JRuby: CVEs in transitive dependencies of Saxon-HE 9.6.0-4

[mohamedhafez]

See https://mvnrepository.com/artifact/net.sf.saxon/Saxon-HE/9.6.0-4

Hoping for a version bump if theres a chance those might affect JRuby users of nokogiri!

[headius]

Hard to figure out what these dependencies are doing, because on Maven Central they are listed as "optional" and the "open-source" version of Saxon (which is really more like source available) does not include a full Maven build for historical releases like 9.6.0-4.

It seems like the problematic dom4j and jdom depenedencies are only compile-time and would not affect users of saxon unless they are connecting it up to dom4j and jdom on their own. In other words, I think this is just an integration-level dependency that does not affect other uses of Saxon.

Upgrading it is still a good idea, since 9.6 is pretty old and these transitive dependencies will show up as false positives even for apps that never use jdom or dom4j.

[flavorjones]

See #3613

[flavorjones]

Also see #3614 which is a backport to the v1.19.x branch so I can cut a security release.

[headius]

@flavorjones Thank you... sorry I didn't get back to a PR but this was a pretty low priority.

[flavorjones]

Addressed in https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.2 out of an abundance of caution!