Update quartz scheduler version to resolve cve

build.sbt

@@ -816,4 +816,7 @@ lazy val `hmda-quarterly-data-service` = (project in file ("hmda-quarterly-data-
     packageSettings
   )
   .dependsOn(common % "compile->compile;test->test")
-  .dependsOn(`hmda-protocol` % "compile->compile;test->test")
+  .dependsOn(`hmda-protocol` % "compile->compile;test->test")
+
+libraryDependencies += "org.quartz-scheduler" % "quartz" % "2.5.0-rc1"
+dependencyOverrides in ThisBuild += "org.quartz-scheduler" % "quartz" % "2.5.0-rc1"

project/Dependencies.scala

@@ -83,6 +83,7 @@ object Dependencies {
   lazy val scalacheckShapeless   = "com.github.alexarchambault" %% "scalacheck-shapeless_1.14"  % Version.scalacheckShapeless % Test
   lazy val diffx                 = "com.softwaremill.diffx"     %% "diffx-core"                 % Version.diffx % Test
   lazy val kubernetesApi         = "io.kubernetes"              % "client-java"                 % Version.kubernetesApi
+  lazy val quartzScheduler       = "org.quartz-scheduler"       % "quartz"                      % Version.quartzScheduler
 
   // overriding the log4j-slf4j bridge used by spring, transitively brought in by s3mock
   // this is needed because of CVE-2021-44228 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

project/Version.scala

@@ -42,4 +42,5 @@ object Version {
   val log4j                  = "2.15.0"
   val kubernetesApi          = "21.0.0-legacy"
   val testContainers         = "1.19.8"
+  val quartzScheduler        = "2.5.0-rc1"
 }