Skip to content

Commit

Permalink
apiclient: Bump Jackson version to 2.10.4
Browse files Browse the repository at this point in the history
Jackson 2.9.x has various vulnerabilities that are fixed in 2.10 series:

FasterXML/jackson-databind#2700 (comment)

Let's update to the latest version of Jackson. This is a similar fix to
Github's Dependabot proposal, except we bump the version number across
all Jackson components:

#116
  • Loading branch information
penberg committed Jul 14, 2020
1 parent 5820992 commit 15eb6ad
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions scylla-apiclient/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
<properties>
<maven.compiler.target>1.8</maven.compiler.target>
<maven.compiler.source>1.8</maven.compiler.source>
<jackson.version>2.10.4</jackson.version>
</properties>

<dependencies>
Expand Down Expand Up @@ -63,17 +64,17 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>2.9.9</version>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.9.10.4</version>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.jaxrs</groupId>
<artifactId>jackson-jaxrs-json-provider</artifactId>
<version>2.9.9</version>
<version>${jackson.version}</version>
</dependency>
</dependencies>

Expand Down

0 comments on commit 15eb6ad

Please sign in to comment.