[NCL-9918] Fix CVEs

[patrikk0123]

No description provided.

[github-actions]

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output

Identified 106 dependencies

Detected 2 vulnerabilities (0 Critical, 0 High, 1 Medium, 1 Low)

+----------+----------------+---------------+-------------------------------------------------------------------------------------------------+
| SEVERITY |    LIBRARY     |      ID       |                                             TOP FIX                                             |
+----------+----------------+---------------+-------------------------------------------------------------------------------------------------+
| MEDIUM   | guava-21.0.jar | CVE-2023-2976 | Upgrade to version com.google.guava:guava:32.0.1-android,32.0.1-jre                             |
+----------+----------------+---------------+-------------------------------------------------------------------------------------------------+
| LOW      | guava-21.0.jar | CVE-2020-8908 | Upgrade to version com.google.guava:guava:32.0.0-android, https://github.com/google/guava.git - |
|          |                |               | v32.0.0                                                                                         |
+----------+----------------+---------------+-------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

galley-caches-1.23-SNAPSHOT.pom
|-- galley-cache-path-mapped-1.23-SNAPSHOT.jar
	|-- path-mapped-pathdb-datastax-3.3-SNAPSHOT.jar
		|-- guava-21.0.jar [1 MEDIUM, 1 LOW]
		|-- cassandra-driver-core-3.12.1.jar
			|-- guava-21.0.jar [1 MEDIUM, 1 LOW]
		|-- cassandra-driver-mapping-3.12.1.jar
			|-- guava-21.0.jar [1 MEDIUM, 1 LOW]
	|-- path-mapped-storage-3.3-SNAPSHOT.jar
		|-- guava-21.0.jar [1 MEDIUM, 1 LOW]
		|-- s3-2.21.20.jar
			|-- aws-core-2.21.20.jar
				|-- guava-21.0.jar [1 MEDIUM, 1 LOW]
			|-- sdk-core-2.21.20.jar
				|-- guava-21.0.jar [1 MEDIUM, 1 LOW]


No Policy violations were detected

Project 'galley' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=b669806f-110d-4010-ba08-c7a27f9371e0
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=d4f29335af524e7286ca3b1fdfd6774223cccd682b424dfd861c54be55307f9a

Mend AI scan succeeded.

Support Token: 053ef01996b544154bdec6dd117020ea81789124928586

SAST scan output

*no findings*

Full logs and artifacts

[rnc]

Quite surprising but having looked into this change it seems @jdcasey removed the galley infinispan cache in 2019 (SHA a871f3c) so it seems that infinispan can be removed. Nice find!