Upgrade to json-path 2.10.0

[ivonaest]

Summary

1. Why:
   To remove CVEs:

   • CVE-2024-57699
   • This CVE affects json-smart library and can lead to denial-of-service through stack exhaustion when parsing malicious JSON

2. What:

   • Upgrade json-path to 2.10.0 to remove CVE-2024-57699
   • json-smart is a transitive dependency of json-path and it needed 2.5.2+ version
   • By upgrading json-path to 2.10.0, json-smart was upgraded to 2.6.0

Additional evidence

Partial output from security scanner Trivy:

Categorization

• security/CVE

[bclozel]

CVE-2024-57699 is irrelevant here as Spring Framework optionnally compiles against this dependency. Only applications depend on json-path.

[ivonaest]

Hi @bclozel, while Spring is not vulnerable merging it is a small upgrade that would remote CVE from future security scans. Are you sure you don't want to merge it?

[bclozel]

@ivonaest I will merge it. I am just stating that this dependency will not show up in security scans because it is not declared in any of our artifacts. Only "spring-test" compiles against it and you can check that it does not depend on it in the published POM: https://central.sonatype.com/artifact/org.springframework/spring-test

Upgrading dependencies is an important concern, but it's even more important to understand how dependency management works and whether a CVE is applicable. Here it is not.

[ivonaest]

@bclozel Thank you for taking the time to explain CVE in this project. From my understanding, it is a false positive reported by Trivy scanner.

[bclozel]

Can you share the part where Trivy points to spring-test as the culprit?

Trivy might be looking at the Gradle module information (where this dependency might show up) but is maybe missing the fact that it's not on the compile classpath.

[ivonaest]

It showed up only here

[bclozel]

I don't understand why Trivy thinks spring-test has guava and other dependencies as transitive dependencies. Neither the POM file nor the Gradle module file lists anything like this. The commons-beanutils mention is also very strange.

If you can reach out to the Trivy team and get some answers, please let us know.