Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-31455

Use jackson bom for jackson dependencies

    XMLWordPrintable

    Details

    • Release Notes Summary:
      Jackson BOM is now imported in the Maven dependency graph.
    • Release Notes Description:
      Hide

      Addons declaring jackson artefacts in their dependencies managment section can remove them as the jackson-bom is now imported in the Maven dependency graph of Nuxeo Platform.
      This will ease the security upgrade of Jackson artefacts for all Nuxeo artefacts.

      Show
      Addons declaring jackson artefacts in their dependencies managment section can remove them as the jackson-bom is now imported in the Maven dependency graph of Nuxeo Platform. This will ease the security upgrade of Jackson artefacts for all Nuxeo artefacts.
    • Tags:
    • Team:
      PLATFORM
    • Sprint:
      nxplatform #75
    • Story Points:
      1

      Description

      We would like to use jackson-bom dependencies for our jackson dependencies in order to have all possible jackson artefacts declared in the Maven dependency graph.

      Furthermore, the BOM is released with a date based version when a micro-patch is released, like jackson-databind 2.12.7.1 which fixes some CVE, see https://github.com/FasterXML/jackson-bom/blob/jackson-bom-2.12.7.20221012/pom.xml. This will help security upgrades with help of dependabot.

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: