You are viewing a plain text version of this content. The canonical link for it is here.

Posted to github@arrow.apache.org by GitBox <gi...@apache.org> on 2022/04/18 17:06:47 UTC

[GitHub] [arrow] davisusanibar commented on a diff in pull request #12912: ARROW-16143: [Java] Upgrade jackson dependencies CVE-2020-36518

davisusanibar commented on code in PR #12912:
URL: https://github.com/apache/arrow/pull/12912#discussion_r852263028


##########
java/adapter/jdbc/pom.xml:
##########
@@ -61,28 +61,24 @@
         <dependency>
             <groupId>com.fasterxml.jackson.dataformat</groupId>
             <artifactId>jackson-dataformat-yaml</artifactId>

Review Comment:
   
   Jackson BOM define dependency and version used for: core, data format, data types, and an others. For that reason modules only need to add the dependency and the `version` is injected by the jackson bom. In this case jackson-bom add this version for [jackson-dataformat-yaml](https://github.com/FasterXML/jackson-bom/blob/jackson-bom-2.13.2.20220328/pom.xml#L142:L145).



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org