Merge remote-tracking branch 'origin/main'

Author: Grahame Grieve

.github/workflows/trivy.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Run static analysis
-        uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 # master
+        uses: aquasecurity/trivy-action@0.34.2 # v0.34.2
         with:
           scan-type: 'fs'
           vuln-type: 'library'

pom.xml

@@ -13,11 +13,11 @@
         <jacksonVersion>2.16.0</jacksonVersion>
         <apacheHttpcomponentsVersion>4.5.13</apacheHttpcomponentsVersion>
         <apacheHttpcomponents5Version>5.0.4</apacheHttpcomponents5Version>
-        <apacheJenaVersion>4.10.0</apacheJenaVersion>
-        <log4jVersion>2.17.1</log4jVersion>
+        <apacheJenaVersion>5.6.0</apacheJenaVersion>
+        <log4jVersion>2.25.3</log4jVersion>
         <lombok_version>1.18.38</lombok_version>
         <slf4jVersion>1.7.36</slf4jVersion>
-        <jettyVersion>12.0.12</jettyVersion>
+        <jettyVersion>12.0.29</jettyVersion>
         <logbackVersion>1.5.20</logbackVersion>
         <nettyConstrainedVersion>4.1.118.Final</nettyConstrainedVersion>
         <maven.compiler.release>17</maven.compiler.release>
@@ -99,6 +99,11 @@
                 <artifactId>commons-io</artifactId>
                 <version>2.18.0</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-text</artifactId>
+                <version>1.15.0</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.xmlbeans</groupId>
                 <artifactId>xmlbeans</artifactId>
@@ -129,13 +134,18 @@
                 <artifactId>logback-core</artifactId>
                 <version>${logbackVersion}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>${log4jVersion}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>
         <dependency>
             <groupId>ca.uhn.hapi.fhir</groupId>
             <artifactId>hapi-fhir-base</artifactId>
-            <version>6.4.1</version>
+            <version>8.4.0</version>
         </dependency>
         <dependency>
             <groupId>ca.uhn.hapi.fhir</groupId>
@@ -233,7 +243,7 @@
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.8.9</version>
+            <version>2.13.2</version>
         </dependency>
         <dependency>
             <groupId>com.google.code.javaparser</groupId>
@@ -457,7 +467,7 @@
         <dependency>
             <groupId>org.eclipse.jgit</groupId>
             <artifactId>org.eclipse.jgit</artifactId>
-            <version>6.10.1.202505221210-r</version>
+            <version>7.4.0.202509020913-r</version>
         </dependency>
         <dependency>
             <groupId>org.fhir</groupId>
@@ -483,7 +493,7 @@
         <dependency>
             <groupId>org.mozilla</groupId>
             <artifactId>rhino</artifactId>
-            <version>1.7R4</version>
+            <version>1.9.0</version>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>