[4.2.0][Dependency Upgrade] Analyze Trivy scan reports

[msm1992]

Description

This issue is created to track progress on trivy scan report analysis on APIM, MI and SI 4.2.0.

scan reports : #1220 (comment)

Affected Component

None

Version

No response

Related Issues

No response

Suggested Labels

No response

[msm1992]

• Following components in APIM 4.2.0 were identifies as need to be upgraded.

component	group id	current version	version to be upgraded to	severity
protobuf-java	com.google.protobuf	3.19.3	3.21.7	High
commons-httpclient	commons-httpclient.wso2	3.1.0.wso2v6		Medium
json-path	net.minidev	2.4		Critical
jsoup	org.jsoup	1.14.3	1.15.3	Medium
pax-logging-log4j2	org.ops4j.pax.logging	1.10.1	1.11.10	Critical
spring		5.3.19	6.0.0/5.3.20	Critical
callhome		4.5.x_1.0.13	4.5.x_1.0.15

• In MI 4.2.0 only jsoup(1.14.3 -> 1.15.3) was identified as need to be upgraded. be upgraded.

• In MI Dashboard 4.2.0 no new CVEs were found

• In MI 4.2.0 only guava was identified as need to be upgraded. be upgraded.