Dependency updates (not dependabot detected)

[planetf1]

Evaluate Updating versions of

• libthrift ((0.9.2/0.13.0 -> 0.14.1) [fvts, canonical glossary]
• elasticsearch-client (7.6.2-> 7.12.1) [janusgraph]
• jakarta.el (3.0.2 -> 4.0.1) [springboot]

to address documented security issues

[planetf1]

Also need to check the following ignored dependencies:
org.apache.jena:jena-core
org.apache.jena:jena-arq

[planetf1]

• jena is now updated in June 2021 dependabot updates (part 2) #5309
• jakarta-el is not needed
• thrift will be removed as part of continuing cassandra work including Cassandra Dependency (scope/security) #2671
• elasticsearch is not a direct dependency, only transitive, via janusgraph-es . We generally only mandate versions due to security issues or consistency, this case doesn;t meet this criteria so there seems no requirement to force an updated version

All issues therefore resolved so closing

[planetf1]

Unable to merge jena update -- requires Java 11.
Reopening

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 20 days if no further activity occurs. Thank you for your contributions.