Override Jackson Databind dependency to 2.9.9

akka · Jun 27, 2019 · bf4c399 · bf4c399
1 parent 4d8463a
commit bf4c399
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/project/Dependencies.scala b/project/Dependencies.scala
@@ -169,6 +169,8 @@ object Dependencies {
           .map("org.apache.geode" % _ % GeodeVersion exclude ("org.slf4j", "slf4j-log4j12")) ++
         Seq(
           "com.chuusai" %% "shapeless" % "2.3.3",
+          // overriding version from geode to avoid some security vulnerabilities
+          "com.fasterxml.jackson.core" % "jackson-databind" % "2.9.9",
           "org.slf4j" % "log4j-over-slf4j" % slf4jVersion % Test // MIT like: http://www.slf4j.org/license.html
         )
     )
@@ -265,7 +267,9 @@ object Dependencies {
   val JsonStreaming = Seq(
     libraryDependencies ++= Seq(
         "com.github.jsurfer" % "jsurfer" % "1.4.3", // MIT,
-        "com.github.jsurfer" % "jsurfer-jackson" % "1.4.3" // MIT
+        "com.github.jsurfer" % "jsurfer-jackson" % "1.4.3", // MIT
+        // overriding version from jsurfer-jackson to avoid some security vulnerabilities
+        "com.fasterxml.jackson.core" % "jackson-databind" % "2.9.9"
       )
   )