EDIT

mvn versions:display-dependency-updates
mvn dependency:tree
mvn dependency:tree -Dscope=compile
mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:tree -Dverbose=true  (verbose flag has been removed in 3.0 (https://maven.apache.org/plugins/maven-dependency-plugin/examples/resolving-conflicts-using-the-dependency-tree.html)
mvn dependency:analyze

taxeditor.cdmlib dependencies should use cdmlib-io dependencies. Dependencies from cdmlib-remote, cdmlib-print, etc. should only be mentioned in the according plugins like taxeditor.print.
Also database related dependencies should only go to taxeditor.webapp (once #9189 is implemented)

important:

• spring-security-oauth2 2.0.11.RELEASE => 2.5.0.RELEASE
• xercesImpl 2.11.0 => 2.12.0

• hibernate-validator 5.2.2.Final => 6.1.5.Final with new groupId org.hibernate.validator (before it was org.hibernate)

  • slf4j 1.7.13 => 1.7.30
  • jboss-logging 3.3.0.Final => 3.4.1.Final
  • classmate 1.3.1 => 1.5.1
  • javax.el-api => 2.2.5 => 3.0.0
  • validation-api 1.1.0.Final => 2.0.1.Final

others:

• cglib and cglib-nodep (#9206)
• ehcache (#9207, there are open issues)
• jackson 2.10.2 => 2.11.2
  

TODO:

• remove cdmlib-persistence from taxeditor dependencies (also removes hibernate dependencies) (#9208)
• upgrade to hibernate >5.1
• remove apache-log4j-extras from taxeditor #9205