Skip to content

Update Jackson dependency to current version #6

Description

@thatsjet

Summary

java/pom.xml pins Jackson at 2.15.2 which has known CVEs. A security library shipping vulnerable dependencies undermines credibility.

Current

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.15.2</version>
</dependency>
<dependency>
    <groupId>com.fasterxml.jackson.dataformat</groupId>
    <artifactId>jackson-dataformat-yaml</artifactId>
    <version>2.15.2</version>
</dependency>

Instructions

  1. Check the latest stable Jackson version at https://github.com/FasterXML/jackson/wiki/Jackson-Releases
  2. Update both jackson-databind and jackson-dataformat-yaml to the same latest 2.x version (currently 2.18.x)
  3. Run mvn compile to verify no breaking API changes
  4. Run mvn test if tests exist

File to modify

  • java/pom.xml — update both version strings

Verification

  • mvn dependency:tree shows updated Jackson versions
  • mvn compile succeeds
  • No deprecation warnings from Jackson API usage

Metadata

Metadata

Assignees

No one assigned

    Labels

    P1Important — should be in first releasesecuritySecurity-related changes

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions