4.0.0 vulnerable-components jar org.owasp.webgoat.lesson webgoat-lessons-parent 8.0-SNAPSHOT com.thoughtworks.xstream xstream 1.4.7 junit junit