Upgrade utils-mail-dkim dependency to version 3.2.2 resolving dependency clashes and update ossindex-maven-plugin configuration to exclude multiple CVEs for spring dependency on provided scope (can't upgrade Spring without commercial license, or by switching to Java 17).

Author: bbottema

modules/dkim-module/pom.xml

@@ -33,7 +33,7 @@
         <dependency>
             <groupId>org.simplejavamail</groupId>
             <artifactId>utils-mail-dkim</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.2</version>
         </dependency>
     </dependencies>
 </project>

modules/spring-module/pom.xml

@@ -37,6 +37,7 @@
             <artifactId>spring-core</artifactId>
             <scope>provided</scope>
         </dependency>
+        <!--suppress VulnerableLibrariesLocal -->
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-context</artifactId>
@@ -68,6 +69,7 @@
             <artifactId>spring-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <!--suppress VulnerableLibrariesLocal -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
@@ -114,6 +116,32 @@
                     </annotationProcessorPaths>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.sonatype.ossindex.maven</groupId>
+                <artifactId>ossindex-maven-plugin</artifactId>
+                <configuration>
+                    <excludeVulnerabilityIds>
+                        <!-- Cannot be fixed:
+                            1. fix version is only available in a Spring commercial version
+                            2. the next OSS version requires minimum Java 17
+                            3. Spring is a 'provided' dependency anyway, so not shipped with this library -->
+                        <excludeVulnerabilityId>CVE-2024-38820</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2023-51074</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2024-31573</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-1471</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-25857</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-38749</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-38750</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-38751</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-38752</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2022-41854</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2023-1370</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2023-6378</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2024-12798</excludeVulnerabilityId>
+                        <excludeVulnerabilityId>CVE-2024-12801</excludeVulnerabilityId>
+                    </excludeVulnerabilityIds>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 </project>

pom.xml

@@ -165,19 +165,6 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.sonatype.ossindex.maven</groupId>
-                <artifactId>ossindex-maven-plugin</artifactId>
-                <configuration>
-                    <excludeVulnerabilityIds>
-                        <!-- Cannot be fixed:
-                            1. fix version is only available in a Spring commercial version
-                            2. the next OSS version requires minimum Java 17
-                            3. Spring is a 'provided' dependency anyway, so not shipped with this library -->
-                        <excludeVulnerabilityId>CVE-2024-38820</excludeVulnerabilityId>
-                    </excludeVulnerabilityIds>
-                </configuration>
-            </plugin>
         </plugins>
     </build>