Merge 1.5.4 changes back to master.

doc/licenses/apache-commons-1.16.0/NOTICE

@@ -0,0 +1,5 @@
+Apache Commons Codec
+Copyright 2002-2023 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (https://www.apache.org/).

doc/licenses/apache-commons-1.16.0/README

@@ -1,7 +1,7 @@
 Apache Commons Codec (http://commons.apache.org/proper/commons-codec/)
 -----------------------------------------------------------------------
 
-    Version: 1.15
+    Version: 1.16.0
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-commons-1.16.0/dep-coordinates.txt

@@ -0,0 +1 @@
+commons-codec:commons-codec:jar:1.16.0

doc/licenses/apache-commons-codec-1.15/NOTICE

@@ -1,17 +0,0 @@
-Apache Commons Codec
-Copyright 2002-2020 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (https://www.apache.org/).
-
-src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java
-contains test data from http://aspell.net/test/orig/batch0.tab.
-Copyright (C) 2002 Kevin Atkinson (kevina@gnu.org)
-
-===============================================================================
-
-The content of package org.apache.commons.codec.language.bm has been translated
-from the original php source code available at http://stevemorse.org/phoneticinfo.htm
-with permission from the original authors.
-Original source copyright:
-Copyright (c) 2008 Alexander Beider & Stephen P. Morse.

doc/licenses/apache-commons-codec-1.15/dep-coordinates.txt

@@ -1 +0,0 @@
-commons-codec:commons-codec:jar:1.15

doc/licenses/apache-commons-lang-3.12.0/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.commons:commons-lang3:jar:3.12.0

doc/licenses/apache-commons-lang-3.14.0/NOTICE

@@ -1,5 +1,5 @@
 Apache Commons Lang
-Copyright 2001-2021 The Apache Software Foundation
+Copyright 2001-2023 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (https://www.apache.org/).

doc/licenses/apache-commons-lang-3.14.0/README

@@ -1,7 +1,7 @@
 Apache Commons Lang (http://commons.apache.org/proper/commons-lang/)
 --------------------------------------------------------------------
 
-    Version: 3.12.0
+    Version: 3.14.0
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-commons-lang-3.14.0/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.commons:commons-lang3:jar:3.14.0

doc/licenses/apache-commons-pool-2.11.1/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.commons:commons-pool2:jar:2.11.1

doc/licenses/apache-commons-pool-2.12.0/NOTICE

@@ -1,5 +1,5 @@
 Apache Commons Pool
-Copyright 2001-2021 The Apache Software Foundation
+Copyright 2001-2023 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (https://www.apache.org/).

doc/licenses/apache-commons-pool-2.12.0/README

@@ -1,7 +1,7 @@
 Apache Commons Pool (http://commons.apache.org/proper/commons-pool/)
 --------------------------------------------------------------------
 
-    Version: 2.11.1
+    Version: 2.12.0
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-commons-pool-2.12.0/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.commons:commons-pool2:jar:2.12.0

doc/licenses/apache-mina-2.2.2/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.mina:mina-core:jar:2.2.2

doc/licenses/apache-mina-2.2.3/README

@@ -1,7 +1,7 @@
 Apache Mina (https://mina.apache.org/)
 --------------------------------------
 
-    Version: 2.2.2
+    Version: 2.2.3
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-mina-2.2.3/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.mina:mina-core:jar:2.2.3

doc/licenses/apache-santuario-2.2.3/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.santuario:xmlsec:jar:2.2.3

doc/licenses/apache-santuario-2.2.6/NOTICE

@@ -1,5 +1,5 @@
 Apache Santuario - XML Security for Java
-Copyright 1999-2021 The Apache Software Foundation
+Copyright 1999-2022 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
@@ -10,3 +10,5 @@ Data Communications Systems, <http://www.nue.et-inf.uni-siegen.de/>.
 The development of this software was partly funded by the European 
 Commission in the <WebSig> project in the ISIS Programme. 
 
