Merge patch branch changes to main.

doc/licenses/apache-mina-2.2.3/dep-coordinates.txt

@@ -1 +0,0 @@
-org.apache.mina:mina-core:jar:2.2.3

doc/licenses/apache-mina-2.2.4/README

@@ -1,7 +1,7 @@
 Apache Mina (https://mina.apache.org/)
 --------------------------------------
 
-    Version: 2.2.3
+    Version: 2.2.4
     From: 'Apache Software Foundation' (https://www.apache.org/)
     License(s):
         Apache v2.0

doc/licenses/apache-mina-2.2.4/dep-coordinates.txt

@@ -0,0 +1 @@
+org.apache.mina:mina-core:jar:2.2.4

doc/licenses/bouncycastle-1.79/dep-coordinates.txt

@@ -1,3 +0,0 @@
-org.bouncycastle:bcpkix-jdk15to18:jar:1.79
-org.bouncycastle:bcprov-jdk15to18:jar:1.79
-org.bouncycastle:bcutil-jdk15to18:jar:1.79

doc/licenses/bouncycastle-1.80/README

@@ -1,7 +1,7 @@
 BouncyCastle Crypto (https://www.bouncycastle.org/java.html)
 ------------------------------------------------------------
 
-    Version: 1.79
+    Version: 1.80
     From: 'The Legion of Bouncy Castle' (https://www.bouncycastle.org)
     License(s):
-        MIT (bundled/bouncycastle-1.79/LICENSE)
+        MIT (bundled/bouncycastle-1.80/LICENSE)

doc/licenses/bouncycastle-1.80/dep-coordinates.txt

@@ -0,0 +1,3 @@
+org.bouncycastle:bcpkix-jdk15to18:jar:1.80
+org.bouncycastle:bcprov-jdk15to18:jar:1.80
+org.bouncycastle:bcutil-jdk15to18:jar:1.80

doc/licenses/bouncycastle-2.0.0/dep-coordinates.txt

@@ -1 +0,0 @@
-org.bouncycastle:bc-fips:jar:2.0.0

doc/licenses/bouncycastle-2.0.3/dep-coordinates.txt

@@ -1 +0,0 @@
-org.bouncycastle:bcutil-fips:jar:2.0.3

doc/licenses/bouncycastle-fips-2.1.0/README

@@ -1,7 +1,7 @@
 BouncyCastle FIPS Distribution (https://www.bouncycastle.org/fips-java)
 -----------------------------------------------------------------------
 
-    Version: 2.0.0
+    Version: 2.1.0
     From: 'The Legion of Bouncy Castle' (https://www.bouncycastle.org)
     License(s):
-        MIT (bundled/bouncycastle-fips-2.0.0/LICENSE)
+        MIT (bundled/bouncycastle-fips-2.1.0/LICENSE)

doc/licenses/bouncycastle-fips-2.1.0/dep-coordinates.txt

@@ -0,0 +1 @@
+org.bouncycastle:bc-fips:jar:2.1.0

doc/licenses/bouncycastle-pkix-fips-2.0.7/dep-coordinates.txt

@@ -1 +0,0 @@
-org.bouncycastle:bcpkix-fips:jar:2.0.7

doc/licenses/bouncycastle-pkix-fips-2.1.9/README

@@ -1,7 +1,7 @@
 BouncyCastle PKIX APIs, FIPS Distribution (https://www.bouncycastle.org/fips-java)
 -----------------------------------------------------------------------
 
-    Version: 2.0.7
+    Version: 2.1.9
     From: 'The Legion of Bouncy Castle' (https://www.bouncycastle.org)
     License(s):
-        MIT (bundled/bouncycastle-pkix-fips-2.0.7/LICENSE)
+        MIT (bundled/bouncycastle-pkix-fips-2.1.9/LICENSE)

doc/licenses/bouncycastle-pkix-fips-2.1.9/dep-coordinates.txt

@@ -0,0 +1 @@
+org.bouncycastle:bcpkix-fips:jar:2.1.9

doc/licenses/bouncycastle-util-fips-2.1.4/README

@@ -1,7 +1,7 @@
 Bouncy Castle ASN.1 Extension and Utility APIs (https://www.bouncycastle.org/fips-java)
 -----------------------------------------------------------------------
 
