Update oidc related dependencies (#71521)

Update:

Non-issue, no notable changes. 

- json-smart from 2.3 to 2.4.2
- accessors-smart from 1.2 to 2.4.2
- asm from 7.1 to 8.0.1
- nimbus-jose-jwt from 8.6 to 9.8.1
- oauth2-oidc-sdk from 7.0.2 to 9.3.1

Author: jkakavas

x-pack/plugin/security/build.gradle

@@ -59,14 +59,14 @@ dependencies {
   runtimeOnly 'com.google.guava:guava:19.0'
 
   // Dependencies for oidc
-  api "com.nimbusds:oauth2-oidc-sdk:7.0.2"
-  api "com.nimbusds:nimbus-jose-jwt:8.6"
+  api "com.nimbusds:oauth2-oidc-sdk:9.3.1"
+  api "com.nimbusds:nimbus-jose-jwt:9.8.1"
   api "com.nimbusds:lang-tag:1.4.4"
   api "com.sun.mail:jakarta.mail:1.6.3"
   api "net.jcip:jcip-annotations:1.0"
-  api "net.minidev:json-smart:2.3"
-  api "net.minidev:accessors-smart:1.2"
-  api "org.ow2.asm:asm:7.1"
+  api "net.minidev:json-smart:2.4.2"
+  api "net.minidev:accessors-smart:2.4.2"
+  api "org.ow2.asm:asm:8.0.1"
 
   testImplementation 'org.elasticsearch:securemock:1.2'
   testImplementation "org.elasticsearch:mocksocket:${versions.mocksocket}"
@@ -84,7 +84,7 @@ dependencies {
   testImplementation('org.apache.kerby:kerb-crypto:1.1.1')
   testImplementation('org.apache.kerby:kerb-util:1.1.1')
   testImplementation('org.apache.kerby:token-provider:1.1.1')
-  testImplementation('com.nimbusds:nimbus-jose-jwt:8.6')
+  testImplementation('com.nimbusds:nimbus-jose-jwt:9.8.1')
   testImplementation('net.jcip:jcip-annotations:1.0')
   testImplementation('org.apache.kerby:kerb-admin:1.1.1')
   testImplementation('org.apache.kerby:kerb-server:1.1.1')
@@ -264,13 +264,6 @@ tasks.named("thirdPartyAudit").configure {
     'net.sf.ehcache.Element',
     // [missing classes] SLF4j includes an optional class that depends on an extension class (!)
     'org.slf4j.ext.EventData',
-    // Optional dependency of oauth2-oidc-sdk that we don't need since we do not support AES-SIV for JWE
-    'org.cryptomator.siv.SivMode',
-    // Optional dependency of nimbus-jose-jwt for handling Ed25519 signatures and ECDH with X25519 (RFC 8037)
-    'com.google.crypto.tink.subtle.Ed25519Sign',
-    'com.google.crypto.tink.subtle.Ed25519Sign$KeyPair',
-    'com.google.crypto.tink.subtle.Ed25519Verify',
-    'com.google.crypto.tink.subtle.X25519',
     // Bouncycastle is an optional dependency for apache directory, cryptacular and opensaml packages. We
     // acknowledge them here instead of adding bouncy castle as a compileOnly dependency
     'org.bouncycastle.asn1.ASN1Encodable',
@@ -420,11 +413,13 @@ tasks.named("thirdPartyAudit").configure {
     'org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util',
     'org.bouncycastle.jcajce.provider.asymmetric.util.ECUtil',
     'org.bouncycastle.jce.provider.BouncyCastleProvider',
+    'org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider',
     'org.bouncycastle.jce.spec.ECNamedCurveGenParameterSpec',
     'org.bouncycastle.math.ec.ECFieldElement',
     'org.bouncycastle.math.ec.ECPoint',
     'org.bouncycastle.openssl.jcajce.JcaPEMWriter',
     'org.bouncycastle.operator.jcajce.JcaContentSignerBuilder',
+    'org.bouncycastle.operator.OperatorCreationException',
     'org.bouncycastle.util.Arrays',
     'org.bouncycastle.util.Strings',
     'org.bouncycastle.util.io.Streams',
@@ -454,7 +449,13 @@ tasks.named("thirdPartyAudit").configure {
           'javax.xml.bind.JAXBException',
           'javax.xml.bind.Unmarshaller',
           'javax.xml.bind.UnmarshallerHandler',
-          // Optional dependencies of oauth2-oidc-sdk
+          // Optional dependency of oauth2-oidc-sdk that we don't need since we do not support AES-SIV for JWE
+          'org.cryptomator.siv.SivMode',
+          // Optional dependency of nimbus-jose-jwt for handling Ed25519 signatures and ECDH with X25519 (RFC 8037)
+          'com.google.crypto.tink.subtle.Ed25519Sign',
+          'com.google.crypto.tink.subtle.Ed25519Sign$KeyPair',
+          'com.google.crypto.tink.subtle.Ed25519Verify',
+          'com.google.crypto.tink.subtle.X25519',
           'com.nimbusds.common.contenttype.ContentType',
           'javax.activation.ActivationDataFlavor',
           'javax.activation.DataContentHandler',

x-pack/plugin/security/licenses/accessors-smart-1.2.jar.sha1

@@ -0,0 +1 @@
+4f09981a3c80f0766998c68d83bfd060812d5bcd

x-pack/plugin/security/licenses/accessors-smart-2.4.2.jar.sha1

@@ -0,0 +1 @@
+3f5199523fb95304b44563f5d56d9f5a07270669

x-pack/plugin/security/licenses/asm-7.1.jar.sha1

@@ -0,0 +1 @@
+a7fcd0f985696c37cd3546f19c85c2ff367f2e85

x-pack/plugin/security/licenses/asm-8.0.1.jar.sha1

@@ -0,0 +1 @@
+2af7f734313320e4b156522d22ce32b775633909