+This product contains software that is
+copyright (c) 2021, Oracle and/or its affiliates.

doc/licenses/apache-santuario-2.2.6/README

@@ -1,7 +1,7 @@
 Apache Santuario (https://santuario.apache.org/)
 -------------------------------------------------
 
-    Version: 2.2.3
+    Version: 2.2.6
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-santuario-2.2.6/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.santuario:xmlsec:jar:2.2.6

doc/licenses/checker-qual-3.33.0/dep-coordinates.txt

@@ -1 +0,0 @@
-org.checkerframework:checker-qual:jar:3.33.0

doc/licenses/checker-qual-3.37.0/README

@@ -1,8 +1,8 @@
 Checker Framework qualifiers (https://checkerframework.org/)
 ------------------------------------------------------------
 
-    Version: 3.33.0
+    Version: 3.37.0
     From: 'Checker Framework developers' (https://checkerframework.org/)
     License(s):
-        MIT (bundled/checker-qual-3.33.0/LICENSE.txt)
+        MIT (bundled/checker-qual-3.37.0/LICENSE.txt)
 

doc/licenses/checker-qual-3.37.0/dep-coordinates.txt

@@ -0,0 +1 @@
+org.checkerframework:checker-qual:jar:3.37.0

doc/licenses/directory-api-2.1.4/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.directory.api:api-all:jar:2.1.4

doc/licenses/directory-api-2.1.5/README

@@ -1,7 +1,7 @@
 Apache Directory LDAP API (http://directory.apache.org)
 -------------------------------------------------------
 
-    Version: 2.1.4
+    Version: 2.1.5
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/directory-api-2.1.5/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.directory.api:api-all:jar:2.1.5

doc/licenses/error-prone-2.18.0/dep-coordinates.txt

@@ -1 +0,0 @@
-com.google.errorprone:error_prone_annotations:jar:2.18.0

doc/licenses/error-prone-2.21.1/README

@@ -1,7 +1,7 @@
 Error Prone (https://errorprone.info/)
 --------------------------------------
 
-    Version: 2.18.0
+    Version: 2.21.1
     From: 'Google Inc.' (http://www.google.com/)
     License(s):
         Apache v2.0

doc/licenses/error-prone-2.21.1/dep-coordinates.txt

@@ -0,0 +1 @@
+com.google.errorprone:error_prone_annotations:jar:2.21.1

doc/licenses/guava-32.1.3-jre/README

@@ -1,7 +1,7 @@
 Guava: Google Core Libraries for Java (https://github.com/google/guava)
 -----------------------------------------------------------------------
 
-    Version: 32.1.2-jre
+    Version: 32.1.3-jre
     From: 'Google Inc.' (http://www.google.com/)
     License(s):
         Apache v2.0

doc/licenses/guava-32.1.3-jre/dep-coordinates.txt

@@ -1,3 +1,3 @@
 com.google.guava:failureaccess:jar:1.0.1
-com.google.guava:guava:jar:32.1.2-jre
+com.google.guava:guava:jar:32.1.3-jre
 com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava

doc/licenses/jackson-2.16.0/README

@@ -1,7 +1,7 @@
 Jackson (https://github.com/FasterXML/jackson)
 ----------------------------------------------
 
-    Version: 2.15.2
+    Version: 2.16.0
     From: 'FasterXML, LLC' (https://github.com/FasterXML)
     License(s):
         Apache v2.0

doc/licenses/jackson-2.16.0/dep-coordinates.txt

@@ -1,4 +1,4 @@
-com.fasterxml.jackson.core:jackson-core:jar:2.15.2
+com.fasterxml.jackson.core:jackson-core:jar:2.16.0
-com.fasterxml.jackson.core:jackson-annotations:jar:2.15.2
+com.fasterxml.jackson.core:jackson-annotations:jar:2.16.0
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.15.2
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.16.0
-com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.15.2
+com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.16.0

doc/licenses/jackson-databind-2.15.2/dep-coordinates.txt

@@ -1 +0,0 @@
-com.fasterxml.jackson.core:jackson-databind:jar:2.15.2

doc/licenses/jackson-databind-2.16.0/README

@@ -1,7 +1,7 @@
 Jackson-databind (https://github.com/FasterXML/jackson-databind)
 ----------------------------------------------
 
