both contain security fixes, so would be a good idea to update. I've
prepared those in
https://github.com/georchestra/georchestra/issues/4594, light runtime
testing with tomcat 9 showed they were okay but i haven't "extensively"
tested them in various exotic configurations.