Upgrade xerces:xercesImpl

[feffi]

✗ High severity vulnerability found on xerces:xercesImpl@2.8.1

• info: Denial of Service (DoS)

[feffi]

for a parent list, have a look at: #1129

[feffi]

There is no fix version for xerces:xercesImpl yet

[jknack]

xerces is transitive dependency from jooby-pac4j

[INFO] +- org.pac4j:pac4j-openid:jar:2.2.1:test
[INFO] |  +- org.openid4java:openid4java:jar:1.0.0:test
[INFO] |  |  +- org.apache.httpcomponents:httpclient:jar:4.5.2:test
[INFO] |  |  |  \- org.apache.httpcomponents:httpcore:jar:4.4.4:test
[INFO] |  |  +- net.sourceforge.nekohtml:nekohtml:jar:1.9.10:test
[INFO] |  |  \- xerces:xercesImpl:jar:2.8.1:test

I didn't try it but think it is used in a closed context so we are safe.

[feffi]

For those kind of transitive vulnerabilities, I would recommend to write tests to verify this.

[jknack]

dependencies are automatically updated with dependabot now