Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jackson dependency update #199

Open
gsvdutra opened this issue May 5, 2023 · 1 comment
Open

Jackson dependency update #199

gsvdutra opened this issue May 5, 2023 · 1 comment

Comments

@gsvdutra
Copy link

gsvdutra commented May 5, 2023

The Jackson package causes reliability issues because of a vulnerability.

The version 2.14.2 is vulnerable to Denial of Service (DoS).

This can be fixed by updating the library to 2.15.0

https://security.snyk.io/package/maven/com.fasterxml.jackson.core:jackson-databind

@ned13
Copy link

ned13 commented Jan 2, 2025

I encountered the Jackson package issue which is too old. My case is I am trying akka to use vavr data structure in akka's entity state. issue comes from serialization. I managed to resolve it by creating my own snapshot version with updated Jackson package to 2.17.3 and all test PASSED.

Since there are vulnerabilities in existing version 2.7.2 and I saw the version is upgraded in version/1.x branch. according the newest post in vavr discussion. It seems the main branch should have upgraded version of Jackson. Is there anything we can help for new release of 0.X version?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants