The list of CVE vulnerabilities has been steadily increasing in both 3rd party deps and even some org.jboss.tools plugins since Jan 2017.

Is it time to do something about this, or should we just keep logging the volume of problems?

https://dev-platform-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/view/Devstudio/view/jbosstools-releng/job/devstudio.cve.report/lastBuild/dependency-check-jenkins-pluginResult/ - 2658 warnings

https://dev-platform-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/view/Devstudio/view/jbosstools-releng/job/devstudio.cve.report-merged/lastBuild/dependency-check-jenkins-pluginResult/ - 1508 warnings