ATLAS-2671: Dependency upgrades

graphdb/janus/pom.xml

@@ -34,9 +34,10 @@
          Some dependencies, like slf4j are excluded from the jar because they are included in Atlas -->
 
     <properties>
-        <tinkerpop.version>3.2.6</tinkerpop.version>
+        <tinkerpop.version>3.3.3</tinkerpop.version>
         <janus.version>0.2.0</janus.version>
         <checkstyle.failOnViolation>false</checkstyle.failOnViolation>
+        <lucene-solr.version>7.3.0</lucene-solr.version>
     </properties>
 
     <dependencies>
@@ -173,6 +174,32 @@
             <artifactId>solr-solrj</artifactId>
             <version>7.0.0</version>
         </dependency>
+        <!-- CVE Overrides for Lucene -->
+        <dependency>
+            <groupId>org.apache.lucene</groupId>
+            <artifactId>lucene-core</artifactId>
+            <version>${lucene-solr.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.lucene</groupId>
+            <artifactId>lucene-analyzers-common</artifactId>
+            <version>${lucene-solr.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.lucene</groupId>
+            <artifactId>lucene-queryparser</artifactId>
+            <version>${lucene-solr.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.lucene</groupId>
+            <artifactId>lucene-spatial</artifactId>
+            <version>${lucene-solr.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.lucene</groupId>
+            <artifactId>lucene-spatial-extras</artifactId>
+            <version>${lucene-solr.version}</version>
+        </dependency>
 
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>

graphdb/janus/src/main/java/org/apache/atlas/repository/graphdb/janus/migration/AtlasGraphSONReader.java

@@ -25,6 +25,7 @@ import org.apache.tinkerpop.gremlin.process.traversal.dsl.graph.GraphTraversal;
 import org.apache.tinkerpop.gremlin.structure.Graph;
 import org.apache.tinkerpop.gremlin.structure.Vertex;
 import org.apache.tinkerpop.gremlin.structure.io.graphson.GraphSONMapper;
+import org.apache.tinkerpop.gremlin.structure.io.graphson.TypeInfo;
 import org.apache.tinkerpop.shaded.jackson.core.JsonFactory;
 import org.apache.tinkerpop.shaded.jackson.core.JsonParser;
 import org.apache.tinkerpop.shaded.jackson.core.JsonToken;
@@ -257,7 +258,7 @@ public final class AtlasGraphSONReader {
             }
 
             final GraphSONMapper.Builder builder = GraphSONMapper.build();
-            final GraphSONMapper         mapper  = builder.embedTypes(false).create();
+            final GraphSONMapper         mapper  = builder.typeInfo(TypeInfo.NO_TYPES).create();
 
             return new AtlasGraphSONReader(mapper.createMapper(), relationshipCache, graph, bulkLoadGraph,
                                            propertiesToPostProcess, numWorkers, batchSize, suppliedStartIndex);

graphdb/janus/src/test/java/org/apache/atlas/repository/graphdb/janus/migration/BaseUtils.java

@@ -22,6 +22,7 @@ import org.apache.commons.io.FileUtils;
 import org.apache.tinkerpop.gremlin.process.traversal.dsl.graph.GraphTraversal;
 import org.apache.tinkerpop.gremlin.structure.Vertex;
 import org.apache.tinkerpop.gremlin.structure.io.graphson.GraphSONMapper;
+import org.apache.tinkerpop.gremlin.structure.io.graphson.TypeInfo;
 import org.apache.tinkerpop.gremlin.tinkergraph.structure.TinkerGraph;
 import org.apache.tinkerpop.shaded.jackson.databind.JsonNode;
 import org.apache.tinkerpop.shaded.jackson.databind.ObjectMapper;
@@ -66,7 +67,7 @@ public class BaseUtils {
 
     private JsonNode getEntityNode(String json) throws IOException {
         GraphSONMapper.Builder builder = GraphSONMapper.build();
-        final ObjectMapper mapper  = builder.embedTypes(false).create().createMapper();
+        final ObjectMapper mapper  = builder.typeInfo(TypeInfo.NO_TYPES).create().createMapper();
         return mapper.readTree(json);
     }
 

pom.xml

@@ -554,8 +554,8 @@
         <gson.version>2.5</gson.version>
         <fastutil.version>6.5.16</fastutil.version>
         <guice.version>4.1.0</guice.version>
-        <spring.version>4.3.8.RELEASE</spring.version>
-        <spring.security.version>4.2.4.RELEASE</spring.security.version>
+        <spring.version>4.3.17.RELEASE</spring.version>
+        <spring.security.version>4.2.6.RELEASE</spring.security.version>
 
         <javax.servlet.version>3.1.0</javax.servlet.version>
         <guava.version>19.0</guava.version>
@@ -564,7 +564,7 @@
 
         <!-- Needed for hooks -->
         <aopalliance.version>1.0</aopalliance.version>
-        <jackson.version>2.9.2</jackson.version>
+        <jackson.version>2.9.5</jackson.version>
         <commons-conf.version>1.10</commons-conf.version>
         <commons-conf2.version>2.2</commons-conf2.version>