Upgrade jackson-core to 2.15.0 to resolve vulnerability #1234
Conversation
…pendency management's constraint on pullin gin 2.13.5
| @@ -110,7 +110,8 @@ allprojects { | |||
| dependencies { | |||
| implementation "com.google.guava:guava:32.1.2-jre" | |||
| implementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.0' | |||
|
|
|||
| // jackson-core is a transitive dep coming from jackson-dataformat-yaml, earlier versions have vulnerability sonatype-2022-6438 | |||
| implementation('com.fasterxml.jackson.core:jackson-core:2.15.0') | |||
There was a problem hiding this comment.
We have to add it as a direct dependency here in order to override a version constraint coming from a global dependency management configuration. I believe this constraint is coming from the following entry in our build files:
apply plugin: 'io.spring.dependency-management'
Because I see the following in the debug logs for when gradle attempts to resolve Jackson-core version:
2024-09-11T13:02:25.147-0600 [DEBUG] [io.spring.gradle.dependencymanagement.internal.VersionConfiguringAction] Processing dependency 'com.fasterxml.jackson.core:jackson-core:2.14.0'
2024-09-11T13:02:25.147-0600 [DEBUG] [io.spring.gradle.dependencymanagement.internal.DependencyManagementContainer] Found managed version '2.13.5' for dependency 'com.fasterxml.jackson.core:jackson-core' in global dependency management
2024-09-11T13:02:25.147-0600 [DEBUG] [io.spring.gradle.dependencymanagement.internal.VersionConfiguringAction] Using version '2.13.5' for dependency 'com.fasterxml.jackson.core:jackson-core:2.14.0'
There was a problem hiding this comment.
I suppose just adding a direct dependency is sufficient and we don't need to exclude the transitive too from io.spring.dependency-management in addition to it?
There was a problem hiding this comment.
Correct, I see all other versions of Jackson-core be corrected to --> 2.15.0 in the dependency tree. Other attempts always resulted in 2.13.5 winning (which I believe is coming from spring dependency management). I have also confirmed that in the Detect JAR built from the branch, only version 2.15.0 is present.
There was a problem hiding this comment.
I see, thanks for explaining
shantyk
requested review from
gopannabd,
dterrybd,
niravrsynopsys,
devmehtabd and
andrian-sevastyanov
Resolves vulnerability reported in IDETECT-4459: FasterXML/jackson-core#827