+         <artifact name="commons-io-2.20.0.jar">
+            <sha256 value="df90bba0fe3cb586b7f164e78fe8f8f4da3f2dd5c27fa645f888100ccc25dd72" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="commons-io" name="commons-io" version="2.4">
          <artifact name="commons-io-2.4.jar">
             <sha256 value="cc6a41dc3eaacc9e440a6bd0d2890b20d36b4ee408fe2d67122f328bb6e01581" origin="Generated by Gradle"/>
@@ -1966,6 +1976,11 @@
             <sha256 value="27bb5d40f37c3bb7205b4a0540247df057715e9f6cbbd97d626ab8b50318bb04" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.apache.commons" name="commons-compress" version="1.28.0">
+         <artifact name="commons-compress-1.28.0.jar">
+            <sha256 value="e1522945218456f3649a39bc4afd70ce4bd466221519dba7d378f2141a4642ca" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.apache.commons" name="commons-compress" version="1.4.1">
          <artifact name="commons-compress-1.4.1.jar">
             <sha256 value="28a00d80716f073d644b9da76e94b5e8ff94de8e9323f06f558fba653fcf5f86" origin="Generated by Gradle"/>
@@ -3612,6 +3627,11 @@
             <sha256 value="6cd91991323dd7b2fb28ca93d7ac12af5a86a2f53279e2b35827b30313fd0b9f" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.fusesource.jansi" name="jansi" version="2.4.2">
+         <artifact name="jansi-2.4.2.jar">
+            <sha256 value="0b7b8b003a90ea491579b62f5118828e45112914c65589b00faa49d6ec785839" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.fusesource.leveldbjni" name="leveldbjni-all" version="1.8">
          <artifact name="leveldbjni-all-1.8.jar">
             <sha256 value="c297213b0e6f9392305952753f3099a4c02e70b3656266fe01867e7b6c160ffe" origin="Generated by Gradle"/>
@@ -4122,6 +4142,11 @@
             <sha256 value="adf46d5e34940bdf148ecdd26a9ee8eea94496a72034ff7141066b3eea5c4e9d" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.ow2.asm" name="asm" version="9.9">
+         <artifact name="asm-9.9.jar">
+            <sha256 value="03d99a74ad1ee5c71334ef67437f4ef4fe3488caa7c96d8645abc73c8e2017d4" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.ow2.asm" name="asm-analysis" version="7.2">
          <artifact name="asm-analysis-7.2.jar">
             <sha256 value="be922aae60ff1ff1768e8e6544a38a7f92bd0a6d6b0b9791f94955d1bd453de2" origin="Generated by Gradle"/>
@@ -4207,6 +4232,11 @@
             <sha256 value="62f4b3bc436045c1acb5c3ba2d8ec556ec3369093d7f5d06c747eb04b56d52b1" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.ow2.asm" name="asm-tree" version="9.9">
+         <artifact name="asm-tree-9.9.jar">
+            <sha256 value="42178f3775c9c63f9e5e1446747d29b4eca4d91bd6e75e5c43cfa372a47d38c6" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.ow2.asm" name="asm-util" version="7.2">
          <artifact name="asm-util-7.2.jar">
             <sha256 value="6e24913b021ffacfe8e7e053d6e0ccc731941148cfa078d4f1ed3d96904530f8" origin="Generated by Gradle"/>

libs/plugin-scanner/build.gradle

@@ -20,8 +20,8 @@ dependencies {
   api project(':libs:elasticsearch-plugin-api')
   api project(":libs:elasticsearch-x-content")
 
