Merge tag 'v3.0.3'

[maven-release-plugin] copy for tag v3.0.3

.github/workflows/build.yml

@@ -21,7 +21,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       with:
         token: ${{ github.token }}
         submodules: recursive
@@ -35,14 +35,14 @@ jobs:
         maven-version: 3.9.3
     - name: Set up JDK 11 (build only)
       if: ${{ !((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'develop') }}
-      uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2
+      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93
       with:
         java-version: 11
         distribution: 'temurin'
         cache: 'maven'
     - name: Set up JDK 11 (deploy)
       if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'develop'
-      uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2
+      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93
       with:
         java-version: 11
         distribution: 'temurin'
@@ -54,7 +54,7 @@ jobs:
         gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
     - name: Initialize CodeQL
       if: github.event_name == 'push'
-      uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4
+      uses: github/codeql-action/init@b7bf0a3ed3ecfa44160715d7c442788f65f0f923
       with:
         languages: java
     # -------------------------
@@ -74,7 +74,7 @@ jobs:
         MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
     - name: Perform CodeQL Analysis
       if: github.event_name == 'push'
-      uses: github/codeql-action/analyze@6a28655e3dcb49cb0840ea372fd6d17733edd8a4
+      uses: github/codeql-action/analyze@b7bf0a3ed3ecfa44160715d7c442788f65f0f923
     - name: Test Website
       run: |
         # this needs to be run as a second build to ensure source is fully generated by the previous step

.github/workflows/release.yml

@@ -12,7 +12,7 @@ jobs:
       actions: read
       contents: write
     steps:
-    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       with:
         token: ${{ github.token }}
         submodules: recursive
@@ -25,7 +25,7 @@ jobs:
       with:
         maven-version: 3.9.3
     - name: Set up JDK 11
-      uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2
+      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93
       with:
         java-version: 11
         distribution: 'temurin'

pom.xml

@@ -4,12 +4,12 @@
 	<parent>
 		<groupId>gov.nist.secauto</groupId>
 		<artifactId>oss-parent</artifactId>
-		<version>26</version>
+		<version>27</version>
 	</parent>
 
 	<groupId>gov.nist.secauto.oscal</groupId>
 	<artifactId>liboscal-java</artifactId>
-	<version>3.0.2</version>
+	<version>3.0.3</version>
 	<packaging>jar</packaging>
 
 	<name>OSCAL Java Library</name>
@@ -27,7 +27,7 @@
 		<url>https://github.com/usnistgov/liboscal-java</url>
 		<connection>scm:git:[email protected]:usnistgov/liboscal-java.git</connection>
 		<developerConnection>scm:git:[email protected]:usnistgov/liboscal-java.git</developerConnection>
-	  <tag>v3.0.2</tag>
+	  <tag>v3.0.3</tag>
     </scm>
 
 	<distributionManagement>
@@ -124,17 +124,17 @@
 
 		<dependency.metaschema-framework.version>0.12.2</dependency.metaschema-framework.version>
 
-		<dependency.auto-service.version>1.0.1</dependency.auto-service.version>
-		<dependency.commons-lang3.version>3.13.0</dependency.commons-lang3.version>
+		<dependency.auto-service.version>1.1.1</dependency.auto-service.version>
+		<dependency.commons-lang3.version>3.14.0</dependency.commons-lang3.version>
 		<dependency.infinispan.version>13.0.10.Final</dependency.infinispan.version>
 		<dependency.jetbrains-annotation.version>23.0.0</dependency.jetbrains-annotation.version>
 		<dependency.jmock-junit5.version>2.12.0</dependency.jmock-junit5.version>
-		<dependency.log4j2.version>2.20.0</dependency.log4j2.version>
-		<dependency.saxon.version>12.3</dependency.saxon.version>
+		<dependency.log4j2.version>2.22.0</dependency.log4j2.version>
+		<dependency.saxon.version>12.4</dependency.saxon.version>
 		<dependency.spotbugs-annotations.version>4.7.3</dependency.spotbugs-annotations.version>
-		<dependency.xmlresolver.version>4.6.0</dependency.xmlresolver.version>
+		<dependency.xmlresolver.version>5.2.3</dependency.xmlresolver.version>
 
-		<plugin.cyclonedx.version>2.7.3</plugin.cyclonedx.version>
+		<plugin.cyclonedx.version>2.7.11</plugin.cyclonedx.version>
         <plugin.maven-toolchains.version>3.1.0</plugin.maven-toolchains.version>
 
 		<cyclonedx.schema.version>1.3</cyclonedx.schema.version>
@@ -273,19 +273,19 @@
 		<dependency>
 			<groupId>org.assertj</groupId>
 			<artifactId>assertj-core</artifactId>
-			<version>3.24.2</version>
+			<version>3.25.2</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.xmlunit</groupId>
 			<artifactId>xmlunit-core</artifactId>
-			<version>2.9.0</version>
+			<version>2.9.1</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.xmlunit</groupId>
 			<artifactId>xmlunit-assertj3</artifactId>
-			<version>2.9.0</version>
+			<version>2.9.1</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -398,7 +398,7 @@
 			<plugin>
 				<groupId>io.github.git-commit-id</groupId>
 				<artifactId>git-commit-id-maven-plugin</artifactId>
-				<version>6.0.0</version>
+				<version>7.0.0</version>
 				<configuration>
 					<useNativeGit>false</useNativeGit>
 				</configuration>
@@ -469,7 +469,7 @@
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>templating-maven-plugin</artifactId>
-				<version>1.0.0</version>
+				<version>3.0.0</version>
 				<executions>
 					<execution>
 						<id>filter-src</id>
@@ -482,7 +482,7 @@
 			<plugin>
 				<groupId>com.googlecode.maven-download-plugin</groupId>
 				<artifactId>download-maven-plugin</artifactId>
-				<version>1.6.8</version>
+				<version>1.8.0</version>
 				<configuration>
 					<skipCache>true</skipCache>
 					<overwrite>false</overwrite>