Ensure all Jenkins jobs are working fine for the VFC repositories that are part of Jakarta release, 

Update the vulnerable direct dependencies in their code base following the recommendations of SECCOM documented in https://wiki.onap.org/display/SV/London+VFC

Identify resource or technical constraints to SECCOM by (M2).

Submit a LF Ticket for access to the Security Vulnerabilities space (if needed).

Execute packages upgrades accordingly.

Update statuses in the restricted Wiki (link above).

For the agreed resource or technical constraints provide waiver status with declaration on when it is planned to be solved.