2.x: Upgrade jackson, kafka client, log4j, owasp dep check

.gitignore

@@ -77,3 +77,6 @@ user.txt
 ObjectStore/
 PutObjectStoreDirHere/
 RUNTIMEDB/
+
+# OCA
+.oca/

dependencies/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2019, 2025 Oracle and/or its affiliates.
+    Copyright (c) 2019, 2026 Oracle and/or its affiliates.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -72,7 +72,7 @@
         <version.lib.hystrix>1.5.18</version.lib.hystrix>
         <version.lib.inject>1.0</version.lib.inject>
         <version.lib.interceptor-api>1.2.5</version.lib.interceptor-api>
-        <version.lib.jackson>2.20.0</version.lib.jackson>
+        <version.lib.jackson>2.21.1</version.lib.jackson>
         <version.lib.jaegertracing>1.8.1</version.lib.jaegertracing>
         <version.lib.jandex>2.3.1.Final</version.lib.jandex>
         <version.lib.jaxb-api>2.3.3</version.lib.jaxb-api>
@@ -93,8 +93,8 @@
         <version.lib.jsonp-api>1.1.6</version.lib.jsonp-api>
         <version.lib.jsonp-impl>1.1.6</version.lib.jsonp-impl>
         <version.lib.junit>5.7.0</version.lib.junit>
-        <version.lib.kafka>3.9.1</version.lib.kafka>
-        <version.lib.log4j>2.21.1</version.lib.log4j>
+        <version.lib.kafka>3.9.2</version.lib.kafka>
+        <version.lib.log4j>2.25.3</version.lib.log4j>
         <version.lib.logback>1.4.14</version.lib.logback>
         <version.lib.mariadb-java-client>2.6.2</version.lib.mariadb-java-client>
         <version.lib.maven-wagon>2.10</version.lib.maven-wagon>

etc/dependency-check-suppression.xml

@@ -261,4 +261,50 @@ https://github.com/jeremylong/DependencyCheck/issues/7019
    <cve>CVE-2025-67487</cve>
 </suppress>
 
+<!-- False Positive.
+     This CVE is against Static Web Server (SWS) not Helidon WebServer static content support
+-->
+<suppress>
+   <notes><![CDATA[
+   file name: io.helidon.webserver:helidon-webserver-static-content:2.6.15-SNAPSHOT
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/io\.helidon\.webserver/helidon-webserver-static-content@.*$</packageUrl>
+   <cve>CVE-2026-27480</cve>
+</suppress>
+
+
+<!-- False Positive.
+     This CVE is against Neo4J database, not the driver
+-->
+<suppress>
+   <notes><![CDATA[
+   file name: neo4j-java-driver-slim-4.4.11.jar
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/org\.neo4j\.driver/neo4j-java-driver-slim@.*$</packageUrl>
+   <cve>CVE-2026-1337</cve>
+</suppress>
+<suppress>
+   <notes><![CDATA[
+   file name: io.helidon.integrations.neo4j:helidon-integrations-neo4j:2.6.15-SNAPSHOT
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/io\.helidon\.integrations\.neo4j/helidon-integrations-neo4j@.*$</packageUrl>
+   <cve>CVE-2026-1337</cve>
+</suppress>
+
+<!-- 
+     This CVE is old and was fixed in Kotlin 1.4.21. The CPE recently changed in NVD.
+     Will keep an eye on this to see if the CPE in NVD is bad, or if there is something new.
+-->
+<suppress>
+   <notes><![CDATA[
+   file name: kotlin-stdlib-1.9.10.jar
+   file name: kotlin-stdlib-jdk7-1.9.10.jar
+   file name: kotlin-stdlib-jdk8-1.9.10.jar
+   file name: kotlin-stdlib-common-1.9.10.jar
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib.*$</packageUrl>
+   <cve>CVE-2020-29582</cve>
+</suppress>
+
+
 </suppressions>

logging/log4j/pom.xml

@@ -47,6 +47,11 @@
             <artifactId>log4j-api</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter-api</artifactId>

pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2016, 2025 Oracle and/or its affiliates.
+    Copyright (c) 2016, 2026 Oracle and/or its affiliates.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -119,7 +119,7 @@
         <version.plugin.source>3.0.1</version.plugin.source>
         <version.plugin.spotbugs>4.4.2.2</version.plugin.spotbugs>
         <version.plugin.findsecbugs>1.11.0</version.plugin.findsecbugs>
-        <version.plugin.dependency-check>12.1.5</version.plugin.dependency-check>
+        <version.plugin.dependency-check>12.1.9</version.plugin.dependency-check>
         <version.plugin.surefire>3.0.0-M5</version.plugin.surefire>
         <version.plugin.toolchains>1.1</version.plugin.toolchains>
         <version.plugin.version-plugin>2.3</version.plugin.version-plugin>