tree a55f1b6820e410b44155bbd3cd96b629ed859cb0
parent 6a19e0e3b8d76b5abb872a4cce81f99cbdf36a88
author Lari Hotari <lhotari@users.noreply.github.com> 1624831119 +0300
committer GitHub <noreply@github.com> 1624831119 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJg2PSPCRBK7hj4Ov3rIwAAk/AIAHDXxrp049wS5ohM6hHt1JCl
 1wqSiiJ2o6XIv+OLioW+eAAu8i5CybzkbvxHnxOlohYHdHqPEXrx2jzCQ9aL6PFJ
 MLQ9iN19/6dgTakvRS7PRZU9iKVBiDM1DS01DeltD2pqRPh1Hm+QzawXUf2ULecp
 N5oqEDW7/tNFUH9oDClWoogdw/9D0fZZdVmLIlRj40d7mkuY+zUNpEx2SfS+uv3l
 bZIfvQzKEBky5F13GPm/qmA/ZLkOiWdphKb/iph9gcNkx+rxCnBaJwfN8NR+X+Nw
 vIvFHcZ3n0RkQCnMyXRUDAAAmqnszKwRlpj5BtU7KHTiJpFXov8haosZ+Y1EM6k=
 =1Or3
 -----END PGP SIGNATURE-----
 

[Build/Security] Upgrade Freebuilder version and fix the dependency

Fixes #2732

### Motivation

- Freebuilder 1.14.9 contains an outdate jquery js file which causes the library to be flagged as vulnerable with the highest threat level in Sonatype IQ vulnerability scanner. This also flags Bookkeeper and Pulsar as vulnerable with the highest threat level although it is a false positive and not an actual threat.

- Freebuilder shouldn't be exposed as a transitive dependency
  - it's an annotation processor which should be defined
    - [optional in maven](https://github.com/inferred/FreeBuilder#maven)
    - [compileOnly in gradle](https://github.com/inferred/FreeBuilder#gradle)

### Changes

- upgrade [Freebuilder](https://github.com/inferred/FreeBuilder) from 1.14.9 to 2.7.0
- make dependency optional in maven pom.xml
- use `compileOnly` instead of `implementation` in gradle build

Reviewers: Sijie Guo <None>

This closes #2734 from lhotari/lh-fix-freebuilder-dependency-issue