Upgrade to some latest packages in NETFLIX-INFIX because some dependencies are very old

[smmsit]

Hi,

I found some very old dependencies being used in netflix-infix project list below,

1. joda-time v2.3 TO v2.13.1 (https://mvnrepository.com/artifact/joda-time/joda-time)

2. antlr-runtime v3.4 to 3.5.3, it has been relocated to org.antlr » antlr4-runtime which is being maintained regularly. This upgrade to latest relocated package also involves not using more old subpackages like commons-jxpath:commons-jxpath:jar:1.3, org.antlr:stringtemplate:jar:3.2.1, also to relocated org.antlr » antlr4

3. org.apache.commons.jxpath is a very old library, full of CVE and unmaintained for 17 years. We should remove deps on jxpath and use JDK standard implementation.

Can we update these packages to a much more stable version

[recaph]

https://commons.apache.org/jxpath/download_jxpath.cgi jxpath 1.4.0

[windmueller]

Guava 14.0.1 (released in March 2013) also has three known CVEs:

• CVE-2018-10237
• CVE-2020-8908
• CVE-2023-2976