various dependency updates for master

[sepe81]

No description provided.

[lukaszlenart]

It fails on Log4j as here #836

[sepe81]

Okay, there seems to be some minor problem with error_prone_annotations. I'll try to solve it.

Warning:
Dependency convergence error for com.google.errorprone:error_prone_annotations:jar:2.23.0:compile paths to dependency are:
+-org.apache.struts:struts2-showcase:war:6.4.0-SNAPSHOT
+-org.apache.logging.log4j:log4j-api:jar:2.22.1:compile
+-com.google.errorprone:error_prone_annotations:jar:2.23.0:compile
and
+-org.apache.struts:struts2-showcase:war:6.4.0-SNAPSHOT
+-org.apache.struts:struts2-core:jar:6.4.0-SNAPSHOT:compile
+-com.github.ben-manes.caffeine:caffeine:jar:2.9.3:compile
+-com.google.errorprone:error_prone_annotations:jar:2.10.0:compile

Error: Rule 0: org.apache.maven.plugins.enforcer.DependencyConvergence failed with message:

[sepe81]

Unfortunately, error_prone_annotations > 2.10.0 depends on Java 11 – so an upgrade is not an option for now.

I'll downgrade log4j2 to 2.21.1.

[lukaszlenart]

I created ticket WW-5384 to address Log4j in S7

[sepe81]

@lukaszlenart ready to merge or do you see any further issue? I would like to cherry pick this to v7 afterwards and add a commit for WW-5384

[lukaszlenart]

I wonder if we shouldn't create JIRA tickets to let users know what was upgraded in scope of this PR

[sepe81]

@lukaszlenart What kind of detail level do you prefer for such a ticket? There are many Dependabot updates nowadays without an accompanying ticket. That's why I'm somewhat puzzled about how we want to handle this consistently?

[lukaszlenart]

I just create a simple Dependency task in JIRA with a title explaining what is going to be upgraded like here WW-5347. Yet I wonder if need to report any patch version upgrade, if all the tests passed everything should be fine. Let me ask this on the Dev group.

[lukaszlenart]

Ok, looks like my idea with merging patch versions without a JIRA ticket is ok. Could you create a ticket to cover upgrade of Log4j from 2.20.0 to 2.21.1? This is the only major/minor upgrade in this PR. Thanks in advance!

[sepe81]

see https://issues.apache.org/jira/browse/WW-5389

[lukaszlenart]

Thanks, LGTM!