Upgrade vulnerable dependencies

[vinamartin]

What does this PR do?

Upgrade various vulnerable dependencies.
Would prefer the changes from: #6864, so I am happy to wait on that PR instead.

Who is reviewing it?

@jrnorth @clockard @ahoffer @lavoywj @alexabird

How should this be tested?

Ensure things don't break. ✨

Notes on Review Process

Please see Notes on Review Process for further guidance on requirements for merging and abbreviated reviews.

Review Comment Legend:

• ✏️ (Pencil) This comment is a nitpick or style suggestion, no action required for approval. This comment should provide a suggestion either as an in line code snippet or a gist.
• ❓ (Question Mark) This comment is to gain a clearer understanding of design or code choices, clarification is required but action may not be necessary for approval.
• ❗ (Exclamation Mark) This comment is critical and requires clarification or action before approval.

[clockard]

build now

[cxddfbot]

Internal build has been started, your results will be available at build completion.

[cxddfbot]

Build SUCCESS See the job results in legacy Jenkins UI or in Blue Ocean UI.