Backport PR #15125 to 8.9: update commons-io commons-compress jrjackson databind

build.gradle

@@ -19,7 +19,7 @@
 
 buildscript {
     ext {
-        snakeYamlVersion = '1.33'
+        snakeYamlVersion = '2.0'
         shadowGradlePluginVersion = '7.0.0'
     }
 

logstash-core/benchmarks/build.gradle

@@ -58,7 +58,7 @@ dependencies {
   implementation "org.openjdk.jmh:jmh-core:$jmh"
   annotationProcessor "org.openjdk.jmh:jmh-generator-annprocess:$jmh"
   implementation 'com.google.guava:guava:24.1.1-jre'
-  implementation 'commons-io:commons-io:2.5'
+  implementation 'commons-io:commons-io:2.13.0'
   runtimeOnly 'joda-time:joda-time:2.8.2'
   api "org.jruby:jruby-core:$jrubyVersion"
 }

logstash-core/build.gradle

@@ -181,8 +181,6 @@ dependencies {
     implementation 'org.codehaus.janino:janino:3.1.0'
     implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:${jacksonVersion}"
     implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${jacksonVersion}"
-    // pin version of jackson-dataformat-yaml's transitive dependency "snakeyaml"
-    implementation "org.yaml:snakeyaml:1.33"
     implementation group: 'com.google.guava', name: 'guava', version: '31.1-jre'
     implementation('com.google.googlejavaformat:google-java-format:1.15.0') {
         exclude group: 'com.google.guava', module: 'guava'

tools/benchmark-cli/build.gradle

@@ -50,11 +50,11 @@ ext {
 dependencies {
   implementation 'net.sf.jopt-simple:jopt-simple:5.0.3'
   implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.12'
-  implementation group: 'org.apache.commons', name: 'commons-compress', version: '1.20'
+  implementation group: 'org.apache.commons', name: 'commons-compress', version: '1.23.0'
   implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.10'
   implementation group: 'commons-codec', name: 'commons-codec', version: '1.14'
 
-  implementation group: 'commons-io', name: 'commons-io', version: '2.7'
+  implementation group: 'commons-io', name: 'commons-io', version: '2.13.0'
   implementation "com.fasterxml.jackson.core:jackson-core:${jacksonVersion}"
   api "com.fasterxml.jackson.core:jackson-databind:${jacksonDatabindVersion}"
   implementation group: 'org.elasticsearch.client', name: 'elasticsearch-rest-client', version: elasticsearch

tools/dependencies-report/build.gradle

@@ -42,7 +42,7 @@ buildscript {
 }
 
 dependencies {
-  implementation 'commons-io:commons-io:2.6'
+  implementation 'commons-io:commons-io:2.13.0'
   implementation 'org.apache.commons:commons-csv:1.5'
   implementation "com.fasterxml.jackson.core:jackson-core:${jacksonVersion}"
   implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}"

tools/ingest-converter/build.gradle

@@ -45,7 +45,7 @@ dependencies {
   implementation 'net.sf.jopt-simple:jopt-simple:4.6'
   implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonDatabindVersion}"
   testImplementation "junit:junit:4.12"
-  testImplementation 'commons-io:commons-io:2.5'
+  testImplementation 'commons-io:commons-io:2.13.0'
 }
 
 javadoc {

versions.yml

@@ -24,6 +24,6 @@ jruby:
 # Note: this file is copied to the root of logstash-core because its gemspec needs it when
 #       bundler evaluates the gemspec via bin/logstash
 # Ensure Jackson version here is kept in sync with version used by jrjackson gem
-jrjackson: 0.4.17
-jackson: 2.14.1
-jackson-databind: 2.14.1
+jrjackson: 0.4.18
+jackson: 2.15.2
+jackson-databind: 2.15.2