-  api 'org.ow2.asm:asm:9.7'
-  api 'org.ow2.asm:asm-tree:9.7'
+  api 'org.ow2.asm:asm:9.9'
+  api 'org.ow2.asm:asm-tree:9.9'
 
   testImplementation "junit:junit:${versions.junit}"
   testImplementation(project(":test:framework")) {

libs/x-content/impl/build.gradle

@@ -13,7 +13,7 @@ base {
   archivesName = "x-content-impl"
 }
 
-String jacksonVersion = "2.17.2"
+String jacksonVersion = "2.20.0"
 
 dependencies {
   compileOnly project(':libs:elasticsearch-core')

modules/apm/build.gradle

@@ -12,7 +12,7 @@ esplugin {
   classname 'org.elasticsearch.telemetry.apm.APM'
 }
 
-def otelVersion = '1.31.0'
+def otelVersion = '1.55.0'
 def otelSemconvVersion = '1.21.0-alpha'
 
 dependencies {

modules/ingest-attachment/build.gradle

@@ -21,24 +21,24 @@ esplugin {
 // when updating tika, please review it's parent pom : https://repo1.maven.org/maven2/org/apache/tika/tika-parent
 // and manually update the transitive dependencies here
 def versions = [
-  'tika'  : '2.9.2',
-  'pdfbox': '2.0.31',
-  'poi'   : '5.2.5',
+  'tika'  : '2.9.4',
+  'pdfbox': '2.0.35',
+  'poi'   : '5.4.1',
   'sparsebitset' : '1.3', //poi dependency: https://repo1.maven.org/maven2/org/apache/poi/poi/
   'mime4j': '0.8.11',
-  'commonsCodec': '1.16.1',
-  'slf4' : '2.0.10',
+  'commonsCodec': '1.19.0',
+  'slf4' : '2.0.17',
   'xz' : '1.9',
-  'commonsIo' : '2.15.1',
+  'commonsIo' : '2.20.0',
   //intentionally using the elder "juniversalchardet:juniversalchardet" rather than the newer "com.github.albfernandez:juniversalchardet"
   //since the "com.github.albfernandez" fork has some problems with Chinese.
   'juniversalchardet' : '1.0.3',
   'tagsoup' : '1.2.1',
   'jempbox' : '1.8.17',
   'xmlbeans' : '5.2.0', //poi-ooxml dependency: https://repo1.maven.org/maven2/org/apache/poi/poi-ooxml/
-  'commonsCollections4' : '4.4',
-  'commonsCompress' : '1.26.1',
-  'commonsLang3' :'3.14.0',
+  'commonsCollections4' : '4.5.0',
+  'commonsCompress' : '1.28.0',
+  'commonsLang3' :'3.19.0',
   'commonsMath3' : '3.6.1'
 ]
 

modules/ingest-geoip/build.gradle

@@ -28,7 +28,7 @@ tasks.named('internalClusterTestTestingConventions').configure {
 }
 
 dependencies {
-  implementation('com.maxmind.geoip2:geoip2:4.2.0')
+  implementation('com.maxmind.geoip2:geoip2:4.4.0')
   // geoip2 dependencies:
   runtimeOnly("com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}")
   runtimeOnly("com.fasterxml.jackson.core:jackson-databind:${versions.jackson}")

modules/lang-mustache/build.gradle

@@ -17,7 +17,7 @@ esplugin {
 }
 
 dependencies {
-  api "com.github.spullara.mustache.java:compiler:0.9.10"
+  api "com.github.spullara.mustache.java:compiler:0.9.14"
 }
 
 restResources {

modules/lang-painless/build.gradle

@@ -77,16 +77,16 @@ sourceSets {
 dependencies {
     docImplementation project(':server')
     docImplementation project(':modules:lang-painless')
-    docImplementation 'com.github.javaparser:javaparser-core:3.18.0'
-    docImplementation 'org.jsoup:jsoup:1.13.1'
+    docImplementation 'com.github.javaparser:javaparser-core:3.27.1'
+    docImplementation 'org.jsoup:jsoup:1.21.2'
     if (isEclipse) {
         /*
          * Eclipse isn't quite "with it" enough to understand the different
          * source sets. This adds the dependency to all source sets so it
          * can compile the doc java files.
          */
-        implementation 'com.github.javaparser:javaparser-core:3.18.0'
-        implementation 'org.jsoup:jsoup:1.13.1'
+        implementation 'com.github.javaparser:javaparser-core:3.27.1'
+        implementation 'org.jsoup:jsoup:1.21.2'
     }
 }
 

