CVE Fix: Update json-path version

extensions-core/orc-extensions/src/test/java/org/apache/druid/data/input/orc/OrcReaderTest.java

@@ -314,8 +314,11 @@ public void testJsonPathFunctions() throws IOException
         //deviation of [7,8,9] is 1/3, stddev is sqrt(1/3), approximately 0.8165
         Assert.assertEquals(0.8165, Double.parseDouble(Iterables.getOnlyElement(row.getDimension("stddev"))), 0.0001);
 
-        //append is not supported
-        Assert.assertEquals(Collections.emptyList(), row.getDimension("append"));
+        // we do not support json-path append function for ORC format (see https://github.com/apache/druid/pull/11722)
+        Exception exception = Assert.assertThrows(UnsupportedOperationException.class, () -> {
+          row.getDimension("append");
+        });
+        Assert.assertEquals("Unused", exception.getMessage());
       }
       Assert.assertEquals(1, actualRowCount);
     }

licenses.yaml

@@ -397,7 +397,7 @@ name: JsonPath
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.3.0
+version: 2.9.0
 libraries:
   - com.jayway.jsonpath: json-path
 

owasp-dependency-check-suppressions.xml

@@ -21,7 +21,7 @@
   <!-- False positives -->
   <suppress>
     <notes><![CDATA[
-     file name: json-path-2.3.0.jar jackson-core-2.12.7.jar
+     file name: json-path-2.9.0.jar jackson-core-2.12.7.jar
      ]]></notes>
     <cve>CVE-2022-45688</cve>
     <cve>CVE-2023-35116</cve>

pom.xml

@@ -927,7 +927,7 @@
             <dependency>
                 <groupId>com.jayway.jsonpath</groupId>
                 <artifactId>json-path</artifactId>
-                <version>2.3.0</version>
+                <version>2.9.0</version>
             </dependency>
             <dependency>
                 <groupId>net.thisptr</groupId>