icu not affected

openjfx no-dsa (no specific information provided, but low CVSS score in Oracle advisory)
libraw no-dsa
remaining libvorbis issues postponed
obs-build no-dsa
libkohana2-php ignored
add and take libvorbis to dsa-needed