<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.15.2</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
<version>2.15.2</version>
</dependency>
Summary
java/pom.xmlpins Jackson at 2.15.2 which has known CVEs. A security library shipping vulnerable dependencies undermines credibility.Current
Instructions
jackson-databindandjackson-dataformat-yamlto the same latest 2.x version (currently 2.18.x)mvn compileto verify no breaking API changesmvn testif tests existFile to modify
java/pom.xml— update both version stringsVerification
mvn dependency:treeshows updated Jackson versionsmvn compilesucceeds