-    Version: 2.15.2
+    Version: 2.16.0
     From: 'FasterXML, LLC' (https://github.com/FasterXML)
     License(s):
         Apache v2.0

doc/licenses/jackson-databind-2.16.0/dep-coordinates.txt

@@ -0,0 +1 @@
+com.fasterxml.jackson.core:jackson-databind:jar:2.16.0

doc/licenses/jersey-2.40/dep-coordinates.txt

@@ -1,7 +0,0 @@
-org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.40
-org.glassfish.jersey.core:jersey-common:jar:2.40
-org.glassfish.jersey.core:jersey-server:jar:2.40
-org.glassfish.jersey.core:jersey-client:jar:2.40
-org.glassfish.jersey.inject:jersey-hk2:jar:2.40
-org.glassfish.jersey.media:jersey-media-json-jackson:jar:2.40
-org.glassfish.jersey.ext:jersey-entity-filtering:jar:2.40

doc/licenses/jersey-2.41/README

@@ -1,8 +1,8 @@
 Jersey (https://jersey.java.net/)
 ---------------------------------
 
-    Version: 2.40
+    Version: 2.41
     From: 'Eclipse Foundation' (https://www.eclipse.org/)
     License(s):
-        EPL v2.0 (bundled/jersey-2.40/LICENSE.md)
+        EPL v2.0 (bundled/jersey-2.41/LICENSE.md)
 

doc/licenses/jersey-2.41/dep-coordinates.txt

@@ -0,0 +1,7 @@
+org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.41
+org.glassfish.jersey.core:jersey-common:jar:2.41
+org.glassfish.jersey.core:jersey-server:jar:2.41
+org.glassfish.jersey.core:jersey-client:jar:2.41
+org.glassfish.jersey.inject:jersey-hk2:jar:2.41
+org.glassfish.jersey.media:jersey-media-json-jackson:jar:2.41
+org.glassfish.jersey.ext:jersey-entity-filtering:jar:2.41

doc/licenses/kotlin-1.9.10/dep-coordinates.txt

@@ -1,5 +0,0 @@
-org.jetbrains.kotlin:kotlin-reflect:jar:1.9.10
-org.jetbrains.kotlin:kotlin-stdlib:jar:1.9.10
-org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.10
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:jar:1.9.10
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:jar:1.9.10

doc/licenses/kotlin-1.9.21/README

@@ -1,7 +1,7 @@
 Kotlin (https://kotlinlang.org/)
 --------------------------------
 
-    Version: 1.9.10
+    Version: 1.9.21
     From: 'JetBrains s.r.o and respective authors and developers'
     License(s):
         Apache v2.0

doc/licenses/kotlin-1.9.21/dep-coordinates.txt

@@ -0,0 +1,5 @@
+org.jetbrains.kotlin:kotlin-reflect:jar:1.9.21
+org.jetbrains.kotlin:kotlin-stdlib:jar:1.9.21
+org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.21
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:jar:1.9.21
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:jar:1.9.21

doc/licenses/logback-1.3.11/dep-coordinates.txt

@@ -1,2 +0,0 @@
-ch.qos.logback:logback-classic:jar:1.3.11
-ch.qos.logback:logback-core:jar:1.3.11

doc/licenses/logback-1.3.14/README

@@ -1,8 +1,8 @@
 Logback (http://logback.qos.ch/)
 --------------------------------
 
-    Version: 1.3.11
+    Version: 1.3.14
     From: 'QOS.ch Sàrl' (http://qos.ch/)
     License(s):
-        EPL v1.0 (bundled/logback-1.3.11/LICENSE.txt)
+        EPL v1.0 (bundled/logback-1.3.14/LICENSE.txt)
 

doc/licenses/logback-1.3.14/dep-coordinates.txt

@@ -0,0 +1,2 @@
+ch.qos.logback:logback-classic:jar:1.3.14
+ch.qos.logback:logback-core:jar:1.3.14

doc/licenses/mybatis-3.5.13/dep-coordinates.txt

@@ -1 +0,0 @@
-org.mybatis:mybatis:jar:3.5.13

doc/licenses/mybatis-3.5.14/README

@@ -1,7 +1,7 @@
 MyBatis (http://www.mybatis.org/mybatis-3/)
 -------------------------------------------
 
-    Version: 3.5.13
+    Version: 3.5.14
     From: 'MyBatis' (http://www.mybatis.org/)
     License(s):
         Apache v2.0

doc/licenses/mybatis-3.5.14/dep-coordinates.txt

@@ -0,0 +1 @@
+org.mybatis:mybatis:jar:3.5.14

doc/licenses/snakeyaml-2.0/dep-coordinates.txt

@@ -1 +0,0 @@
-org.yaml:snakeyaml:jar:2.0

doc/licenses/snakeyaml-2.2/README

@@ -1,7 +1,7 @@
 SnakeYAML (https://bitbucket.org/snakeyaml/snakeyaml/
 -----------------------------------------------------
 
-    Version: 2.0
+    Version: 2.2
     From: 'Andrey Somov' (https://bitbucket.org/asomov/)
     License(s):
         Apache v2.0

doc/licenses/snakeyaml-2.2/dep-coordinates.txt

@@ -0,0 +1 @@
+org.yaml:snakeyaml:jar:2.2

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml

@@ -57,7 +57,7 @@
         <dependency>
             <groupId>org.mybatis</groupId>
             <artifactId>mybatis</artifactId>
-            <version>3.5.13</version>
+            <version>3.5.14</version>
         </dependency>
         
         <!-- MyBatis Guice -->

extensions/guacamole-auth-ldap/pom.xml

@@ -51,8 +51,19 @@
         <dependency>
             <groupId>org.apache.directory.api</groupId>
             <artifactId>api-all</artifactId>
-            <version>2.1.4</version>
+            <version>2.1.5</version>
             <exclusions>
+
+                <!--
+                    Replace slightly older commons-lang3 (3.13.0) with latest
+                    compatible version (3.14.0) so that we don't need two copies
+                    of the same license information.
+                -->
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-lang3</artifactId>
+                </exclusion>
+
             </exclusions>
         </dependency>
 
@@ -72,6 +83,13 @@
             <artifactId>jackson-dataformat-yaml</artifactId>
         </dependency>
 
+        <!-- Apache Commons Lang (see exclusions for api-all) -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.14.0</version>
+        </dependency>
+
     </dependencies>
 
 </project>

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/pom.xml

@@ -65,6 +65,17 @@
                     <groupId>org.glassfish.jaxb</groupId>
                     <artifactId>jaxb-core</artifactId>
                 </exclusion>
+                
+                <!--
+                    Replace slightly older commons-codec (1.15) with newer
+                    and identical version to that used by Apache Directory API
+                    for LDAP (1.16.0) so that we don't need two copies of the
+                    same license information.
+                -->
+                <exclusion>
+                    <groupId>commons-codec</groupId>
+                    <artifactId>commons-codec</artifactId>
+                </exclusion>
 
             </exclusions>
         </dependency>
@@ -118,6 +129,13 @@
             <version>2.3.1</version>
         </dependency>
 
+        <!-- Apache Commons Codec (see exclusions for cas-client-core) -->
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+            <version>1.16.0</version>
+        </dependency>
+
     </dependencies>
 
