Bump Gson 2.8.5 to a current release (CVE-2022-25647) #19

Contexte

Extracted from #3. pom.xml pins Gson 2.8.5 (2018) in dependencyManagement; CVE-2022-25647 (deserialization DoS) is fixed in 2.8.9. Latest is 2.14.0. Usage across core, metadata, agent and web-ui is plain JsonParser/Gson serialization, nothing reflective on JDK internals.

Description

Bump the single managed version to the current release and prove the four modules still build and test. If a Gson ≥ 2.10 behaviour change bites (stricter reflection, JsonParser static API), fix the call site rather than pinning an intermediate version.

Fichiers concernes

• pom.xml:73 — the managed version

Criteres d'acceptation

• Gson ≥ 2.11 in dependencyManagement, no module overriding it
• mvn -Dskip.installnodeyarn=true -Dskip.yarn=true test green on Ubuntu and Windows CI
• Linked from Dependencies frozen since 2019-2020, no update visibility #3

Complexite

S