Updating jackson-databind for CVE-2020-36518 #129
Conversation
Signed-off-by: Vacha Shah <vachshah@amazon.com>
java-client/build.gradle.kts
Outdated
| @@ -149,7 +149,7 @@ dependencies { | |||
| // Apache 2.0 | |||
|
|
|||
| implementation("com.fasterxml.jackson.core", "jackson-core", jacksonVersion) | |||
| implementation("com.fasterxml.jackson.core", "jackson-databind", jacksonVersion) | |||
| implementation("com.fasterxml.jackson.core", "jackson-databind", "2.12.6.1") | |||
There was a problem hiding this comment.
It would be better to introduce jacksonDatabindVersion so we could change jacksonVersion & jacksonDatabindVersion in lockstep if needed
There was a problem hiding this comment.
That makes sense to me. @VachaShah , WDYT?
There was a problem hiding this comment.
That sounds good! Added a commit to include jacksonDatabindVersion.
Signed-off-by: Vacha Shah <vachshah@amazon.com>
|
@reta I am not able to re-request a review from you |
I can look to see how that can work. |
@VachaShah sorry if that is what you already have in mind, but Gradle has this version catalog feature with I think we could leverage to align the dependencies between all OpenSearch ecosystem. [1] https://docs.gradle.org/current/userguide/platforms.html |
Signed-off-by: Vacha Shah vachshah@amazon.com
Description
Updating
jackson-databindto2.12.6.1for CVE-2020-36518.Issues Resolved
#121
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.