In attempting to compile this project according to the instructions in the readme, I observed that the OWASP dependency_check_maven plugin was having trouble grabbing CVE data from NIST (their CVE feed was scuttled a while ago). I bumped the version of this plugin up to 7.0.0 (the most current version available), and re-ran the build. But it failed, after detecting a number of dependencies with known vulnerabilities: I will paste the list below. All of these dependencies, including the dependency_check_maven plugin, need version bumps.
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '4.0': [ERROR] [ERROR] commons-cli-1.4.jar: CVE-2021-40111(6.5), CVE-2021-40110(7.5), CVE-2021-38542(5.9), CVE-2021-40525(9.1) [ERROR] commons-io-2.6.jar: CVE-2021-29425(4.8) [ERROR] httpclient-4.5.9.jar: CVE-2020-13956(5.3) [ERROR] jackson-annotations-2.6.0.jar: CVE-2018-1000873(6.5) [ERROR] jackson-core-2.6.7.jar: CVE-2018-1000873(6.5) [ERROR] jackson-databind-2.6.7.3.jar: CVE-2017-17485(9.8), CVE-2018-5968(8.1), CVE-2017-15095(9.8), CVE-2019-16942(9.8), CVE-2020-35491(8.1), CVE-2019-16943(9.8), CVE-2020-25649(7.5), CWE-611: Improper Restriction of XML External Entity Reference ('XXE')(5.4), CVE-2020-35490(8.1), CVE-2019-20330(9.8), CVE-2020-10673(8.8), CVE-2018-11307(9.8), CVE-2018-1000873(6.5), CVE-2018-7489(9.8), CVE-2019-17267(9.8), CVE-2019-17531(9.8), CVE-2019-16335(9.8), CVE-2019-14893(9.8), CVE-2019-14540(9.8) [ERROR] [ERROR] See the dependency-check report for more details.