Banned dependencies in release 6.0.2

[Bigtuna00]

I'm trying to use release 6.0.2 as a dependency in another project. Maven complains about two banned dependencies:

[WARNING] Rule 6: org.apache.maven.plugins.enforcer.BannedDependencies failed with message:
asm:asm must not be used, use org.ow2.asm:asm instead
Found Banned Dependency: asm:asm:jar:3.3.1
Use 'mvn dependency:tree' to locate the source of the banned dependencies.
[WARNING] Rule 7: org.apache.maven.plugins.enforcer.BannedDependencies failed with message:
cglib:cglib must not be used, use cglib:cglib-nodep instead
Found Banned Dependency: cglib:cglib:jar:3.2.12
Use 'mvn dependency:tree' to locate the source of the banned dependencies.

These aren't dependencies in my project, they appear to come from

QuickBooks-V3-Java-SDK/ipp-v3-java-devkit/pom.xml

Line 35 in 623d2e4

<version>3.3.1</version>

and

QuickBooks-V3-Java-SDK/ipp-v3-java-devkit/pom.xml

Line 30 in 623d2e4

<version>3.2.12</version>

[Bigtuna00]

Added enforcer exclusions for these two and now I get:

[WARNING] Rule 0: org.apache.maven.plugins.enforcer.BannedDependencies failed with message:
javax.ws.rs:jsr311-api must not be used, use com.sun.jersey:jersey-core instead

For some reason excluding this one doesn't work...

[ddugovic]

Release 6.4.0 still contains vulnerable dependencies (over 20 CVEs) so it would be nice if Intuit could upgrade vulnerable dependencies:
https://mvnrepository.com/artifact/com.intuit.quickbooks-online/ipp-v3-java-devkit/6.4.0
https://mvnrepository.com/artifact/com.intuit.quickbooks-online/oauth2-platform-api/6.4.0