fix: vulnerability of Woodstox 6.2.4

[kuju63]

This PR is to fix the vulnerability of Woodstox 6.2.4.
It is critical vulnerability from CVSS score (CVSS score 7.5).
It caused by jackson-databind which use vulnerable library.

It change impact is to need to change Kotlin support version to exclude 1.4, because jackson-databind 2.13 and later are not support Kotlin 1.4.

CLOSE #3194

[hfhbd]

Kotlin 1.4 support is need to support Gradle 7, which is still supported by Gradle and by Kotlin 1.9.22. Alternatively, switching to Kotlinx serialization would fix this vulnerability too.

[whyoleg]

Hey!
Thanks for the PR, but as stated above the main reason for such old Jackson dependency is compatibility with older Gradle verisions (which are still supported by Gradle and Kotlin Gradle Plugin). So we can't change it right now.

In case you need to enforce usage of newer compatible Jackson version during Dokka execution you need to enforce it in 2 places:

1. in build script classpath (because Dokka Gradle Plugin depends on it) - this configuration will depend on how your build is structured.

• in case you are using buildSrc/build-logic(or any other included build to manage convention plugins or shared configuration) you need to add this to it's build.gradle/build.gradle.kts:

dependencies {
    implementation(enforcedPlatform("com.fasterxml.jackson:jackson-bom:2.13.5"))
}

• in other cases, you can add this to projects build.gradle/build.gradle.kts where Dokka Gradle Plugin is applied:

buildscript {
    dependencies {
        classpath(enforcedPlatform("com.fasterxml.jackson:jackson-bom:2.13.5"))
    }
}

2. in Dokka execution - add this to all modules where Dokka is configured:

dependencies {
    dokkaRuntime(enforcedPlatform("com.fasterxml.jackson:jackson-bom:2.13.5"))
    dokkaPlugin(enforcedPlatform("com.fasterxml.jackson:jackson-bom:2.13.5"))
}

Note: this is via Kotlin Gradle DSL, for groovy same or similar code should work. In some cases, Gradle can not generate dokkaRuntime/dokkPlugin accessors - in this case it's possible to just quote them like "dokkaRuntime"

Maximum available Jackson version here depends on your Gradle version (and as so on embedded Kotlin version used in Gradle: https://docs.gradle.org/current/userguide/compatibility.html#kotlin), I've tested that at my side even 2.15.3 works (with Gradle 8.6).

Hopefully during implementation of new Dokka Gradle Plugin this will be resolved in some way and there will be no vulnerability reports.