-    Version: 2.0.3
+    Version: 2.1.4
     From: 'The Legion of Bouncy Castle' (https://www.bouncycastle.org)
     License(s):
-        MIT (bundled/bouncycastle-fips-2.0.3/LICENSE)
+        MIT (bundled/bouncycastle-fips-2.1.4/LICENSE)

doc/licenses/bouncycastle-util-fips-2.1.4/dep-coordinates.txt

@@ -0,0 +1 @@
+org.bouncycastle:bcutil-fips:jar:2.1.4

doc/licenses/jackson-2.18.3/dep-coordinates.txt

@@ -1,4 +1,4 @@
-com.fasterxml.jackson.core:jackson-core:jar:2.18.2
+com.fasterxml.jackson.core:jackson-core:jar:2.18.3
-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.2
+com.fasterxml.jackson.core:jackson-annotations:jar:2.18.3
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.18.2
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.18.3
-com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.18.2
+com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.18.3

doc/licenses/jackson-databind-2.18.2/dep-coordinates.txt

@@ -1 +0,0 @@
-com.fasterxml.jackson.core:jackson-databind:jar:2.18.2

doc/licenses/jackson-databind-2.18.3/README

@@ -1,7 +1,7 @@
 Jackson-databind (https://github.com/FasterXML/jackson-databind)
 ----------------------------------------------
 
-    Version: 2.18.2
+    Version: 2.18.3
     From: 'FasterXML, LLC' (https://github.com/FasterXML)
     License(s):
         Apache v2.0

doc/licenses/jackson-databind-2.18.3/dep-coordinates.txt

@@ -0,0 +1 @@
+com.fasterxml.jackson.core:jackson-databind:jar:2.18.3

doc/licenses/ksm-sdk-16.6.6/dep-coordinates.txt

@@ -1 +0,0 @@
-com.keepersecurity.secrets-manager:core:jar:16.6.6

doc/licenses/ksm-sdk-17.0.0/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Keeper Security
+Copyright (c) 2021 Keeper Security
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

doc/licenses/ksm-sdk-17.0.0/README

@@ -2,8 +2,8 @@ Keeper Secrets Manager Java SDK
 (https://github.com/Keeper-Security/secrets-manager)
 ----------------------------------------------------
 
-    Version: 16.6.6
+    Version: 17.0.0
     From: 'Keeper Security' (https://www.keepersecurity.com/)
     License(s):
-        MIT (bundled/ksm-sdk-16.6.6/LICENSE)
+        MIT (bundled/ksm-sdk-17.0.0/LICENSE)
 

doc/licenses/ksm-sdk-17.0.0/dep-coordinates.txt

@@ -0,0 +1 @@
+com.keepersecurity.secrets-manager:core:jar:17.0.0

doc/licenses/logback-1.3.14/dep-coordinates.txt

@@ -1,2 +0,0 @@
-ch.qos.logback:logback-classic:jar:1.3.14
-ch.qos.logback:logback-core:jar:1.3.14

doc/licenses/logback-1.3.15/README

@@ -1,8 +1,8 @@
 Logback (http://logback.qos.ch/)
 --------------------------------
 
-    Version: 1.3.14
+    Version: 1.3.15
     From: 'QOS.ch Sàrl' (http://qos.ch/)
     License(s):
-        EPL v1.0 (bundled/logback-1.3.14/LICENSE.txt)
+        EPL v1.0 (bundled/logback-1.3.15/LICENSE.txt)
 

doc/licenses/logback-1.3.15/dep-coordinates.txt

@@ -0,0 +1,2 @@
+ch.qos.logback:logback-classic:jar:1.3.15
+ch.qos.logback:logback-core:jar:1.3.15

doc/licenses/mybatis-3.5.17/dep-coordinates.txt

@@ -1 +0,0 @@
-org.mybatis:mybatis:jar:3.5.17

doc/licenses/mybatis-3.5.19/README

@@ -1,7 +1,7 @@
 MyBatis (http://www.mybatis.org/mybatis-3/)
 -------------------------------------------
 
-    Version: 3.5.17
+    Version: 3.5.19
     From: 'MyBatis' (http://www.mybatis.org/)
     License(s):
         Apache v2.0

doc/licenses/mybatis-3.5.19/dep-coordinates.txt

@@ -0,0 +1 @@
+org.mybatis:mybatis:jar:3.5.19

doc/licenses/slf4j-api-2.0.16/dep-coordinates.txt

@@ -1,2 +0,0 @@
-org.slf4j:jul-to-slf4j:jar:2.0.16
-org.slf4j:slf4j-api:jar:2.0.16

doc/licenses/slf4j-api-2.0.17/README

@@ -1,8 +1,8 @@
 Simple Logging Facade for Java (http://slf4j.org/)
 --------------------------------------------------
 
-    Version: 2.0.16
+    Version: 2.0.17
     From: 'QOS.ch Sàrl' (http://qos.ch/)
     License(s):
-        MIT (bundled/slf4j-api-2.0.16/LICENSE.txt)
+        MIT (bundled/slf4j-api-2.0.17/LICENSE.txt)
 

doc/licenses/slf4j-api-2.0.17/dep-coordinates.txt

@@ -0,0 +1,2 @@
+org.slf4j:jul-to-slf4j:jar:2.0.17
+org.slf4j:slf4j-api:jar:2.0.17

