Dependabot aggregate updates 2023-07-20

[lpalashevski]

See list of dependency update commits for more details.

com.google.guava:guava:32.1.1-jre causes build error

* What went wrong:
Could not determine the dependencies of task ':open-metadata-implementation:adapters:open-connectors:repository-services-connectors:open-metadata-collection-store-connectors:graph-repository-connector:fatJar'.
> Could not resolve all dependencies for configuration ':open-metadata-implementation:adapters:open-connectors:repository-services-connectors:open-metadata-collection-store-connectors:graph-repository-connector:runtimeClasspath'.
   > There was an error while evaluating a component metadata rule for com.google.guava:guava:32.1.1-jre.
      > Cannot add capability com.google.collections:google-collections with version 32.1.1 because it's already defined with version 32.1.1-jre

Quick investigation shows that most probably there are problems related to metadata published for this release causing version resolution conflicts. To solve this we need to introduce custom exclusions / restrictions to satisfy some legacy capability requirements brought by transitive dependencies such as org.apache.cassandra:cassandra-all:4.1.2 and org.janusgraph:janusgraph-driver:0.6.3

Instead using com.google.guava:guava:32.0.1-jre

Since we are waiting on major JanusGraph release, I've decided not to chase this further (already spent significant time) and fix it by going back to recent version 32.0.1-jre
that works in combination with JanusGaraph and does not have vulnerabilities.

[sonatype-lift]

Sonatype Lift is retiring

Sonatype Lift will be retiring on Sep 12, 2023, with its analysis stopping on Aug 12, 2023. We understand that this news may come as a disappointment, and Sonatype is committed to helping you transition off it seamlessly. If you’d like to retain your data, please export your issues from the web console.
We are extremely grateful and thank you for your support over the years.

📖 Read about the impacts and timeline