modules/repository-azure/build.gradle

@@ -27,14 +27,14 @@ dependencies {
   // Microsoft
   api "com.azure:azure-core-http-netty:1.15.3"
   api "com.azure:azure-core:1.51.0"
-  api "com.azure:azure-identity:1.13.2"
+  api "com.azure:azure-identity:1.18.1"
   api "com.azure:azure-json:1.2.0"
   api "com.azure:azure-storage-blob:12.27.1"
   api "com.azure:azure-storage-common:12.26.1"
   api "com.azure:azure-storage-internal-avro:12.12.1"
   api "com.azure:azure-xml:1.1.0"
   api "com.microsoft.azure:msal4j-persistence-extension:1.3.0"
-  api "com.microsoft.azure:msal4j:1.16.2"
+  api "com.microsoft.azure:msal4j:1.23.1"
 
   // Jackson
   api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
@@ -62,20 +62,20 @@ dependencies {
   api "com.github.stephenc.jcip:jcip-annotations:1.0-1"
   api "com.nimbusds:content-type:2.3"
   api "com.nimbusds:lang-tag:1.7"
-  api "com.nimbusds:nimbus-jose-jwt:9.37.3"
-  api "com.nimbusds:oauth2-oidc-sdk:11.9.1"
+  api "com.nimbusds:nimbus-jose-jwt:9.48"
+  api "com.nimbusds:oauth2-oidc-sdk:11.30"
   api "jakarta.activation:jakarta.activation-api:1.2.1"
   api "jakarta.xml.bind:jakarta.xml.bind-api:2.3.3"
   api "net.java.dev.jna:jna-platform:${versions.jna}" // Maven says 5.14.0 but this aligns with the Elasticsearch-wide version
   api "net.java.dev.jna:jna:${versions.jna}" // Maven says 5.14.0 but this aligns with the Elasticsearch-wide version
-  api "net.minidev:accessors-smart:2.5.0"
-  api "net.minidev:json-smart:2.5.0"
+  api "net.minidev:accessors-smart:2.6.0"
+  api "net.minidev:json-smart:2.6.0"
   api "org.codehaus.woodstox:stax2-api:4.2.2"
-  api "org.ow2.asm:asm:9.3"
+  api "org.ow2.asm:asm:9.9"
 
   runtimeOnly "com.google.crypto.tink:tink:1.14.0"
   runtimeOnly "com.google.protobuf:protobuf-java:4.27.0"
-  runtimeOnly "com.google.code.gson:gson:2.11.0"
+  runtimeOnly "com.google.code.gson:gson:2.13.2"
   runtimeOnly "org.cryptomator:siv-mode:1.5.2"
 
   implementation project(":modules:transport-netty4")

