Bump org.codehaus.jettison:jettison to 1.5.4

[kotwanikunal]

Description

• Bump org.codehaus.jettison:jettison to 1.5.4
• CVE: https://www.mend.io/vulnerability-database/CVE-2023-1436
• Mend Run: https://github.com/opensearch-project/OpenSearch/pull/6871/checks?check_run_id=12374301819

Issues Resolved

• https://www.mend.io/vulnerability-database/CVE-2023-1436

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Commits are signed per the DCO using --signoff
• Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/13048/
• CommitID: 542782e
  Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
  Is the failure a flaky test unrelated to your change?

[owaiskazi19]

Shouldn't we add this change in unreleased 3.x and then add it back here while backporting to 2.x?

[nknize]

+1, just remove this here, add skip-changelog and add this line on the 2.x backport. We really should fix this changelog process to be easier.

[kotwanikunal]

The process ideally is, if you know it has to be backported to x.x, add it to the Unreleased x.x version. That way, the automated backport flow does not fail.

[kotwanikunal]

@nknize Added the reasoning above. This is also covered within https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#where-should-i-put-my-changelog-entry

Where should I put my CHANGELOG entry?
Please review the branching strategy document. The changelog on the main branch will contain sections for the next major and next minor releases. Your entry should go into the section it is intended to be released in. In practice, most changes to main will be backported to the next minor release so most entries will likely be in that section.

The following examples assume the next major release on main is 3.0, then next minor release is 2.5, and the current release is 2.4.

Add a new feature to release in next minor: Add a changelog entry to [Unreleased 2.x] on main, then backport to 2.x (including the changelog entry).

[nknize]

Thanks for doing this... just fix the changelog craziness and let's merge since this is fixing the cascading whitesource failures.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: UNSTABLE ❕
• TEST FAILURES:

      1 org.opensearch.snapshots.SearchableSnapshotIT.testCacheFilesAreClosedAfterUse
      1 org.opensearch.search.basic.SearchWithRandomIOExceptionsIT.testRandomDirectoryIOExceptions
      1 org.opensearch.search.basic.SearchWithRandomIOExceptionsIT.classMethod
      1 org.opensearch.cluster.allocation.AwarenessAllocationIT.testThreeZoneOneReplicaWithForceZoneValueAndLoadAwareness

• URL: https://build.ci.opensearch.org/job/gradle-check/13049/
• CommitID: f0cd8d1
  Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-6878-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 ad059c75927df050058da233ba3788c2b887d6f0
# Push it to GitHub
git push --set-upstream origin backport/backport-6878-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-6878-to-2.x.

[kotwanikunal]

Backport: #6880
Looks like the changelog has drifted causing the auto backport failure.
Raising a PR to fix that as well.

[kotwanikunal]

Fix for changelog divergence: #6882