Upgrade json-smart version to 2.5.2 in response to CVE-2024-57699

[ShahimSharafudeen]

Description

Upgrade the json-smart dependency to version 2.5.2 to address CVE-2024-57699. The json-smart dependency is a transitive dependency of com.jayway.jsonpath:json-path:2.9.0, which uses an older version that contains this vulnerability. Therefore, upgrading the json-smart dependency to 2.5.2 resolves the issue. 'json-smart' 2.5.2 uses the latest version of org.ow2.asm:asm 9.7.1, therefore avoiding future conflicts by upgrading the asm version to 9.7.1.

Motivation and Context

Impact

Test Plan

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes

* Upgrade json-smart version to 2.5.2 in response to `CVE-2024-57699 <https://nvd.nist.gov/vuln/detail/CVE-2024-57699>`_. 

[nishithakbhaskaran]

Thanks for the fix!

[ZacBlanco]

I don't think that this PR is necessary. I could not find a usage of json-smart with version other than 2.5.0 in the dependency tree when running ./mvnw dependency:tree. This PR doesn't effectively do anything other than pinning the version to 2.5.0 - which all of our modules already use. We should avoid pinning a transitive dependency unless it is pulling up a version for a specific module.

[ShahimSharafudeen]

I don't think that this PR is necessary. I could not find a usage of json-smart with version other than 2.5.0 in the dependency tree when running ./mvnw dependency:tree. This PR doesn't effectively do anything other than pinning the version to 2.5.0 - which all of our modules already use. We should avoid pinning a transitive dependency unless it is pulling up a version for a specific module.

@ZacBlanco – The json-smart:2.5.0 is a transitive dependency of com.jayway.jsonpath:json-path:2.9.0, and json-path:2.9.0 is the latest release version in the Maven repository, which contains this(CVE-2024-57699) vulnerability. json-smart:2.5.2 addresses this high-severity vulnerability.

[ZacBlanco]

Sorry when I was reviewing earlier I must have had the wrong branch checked out. I looked again and see that 2.5.2 replaces 2.5.0 everywhere. This should be good

[ShahimSharafudeen]

@ZacBlanco - 'json-smart' 2.5.2 uses the latest version of org.ow2.asm:asm 9.7.1, therefore avoiding future conflicts by upgrading the asm dependency version to 9.7.1.

[ShahimSharafudeen]

@yingsu00 / @jaystarshot Can you please have a look whenever you get a chance? Thanks.