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml

@@ -57,7 +57,7 @@
         <dependency>
             <groupId>org.mybatis</groupId>
             <artifactId>mybatis</artifactId>
-            <version>3.5.17</version>
+            <version>3.5.19</version>
         </dependency>
         
         <!-- MyBatis Guice -->

extensions/guacamole-auth-ldap/pom.xml

@@ -54,6 +54,15 @@
             <version>2.1.7</version>
             <exclusions>
 
+                <!--
+                    Replace vulnerable version of Apache MINA until upstream
+                    releases a version with fixed dependencies.
+                -->
+                <exclusion>
+                    <groupId>org.apache.mina</groupId>
+                    <artifactId>mina-core</artifactId>
+                </exclusion>
+
                 <!--
                     Replace slightly older commons-lang3 (3.15.0) with latest
                     compatible version (3.16.0) so that we don't need two copies
@@ -90,6 +99,13 @@
             <version>3.17.0</version>
         </dependency>
 
+        <!-- Apache MINA (see exclusions for api-all) -->
+        <dependency>
+            <groupId>org.apache.mina</groupId>
+            <artifactId>mina-core</artifactId>
+            <version>2.2.4</version>
+        </dependency>
+
     </dependencies>
 
 </project>

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/pom.xml

@@ -79,7 +79,7 @@
 
                 <!--
                     Replace older BouncyCastle (1.70) with newer, compatible
-                    version (1.79), which has since been renamed from
+                    version (1.80), which has since been renamed from
                     "bcpkix-jdk15on" to "bcpkix-jdk15to18".
                 -->
                 <exclusion>
@@ -96,7 +96,7 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcpkix-jdk15to18</artifactId>
-            <version>1.79</version>
+            <version>1.80</version>
         </dependency>
 
         <!-- Guava - Utility Library -->

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml

@@ -123,17 +123,32 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcpkix-fips</artifactId>
-            <version>2.0.7</version>
+            <version>2.1.9</version>
 
-            <!-- Force usage of known version of bc-fips, rather than a future
-            unknown version (bcpkix-fips references bc-fips using a version
-            range, resulting in newer versions getting pulled in automatically,
-            breaking the automated license check) -->
             <exclusions>
+
+                <!--
+                    Force usage of known version of bc-fips, rather than a
+                    future unknown version (bcpkix-fips references bc-fips using
+                    a version range, resulting in newer versions getting pulled
+                    in automatically, breaking the automated license check).
+                -->
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
                     <artifactId>bc-fips</artifactId>
                 </exclusion>
+
+                <!--
+                    Force usage of known version of bcutil-fips, rather than a
+                    future unknown version (bcpkix-fips references bctuil-fips
+                    using a version range, resulting in newer versions getting
+                    pulled in automatically, breaking the automated license
+                    check).
+                -->
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcutil-fips</artifactId>
+                </exclusion>
             </exclusions>
 
         </dependency>
@@ -142,7 +157,14 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bc-fips</artifactId>
-            <version>2.0.0</version>
+            <version>2.1.0</version>
+        </dependency>
+
+        <!-- Force usage of known version of bcutil-fips (see bcpkix-fips above) -->
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcutil-fips</artifactId>
+            <version>2.1.4</version>
         </dependency>
 
     </dependencies>

extensions/guacamole-vault/modules/guacamole-vault-ksm/pom.xml

@@ -60,7 +60,7 @@
         <dependency>
             <groupId>com.keepersecurity.secrets-manager</groupId>
             <artifactId>core</artifactId>
-            <version>16.6.6</version>
+            <version>17.0.0</version>
 
             <!-- Correct version conflict (different versions across transitive
                 dependencies) -->
@@ -106,7 +106,7 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bc-fips</artifactId>
-            <version>2.0.0</version>
+            <version>2.1.0</version>
         </dependency>
 
     </dependencies>

pom.xml

@@ -40,13 +40,13 @@
         <guice.version>5.1.0</guice.version>
         <hk2.version>2.6.1</hk2.version>
         <ipaddress.version>5.5.1</ipaddress.version>
-        <jackson.version>2.18.2</jackson.version>
+        <jackson.version>2.18.3</jackson.version>
-        <jackson-databind.version>2.18.2</jackson-databind.version>
+        <jackson-databind.version>2.18.3</jackson-databind.version>
         <jersey.version>2.46</jersey.version>
-        <junit.version>5.11.4</junit.version>
+        <junit.version>5.12.0</junit.version>
         <junit4.version>4.13.2</junit4.version>
-        <logback.version>1.3.14</logback.version>
+        <logback.version>1.3.15</logback.version>
-        <slf4j.version>2.0.16</slf4j.version>
+        <slf4j.version>2.0.17</slf4j.version>
 
         <!-- The directory that should receive all generated dependency lists
             (for LICENSE generation) -->