Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RD-9188 upgrade jackson-dataformat-yaml #21

Merged
merged 2 commits into from
Jul 11, 2023

Conversation

datYori
Copy link
Contributor

@datYori datYori commented Jul 5, 2023

The current version is causing a transitive vuln issue (check JIRA for more details)

@@ -56,18 +56,19 @@ object Dependencies {

val guava = "com.google.guava" % "guava" % "31.1-jre"

val jacksonDepsVersion = "2.14.2"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We used to place the versions separately but then Intellij stopped detecting updates. That's why we have it explicit per dependency per line instead of placing the number separately. (It's also more confusing because you updated YAML module of Jackson only.)

I think the correct solution is to leave the numbers per line, but actually update them all to 2.15.2, so that we move all of Jackson forward.

That said, this must be validated against scala2 and repose. That's because in the past, the latest Jackson version caused issues downstream in Repose. (@gkiomour might know the details.) Now they are more split, so perhaps easier. But whatever version we define here affects Repose because Jackson is part of the Snapi clients, and Repose itself depends on the clients, which then bring along all of Jackson.

@miguelbranco80 miguelbranco80 merged commit 366e9b8 into main Jul 11, 2023
@miguelbranco80 miguelbranco80 deleted the upgrade-jackson-yaml-dep branch July 11, 2023 10:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants