clj-kitchensink imports a vulnerable version of ini4j.
See https://security.snyk.io/vuln/SNYK-JAVA-ORGINI4J-3042998
It should be updated, promoted, and updated in clj-parent.