use bom correctly and bump dependency checker plugin

Author: denis-yuen

wdl-parsing/WDLParsingFunction/THIRD-PARTY-LICENSES.txt

@@ -101,19 +101,19 @@ Lists of 191 third-party dependencies.
      (The Apache Software License, Version 2.0) J2ObjC Annotations (com.google.j2objc:j2objc-annotations:1.3 - https://github.com/google/j2objc/)
      (The Apache Software License, Version 2.0) Jackson 2 extensions to the Google APIs Client Library for Java (com.google.api-client:google-api-client-jackson2:1.33.2 - https://github.com/googleapis/google-api-java-client/google-api-client-jackson2)
      (The Apache Software License, Version 2.0) Jackson 2 extensions to the Google HTTP Client Library for Java. (com.google.http-client:google-http-client-jackson2:1.41.4 - https://github.com/googleapis/google-http-java-client/google-http-client-jackson2)
-     (The Apache Software License, Version 2.0) Jackson datatype: JSR310 (com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.12.3 - https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jsr310)
-     (The Apache Software License, Version 2.0) Jackson module: JAXB Annotations (com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.12.2 - https://github.com/FasterXML/jackson-modules-base)
-     (The Apache Software License, Version 2.0) Jackson-annotations (com.fasterxml.jackson.core:jackson-annotations:2.12.3 - http://github.com/FasterXML/jackson)
-     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.12.7 - https://github.com/FasterXML/jackson-core)
-     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.12.7.1 - http://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson datatype: JSR310 (com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.0 - https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jsr310)
+     (The Apache Software License, Version 2.0) Jackson module: Old JAXB Annotations (javax.xml.bind) (com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.22.0 - https://github.com/FasterXML/jackson-modules-base)
+     (The Apache Software License, Version 2.0) Jackson-annotations (com.fasterxml.jackson.core:jackson-annotations:2.22 - https://github.com/FasterXML/jackson)
+     (The Apache Software License, Version 2.0) Jackson-core (com.fasterxml.jackson.core:jackson-core:2.22.0 - https://github.com/FasterXML/jackson-core)
+     (The Apache Software License, Version 2.0) jackson-databind (com.fasterxml.jackson.core:jackson-databind:2.22.0 - https://github.com/FasterXML/jackson)
+     (EDL 1.0) Jakarta Activation API jar (jakarta.activation:jakarta.activation-api:1.2.2 - https://github.com/eclipse-ee4j/jaf/jakarta.activation-api)
      (EPL 2.0) (GPL2 w/ CPE) Jakarta Annotations API (jakarta.annotation:jakarta.annotation-api:1.3.5 - https://projects.eclipse.org/projects/ee4j.ca)
      (EPL 2.0) (GPL2 w/ CPE) jakarta.ws.rs-api (jakarta.ws.rs:jakarta.ws.rs-api:2.1.6 - https://github.com/eclipse-ee4j/jaxrs-api)
-     (Eclipse Distribution License - v 1.0) jakarta.xml.bind-api (jakarta.xml.bind:jakarta.xml.bind-api:2.3.2 - https://github.com/eclipse-ee4j/jaxb-api/jakarta.xml.bind-api)
      (BSD-3-Clause) janino (org.codehaus.janino:janino:3.1.7 - http://janino-compiler.github.io/janino/)
      (The Apache Software License, Version 2.0) Java 6 (and higher) Extensions to the Google API Client Library for Java. (com.google.api-client:google-api-client-java6:1.33.2 - https://github.com/googleapis/google-api-java-client/google-api-client-java6)
      (The Apache Software License, Version 2.0) Java 6 (and higher) extensions to the Google OAuth Client Library for Java. (com.google.oauth-client:google-oauth-client-java6:1.33.0 - https://github.com/googleapis/google-oauth-java-client/google-oauth-client-java6)
+     (CDDL 1.1) (GPL2 w/ CPE) Java Architecture for XML Binding (javax.xml.bind:jaxb-api:2.2.12 - http://jaxb.java.net/)
      (Apache-2.0) (LGPL-2.1-or-later) Java Native Access (net.java.dev.jna:jna:5.9.0 - https://github.com/java-native-access/jna)
-     (EDL 1.0) JavaBeans Activation Framework API jar (jakarta.activation:jakarta.activation-api:1.2.1 - https://github.com/eclipse-ee4j/jaf/jakarta.activation-api)
      (Apache 2) JavaEWAH (com.googlecode.javaewah:JavaEWAH:1.1.13 - https://github.com/lemire/javaewah)
      (EPL 2.0) (GPL2 w/ CPE) javax.inject:1 as OSGi bundle (org.glassfish.hk2.external:jakarta.inject:2.6.1 - https://github.com/eclipse-ee4j/glassfish-hk2/external/jakarta.inject)
      (Apache License, Version 2.0) JCL 1.2 implemented over SLF4J (org.slf4j:jcl-over-slf4j:1.7.32 - http://www.slf4j.org)
@@ -190,4 +190,4 @@ Lists of 191 third-party dependencies.
      (WDL License https://github.com/openwdl/wdl/blob/master/LICENSE) wdl-biscayne (org.broadinstitute:wdl-biscayne_2.13:85 - no url defined)
      (WDL License https://github.com/openwdl/wdl/blob/master/LICENSE) wdl-draft2 (org.broadinstitute:wdl-draft2_2.13:85 - no url defined)
      (WDL License https://github.com/openwdl/wdl/blob/master/LICENSE) wdl-draft3 (org.broadinstitute:wdl-draft3_2.13:85 - no url defined)
-     (Unknown license) womtool (org.broadinstitute:womtool_2.13:85 - no url defined)
+     (Cromwell License https://github.com/broadinstitute/cromwell/blob/develop/LICENSE.txt) womtool (org.broadinstitute:womtool_2.13:85 - no url defined)

wdl-parsing/WDLParsingFunction/pom.xml

@@ -7,10 +7,8 @@
     <packaging>jar</packaging>
     <name>WDL parser created for SAM CLI.</name>
     <properties>
-        <maven.compiler.source>11</maven.compiler.source>
-        <maven.compiler.target>11</maven.compiler.target>
         <jersey-version>2.34</jersey-version>
-        <jackson-version>2.12.3</jackson-version>
+        <jackson-version>2.22.0</jackson-version>
         <junit-version>5.7.2</junit-version>
         <maven-plugin-version>3.0.0-M5</maven-plugin-version>
     </properties>
@@ -48,6 +46,17 @@
             <url>https://artifacts.oicr.on.ca/artifactory/collab-release</url>
         </repository>
     </repositories>
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson-version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
     <dependencies>
         <dependency>
             <groupId>com.amazonaws</groupId>
@@ -132,13 +141,10 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <!-- The "jackson-version" version of this artifact doesn't exist, override for dependabot -->
-            <version>2.22.0</version>
         </dependency>
         <dependency>
             <groupId>org.openapitools</groupId>
@@ -148,7 +154,6 @@
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
         <dependency>
             <groupId>org.glassfish.jersey.core</groupId>
@@ -211,7 +216,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-dependency-plugin</artifactId>
-                <version>3.1.2</version>
+                <version>3.11.0</version>
                 <configuration>
                     <failOnWarning>true</failOnWarning>
                     <outputXML>true</outputXML>