[GitHub] [jackrabbit-oak] fabriziofortino opened a new pull request, #712: OAK-9947: upgrade jackson (including databind) to 2.13.4

[GitBox <gi...@apache.org>]

fabriziofortino opened a new pull request, #712:
URL: https://github.com/apache/jackrabbit-oak/pull/712

   The original goal of this task was to upgrade jackson-databind since versions before 2.13.0 are affected by [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518).
   
   After upgrading to 2.13.4 some tests in `oak-segment-aws` were not working (hung indefinitely). `aws-java-sdk-s3` uses a least recent version of jackson and it does not work with the latest.
   
   In general, jackson should not be in the parent pom dependencies otherwise the libraries with transitive dependencies will be forced to use it (and in some cases, it would not work). The parent pom now contains the `jackson.version` only. Submodules are required to reference it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@jackrabbit.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [jackrabbit-oak] fabriziofortino merged pull request #712: OAK-9947: upgrade jackson (including databind) to 2.13.4

[GitBox <gi...@apache.org>]

fabriziofortino merged PR #712:
URL: https://github.com/apache/jackrabbit-oak/pull/712


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@jackrabbit.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org