Bump dependencies to address CVEs

- Bump log4j from 2.25.3 to 2.25.4 (CVE-2026-34480, CVE-2026-34478, CVE-2026-34477)
- Bump jetty from 9.4.57 to 9.4.58 in hdfs-fixture (CVE-2026-2332)
- Upgrade maven-model from 3.9.6 to 3.9.16, add plexus-xml 3.0.1 (CVE-2025-67030)
- Force log4j-core to 2.25.4 in buildSrc
- Bump commons-configuration2 from 2.11.0/2.13.0 to 2.15.0 (CVE-2026-34479)
- Bump jsoup from 1.20.1 to 1.22.2 (CVE-2026-5598, CVE-2025-33042)
- Bump Jackson from 2.18.6 to 2.18.8 (CVE-2026-0636, CVE-2026-5588)
- Bump reactor-netty from 1.2.9 to 1.2.18, reactor-core from 3.7.5 to 3.7.19 (CVE-2026-24281, CVE-2026-24308)

Signed-off-by: Andrew Ross <andrross@amazon.com>

Author: andrross

buildSrc/build.gradle

@@ -136,7 +136,8 @@ dependencies {
   api 'de.thetaphi:forbiddenapis:3.8'
   api 'com.avast.gradle:gradle-docker-compose-plugin:0.17.6'
   api "org.yaml:snakeyaml:${props.getProperty('snakeyaml')}"
-  api 'org.apache.maven:maven-model:3.9.6'
+  api 'org.apache.maven:maven-model:3.9.16'
+  api 'org.codehaus.plexus:plexus-xml:3.0.1'
   api 'com.networknt:json-schema-validator:1.2.0'
   api 'org.jruby.jcodings:jcodings:1.0.58'
   api 'org.jruby.joni:joni:2.2.1'
@@ -165,6 +166,7 @@ dependencies {
 configurations.all {
   resolutionStrategy {
     force "com.google.guava:guava:${props.getProperty('guava')}"
+    force "org.apache.logging.log4j:log4j-core:${props.getProperty('log4j')}"
   }
 }
 

buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle

@@ -18,7 +18,7 @@ repositories {
 }
 
 dependencies {
-  implementation "org.apache.logging.log4j:log4j-core:2.24.3"
+  implementation "org.apache.logging.log4j:log4j-core:2.25.4"
 }
 
 ["0.0.1", "0.0.2"].forEach { v ->

client/rest/licenses/reactor-core-3.7.19.jar.sha1

@@ -0,0 +1 @@
+4b4c09f49a6fa2fa122554453c2d71b5bf2077ef

client/rest/licenses/reactor-core-3.7.5.jar.sha1

@@ -0,0 +1 @@
+459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b

client/sniffer/licenses/jackson-core-2.18.6.jar.sha1

@@ -0,0 +1 @@
+655290d9c95ce378c4b5177b858eefbce0b7867a

client/sniffer/licenses/jackson-core-2.18.8.jar.sha1

@@ -0,0 +1 @@
+4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450