Bump Jython to 2.7.3

[jlowe]

Bumping Jython to 2.7.3 to address CVE-2013-2027

[jlowe]

build

[github-actions]

👎 Promotion blocked, new vulnerability found

Vulnerability report

Component	Vulnerability	Description	Severity
Jython	CVE-2013-2027	Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.	MEDIUM

[revans2]

Should we move away from using jython? Using a beta version does not feel great.

Also the vulnerability scan is still failing. Should we try going to 2.7.3 instead?

[jlowe]

Should we try going to 2.7.3 instead?

I was trying to minimize the change by going to the closest patched version, as the CVE said 2.7.2b3 has the fix. I'll try going to 2.7.3.

[jlowe]

build

[gerashegalov]

LGTM

[gerashegalov]

Should we move away from using jython?

I picked jython for the following reasons:

• lightweight integration with Ant allowing to sidestep awkward XML programming
• does not introduce a new language to the code base
• most actively maintained scriptdef implementation judging by the number of commits as far as I can see which is probably also the reason why we have a release ready for the CVE
• does not require real Python just for the build's sake
• on the other hand, I anticipated that some day it might be required to drop it, and it's not hard to rewrite it in terms of ant exec to python