fix 2.x cve

[derek-ho]

Description

[Describe what this change achieves]

Issues Resolved

[List any issues this PR will resolve]

Check List

• [ ] New functionality includes testing.
  • [ ] All tests pass, including unit test, integration test and doctest
• [ ] New functionality has been documented.
  • [ ] New functionality has javadoc added
  • [ ] New functionality has user manual doc added
• [ ] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[penghuo]

2.x not been used.

[derek-ho]

I will request exception in advisories scan then. We should delete 2.x if not used