Skip to content

GH-3693: Bump Jackson to 2.21.8 - #3940

Open
adoroszlai wants to merge 1 commit into
apache:parquet-1.17.xfrom
adoroszlai:jackson-2.21.8
Open

adoroszlai wants to merge 1 commit into
apache:parquet-1.17.xfrom
adoroszlai:jackson-2.21.8

Conversation

@adoroszlai

Copy link
Copy Markdown

Rationale for this change

Parquet 1.17.1 includes Jackson 2.21.3, which has several CVEs.

What changes are included in this PR?

Bump Jackson to 2.21.8, the latest in 2.21 release line.

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.8

Are these changes tested?

Dependency tree:

[INFO] --- dependency:3.7.1:tree (default-cli) @ parquet-jackson ---
[INFO] org.apache.parquet:parquet-jackson:jar:1.17.2-SNAPSHOT
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.21.8:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.21.8:compile
...

CI build/test:
https://github.com/adoroszlai/parquet-java/actions/runs/42890817488

Are there any user-facing changes?

No user-facing changes.

Closes #3693.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant