Update dependencies in POM

[bact]

• Update dependencies to their latest minor version
• Update spdx-maven-plugin to 1.0.3

[goneall]

In the past, I've been a bit more conservative on updating dependency versions - only updating if there is a security vulnerability or a fix we know would have a positive impact on the library.

I've noticed some of the other Java open source projects keep current on all minor versions. If we want to take this approach, I can update the dependabot to notify us on any updates.

@pmonks @bact - Any thoughts on changing the practice and updating dependabot config?

[pmonks]

In general when I'm confident in my unit tests (in terms of coverage), I'll generally be aggressive about staying on top of the latest released minor and/or patchlevel versions of dependencies (including, in some cases, automating dependency upgrades).

For Spdx-Java-Library specifically, the unit tests seem pretty comprehensive to me so I'd tend to lean towards being more aggressive - at a minimum having dependabot (or whatever) notifying us (raising an issue?) when a dependency falls out of date, but perhaps even automatically submitting a PR with the dependencies upgraded (which will trigger a run of the unit tests, which should tell us whether the upgrade breaks anything).

[bact]

I can see that it's quite a challenge for the maintainer of SPDX Java libraries to keep things secure, as there are quite a number of libraries (core, models, model-stores, library).

I support any approach that will minimise the workload of maintainer while fairly keep the overall positive results of the libraries (although may not be optimal, as I understand that some dependency update could come with a larger download size).

A good side effect of having the same versions for dependecies across SPDX Java libraries (which dependabot tend to bring) is that SPDX Java libraries can share dependencies, potentially reduce download size. (This will be less true for patch level, and more true for minor version).

[goneall]

LGTM

[goneall]

FYI: I created PR #347 which I think will check dependencies weekly.