 </project>

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml

@@ -74,25 +74,92 @@
             <groupId>com.onelogin</groupId>
             <artifactId>java-saml</artifactId>
             <version>2.9.0</version>
-            <!--
-                Replace vulnerable version of Woodstox until upstream
-                releases a version with fixed dependencies
-            -->
             <exclusions>
+
+                <!--
+                    Replace vulnerable version of Woodstox until upstream
+                    releases a version with fixed dependencies
+                -->
                 <exclusion>
                     <groupId>com.fasterxml.woodstox</groupId>
                     <artifactId>woodstox-core</artifactId>
                 </exclusion>
+
+                <!--
+                    Replace vulnerable version of xmlsec until upstream
+                    releases a version with fixed dependencies
+                -->
+                <exclusion>
+                    <groupId>org.apache.santuario</groupId>
+                    <artifactId>xmlsec</artifactId>
+                </exclusion>
+
+                <!--
+                    Replace slightly older commons-lang3 (3.12.0) with latest
+                    compatible version (3.14.0) so that we don't need two copies
+                    of the same license information.
+                -->
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-lang3</artifactId>
+                </exclusion>
+
+                <!--
+                    Replace slightly older commons-codec (1.15) with newer
+                    and identical version to that used by Apache Directory API
+                    for LDAP (1.16.0) so that we don't need two copies of the
+                    same license information.
+                -->
+                <exclusion>
+                    <groupId>commons-codec</groupId>
+                    <artifactId>commons-codec</artifactId>
+                </exclusion>
+
             </exclusions>
         </dependency>
 
-        <!-- Woodstox -->
+        <!-- Woodstox (see exclusions for java-saml) -->
         <dependency>
             <groupId>com.fasterxml.woodstox</groupId>
             <artifactId>woodstox-core</artifactId>
             <version>5.4.0</version>
         </dependency>
 
+        <!-- Apache XML Security for Java (see exclusions for java-saml) -->
+        <dependency>
+            <groupId>org.apache.santuario</groupId>
+            <artifactId>xmlsec</artifactId>
+            <version>2.2.6</version>
+            <exclusions>
+
+                <!--
+                    Replace slightly older commons-codec (1.15) with newer
+                    and identical version to that used by Apache Directory API
+                    for LDAP (1.16.0) so that we don't need two copies of the
+                    same license information.
+                -->
+                <exclusion>
+                    <groupId>commons-codec</groupId>
+                    <artifactId>commons-codec</artifactId>
+                </exclusion>
+
+            </exclusions>
+        </dependency>
+
+        <!-- Apache Commons Lang (see exclusions for java-saml) -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.14.0</version>
+        </dependency>
+
+        <!-- Apache Commons Codec (see exclusions for java-saml and xmlsec) -->
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+            <version>1.16.0</version>
+        </dependency>
+
     </dependencies>
 
 </project>

extensions/guacamole-vault/modules/guacamole-vault-ksm/pom.xml

@@ -38,7 +38,7 @@
     </parent>
 
     <properties>
-        <kotlin.version>1.9.10</kotlin.version>
+        <kotlin.version>1.9.21</kotlin.version>
     </properties>
 
     <dependencies>

pom.xml

@@ -36,15 +36,15 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <!-- Dependency versions -->
-        <guava.version>32.1.2-jre</guava.version>
+        <guava.version>32.1.3-jre</guava.version>
         <guice.version>5.1.0</guice.version>
         <hk2.version>2.6.1</hk2.version>
-        <jackson.version>2.15.2</jackson.version>
+        <jackson.version>2.16.0</jackson.version>
-        <jackson-databind.version>2.15.2</jackson-databind.version>
+        <jackson-databind.version>2.16.0</jackson-databind.version>
-        <jersey.version>2.40</jersey.version>
+        <jersey.version>2.41</jersey.version>
-        <junit.version>5.10.0</junit.version>
+        <junit.version>5.10.1</junit.version>
         <junit4.version>4.13.2</junit4.version>
-        <logback.version>1.3.11</logback.version>
+        <logback.version>1.3.14</logback.version>
         <slf4j.version>2.0.9</slf4j.version>
 
         <!-- The directory that should receive all generated dependency lists