upgrade dependencies

[qiangdavidliu]

No description provided.

[qiangdavidliu]

@spencergibb

[spencergibb]

You guys and changing java versions in a minor :-)

[spencergibb]

So is this after 2.2.3?

[qiangdavidliu]

Yeah, unfortunately due to some decisions from a long time ago :(.
This PR is still probationary, no need to merge it in now. At some point in the future we'd like to bump the ribbon dependencies to be more inline with what we actually use.
If you guys have a preference, we can do this later.

[spencergibb]

NP, can you at least bump the ribbon version to 2.3.x so the 2.2.x line stays java 7?

[qiangdavidliu]

No worries. If/when the java8 does happen, it will absolutely be 2.3.x.

[wojteo]

Is there a chance for these dependencies to be upgraded? There are several highly scored CVEs present in there
You could consider dependabot to make this update process more automated in the future
#452 #491