Bump jackson-bom to 2.13.4.20221013 (upgrade to jackson-databind 2.13.4.2) #4618
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Malax
force-pushed
the
malax/bump-jackson
branch
from
ea450cf
to
28020d3
Compare
Signed-off-by: Manuel Fuchs <manuel.fuchs@salesforce.com>
Malax
force-pushed
the
malax/bump-jackson
branch
from
28020d3
to
7576f84
Compare
Malax
changed the title
mrniko
requested changes
Nov 3, 2022
| @@ -182,7 +182,7 @@ | |||
| <dependency> | |||
| <groupId>com.fasterxml.jackson</groupId> | |||
| <artifactId>jackson-bom</artifactId> | |||
| <version>2.13.4</version> | |||
| <version>2.13.4.20221013</version> | |||
There was a problem hiding this comment.
I guess version should be 2.13.4.2
There was a problem hiding this comment.
I don't see 2.13.4.2 for jackson-bom here: https://search.maven.org/artifact/com.fasterxml.jackson/jackson-bom. What am I missing?
There was a problem hiding this comment.
As explained in FasterXML/jackson-databind#3590
"2.13.4.2 micro-patch (jackson-bom 2.13.4.20221013). (NOTE: 2.13.4.1/2.13.4.20221012 have an issue that affects Gradle users)"
mrniko
approved these changes
Nov 7, 2022
|
Thank you for contribution! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is CVE-2022-42003 for
jackson-databind2.13.4, which is fixed in the next point release2.13.4.1.I didn't check if redisson is actually vulnerable. But bumping the dependency to an unaffected version will at least silence any vulnerability scanners when redisson is used.