We currently depend on Eclipse 4.21.0 for the ECJ front end, which is quite old; the latest release is 4.30.0 (2023-12). Older releases also have some kind of vulnerability (though I don't think this is a huge concern for us), fixed in 4.29.0:

https://gitlab.eclipse.org/security/cve-assignement/-/issues/8

The issue with just updating is that more recent Eclipse versions require JDK 17+ to run. I don't think we want to force all of WALA to require JDK 17 to run. But perhaps there is a way to only require JDK 17 if you want to run the ECJ front end.