MLE-24826 Bumping Spring, undertow for CVEs

[rjrudin]

Also bumped an old version of xmlunit. Pretty sure the junit:junit stuff can be easily removed next.

[github-actions]

Copyright Validation Results
Total: 5 | Passed: 0 | Failed: 0 | Skipped: 5 | at: 2025-10-22 18:05:21 UTC | commit: 47f0091

⏭️ Skipped (Excluded) Files

• build.gradle
• marklogic-client-api-functionaltests/build.gradle
• marklogic-client-api/build.gradle
• ml-development-tools/build.gradle
• test-app/build.gradle

✅ All files have valid copyright headers!

[Copilot]

Pull Request Overview

This pull request addresses security vulnerabilities by bumping versions of Spring dependencies (through transitives), Undertow, and XMLUnit libraries.

Key changes:

• Updated Undertow from 2.3.19.Final to 2.3.20.Final to address CVEs
• Migrated XMLUnit from legacy 1.6 to modern 2.10.4 with updated Maven coordinates
• Updated JUnit Jupiter and ml-app-deployer dependencies to latest versions

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
test-app/build.gradle	Updated Undertow core and servlet dependencies to version 2.3.20.Final
ml-development-tools/build.gradle	Migrated from xmlunit:xmlunit:1.6 to org.xmlunit:xmlunit-legacy:2.10.4
marklogic-client-api/build.gradle	Updated JUnit Jupiter to 5.14.0 and ml-app-deployer to 6.2-SNAPSHOT
marklogic-client-api-functionaltests/build.gradle	Updated ml-app-deployer to 6.2-SNAPSHOT

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Using a SNAPSHOT dependency in production code introduces instability, as the artifact can change without notice. Consider using a stable release version instead, or document why a SNAPSHOT is required.

Suggested change

	testImplementation "com.marklogic:ml-app-deployer:6.2-SNAPSHOT"
	testImplementation "com.marklogic:ml-app-deployer:6.2.0"

[Copilot]

Using a SNAPSHOT dependency in production code introduces instability, as the artifact can change without notice. Consider using a stable release version instead, or document why a SNAPSHOT is required.

Suggested change

	testImplementation "com.marklogic:ml-app-deployer:6.2-SNAPSHOT"
	testImplementation "com.marklogic:ml-app-deployer:6.2.0"