modules/repository-gcs/build.gradle

@@ -26,30 +26,30 @@ dependencies {
   api 'com.google.cloud:google-cloud-storage:2.13.1'
   api 'com.google.cloud:google-cloud-core:2.8.28'
   api 'com.google.cloud:google-cloud-core-http:2.8.28'
-  runtimeOnly 'com.google.guava:guava:32.0.1-jre'
+  runtimeOnly 'com.google.guava:guava:32.1.3-jre'
   runtimeOnly 'com.google.guava:failureaccess:1.0.1'
   api "commons-logging:commons-logging:${versions.commonslogging}"
   api "org.apache.logging.log4j:log4j-1.2-api:${versions.log4j}"
   api "commons-codec:commons-codec:${versions.commonscodec}"
   api 'com.google.api:api-common:2.3.1'
   api 'com.google.api:gax:2.20.1'
-  api 'org.threeten:threetenbp:1.6.5'
+  api 'org.threeten:threetenbp:1.7.2'
   api "com.google.protobuf:protobuf-java-util:${versions.protobuf}"
   api "com.google.protobuf:protobuf-java:${versions.protobuf}"
-  api 'com.google.code.gson:gson:2.10'
+  api 'com.google.code.gson:gson:2.13.2'
   api 'com.google.api.grpc:proto-google-common-protos:2.9.6'
   api 'com.google.api.grpc:proto-google-iam-v1:1.6.2'
   api 'com.google.auth:google-auth-library-credentials:1.11.0'
   api 'com.google.auth:google-auth-library-oauth2-http:1.11.0'
   api "com.google.oauth-client:google-oauth-client:${versions.google_oauth_client}"
   api 'com.google.api-client:google-api-client:2.1.1'
   api 'com.google.http-client:google-http-client:1.42.3'
-  api 'com.google.http-client:google-http-client-gson:1.42.3'
+  api 'com.google.http-client:google-http-client-gson:1.47.1'
   api 'com.google.http-client:google-http-client-appengine:1.42.3'
-  api 'com.google.http-client:google-http-client-jackson2:1.42.3'
+  api 'com.google.http-client:google-http-client-jackson2:1.47.1'
   api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
   api 'com.google.api:gax-httpjson:0.105.1'
-  api 'io.grpc:grpc-context:1.49.2'
+  api 'io.grpc:grpc-context:1.76.0'
   api 'io.opencensus:opencensus-api:0.31.1'
   api 'io.opencensus:opencensus-contrib-http-util:0.31.1'
   api 'com.google.apis:google-api-services-storage:v1-rev20220705-2.0.0'

modules/repository-s3/build.gradle

@@ -36,11 +36,11 @@ dependencies {
   api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson}"
   api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
   api "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:${versions.jackson}"
-  api "joda-time:joda-time:2.10.14"
+  api "joda-time:joda-time:2.14.0"
 
   // HACK: javax.xml.bind was removed from default modules in java 9, so we pull the api in here,
   // and whitelist this hack in JarHell
-  api 'javax.xml.bind:jaxb-api:2.2.2'
+  api 'javax.xml.bind:jaxb-api:2.3.1'
 
   testImplementation project(':test:fixtures:s3-fixture')
   yamlRestTestImplementation project(":test:framework")

plugins/discovery-azure-classic/build.gradle

@@ -31,17 +31,17 @@ dependencies {
   api "org.apache.logging.log4j:log4j-1.2-api:${localVersions.log4j}"
   api "commons-codec:commons-codec:${localVersions.commonscodec}"
   api "commons-lang:commons-lang:2.6"
-  api 'javax.mail:mail:1.4.5'
+  api 'javax.mail:mail:1.4.7'
   api 'javax.inject:javax.inject:1'
   api "com.sun.jersey:jersey-client:${localVersions.jersey}"
   api "com.sun.jersey:jersey-core:${localVersions.jersey}"
-  api 'com.sun.xml.bind:jaxb-impl:2.2.3-1'
+  api 'com.sun.xml.bind:jaxb-impl:2.3.9'
 
   // HACK: javax.xml.bind was removed from default modules in java 9, so we pull the api in here,
   // and whitelist this hack in JarHell
-  api 'javax.xml.bind:jaxb-api:2.2.2'
+  api 'javax.xml.bind:jaxb-api:2.3.1'
 
-  runtimeOnly "joda-time:joda-time:2.10.10"
+  runtimeOnly "joda-time:joda-time:2.14.0"
 }
 
 restResources {

plugins/discovery-ec2/build.gradle

@@ -32,7 +32,7 @@ dependencies {
   api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson}"
   api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
   api "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:${versions.jackson}"
-  api "joda-time:joda-time:2.10.10"
+  api "joda-time:joda-time:2.14.0"
 }
 
 restResources {