Updating and pinning libraries for security reasons

Author: bhermann

build.sbt

@@ -14,21 +14,21 @@ lazy val management = (project in file(".")).enablePlugins(SbtWeb).enablePlugins
                                           buildInfoKeys := Seq[BuildInfoKey](name, version, scalaVersion, sbtVersion),
                                           buildInfoPackage := "de.upb.cs.swt.delphi.management"
                                         )
-                                        
+
 val conf = ConfigFactory.parseFile(new File("conf/application.conf")).resolve()
 val appPortManagement    = conf.getString("app.portManagement")
 
 PlayKeys.devSettings := Seq(
     "play.server.http.port" -> appPortManagement
-)     
+)
 pipelineStages := Seq(digest,gzip)
 
 resolvers += Resolver.sonatypeRepo("snapshots")
 resolvers += Resolver.jcenterRepo
 
 libraryDependencies += guice
 libraryDependencies += "org.scalatestplus.play" %% "scalatestplus-play" % "3.1.2" % Test
-libraryDependencies += "com.h2database" % "h2" % "1.4.197"
+
 libraryDependencies += "com.mohiva" %% "play-silhouette" % "5.0.0"
 libraryDependencies += "com.mohiva" %% "play-silhouette-persistence" % "5.0.0"
 libraryDependencies += "com.mohiva" %% "play-silhouette-crypto-jca" % "5.0.0"
@@ -41,3 +41,12 @@ libraryDependencies += "com.adrianhurt" %% "play-bootstrap" % "1.4-P26-B4-SNAPSH
 libraryDependencies += "eu.bitwalker" % "UserAgentUtils" % "1.20"
 
 routesGenerator := InjectedRoutesGenerator
+
+// Pinning secure versions of insecure transitive libraryDependencies
+// Please update when updating dependencies above (including Play plugin)
+libraryDependencies ++= Seq(
+  "com.nimbusds" % "nimbus-jose-jwt" % "5.14",
+  "org.bouncycastle" % "bcprov-jdk15on" % "1.60",
+  "com.google.guava" % "guava" % "25.1-jre",
+  "org.apache.commons" % "commons-compress" % "1.16"
+)

project/plugins.sbt

@@ -1,5 +1,5 @@
 // The Play plugin
-addSbtPlugin("com.typesafe.play" % "sbt-plugin" % "2.6.10")
+addSbtPlugin("com.typesafe.play" % "sbt-plugin" % "2.6.14")
 
 // build management and packaging
 addSbtPlugin("com.eed3si9n" % "sbt-buildinfo" % "0.7.0")