Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DS-3795] Update jackson-databind due to known vulnerabilities. #2032

Merged
merged 3 commits into from May 9, 2018
Merged

[DS-3795] Update jackson-databind due to known vulnerabilities. #2032

merged 3 commits into from May 9, 2018

Conversation

mwoodiupui
Copy link
Member

@mwoodiupui mwoodiupui added bug work in progress PR is still being worked on & is not currently ready for review labels Apr 23, 2018
@mwoodiupui mwoodiupui added this to the 7.0 milestone Apr 23, 2018
hardyoyo
hardyoyo approved these changes Apr 23, 2018
View reviewed changes
Copy link
Member

@hardyoyo hardyoyo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, and it passes tests.

tdonohue
tdonohue reviewed Apr 23, 2018
View reviewed changes
pom.xml
@@ -1512,7 +1512,7 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
<version>2.8.11.1</version> <!-- TODO sync. with jackson.version -->
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before merging, this TODO needs cleaning up (I'm assuming that's why this is still flagged as a WIP). Currently we seem to have two versions of jackson (2.8.11 in jackson.version and 2.8.11.1 here). It'd be nice to get this set in one place and inherited everywhere else.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, the TODO is for later, when it is possible to sync. them. There is no jackson-core or jackson-annotations 2.8.11.1, but jackson-databind 2.8.11 still has the bug.

It's WIP because I'm still looking into fixing some of the remaining Snyk complaints. Sorry, should have said so. If I have nothing to add today, I'll remove WIP.

@mwoodiupui mwoodiupui removed the work in progress PR is still being worked on & is not currently ready for review label Apr 26, 2018
@mwoodiupui
Copy link
Member Author

Rebased on today's master. Locally, all automated tests still pass.

@mwoodiupui mwoodiupui mentioned this pull request May 8, 2018
Merged
terrywbrady
terrywbrady approved these changes May 8, 2018
View reviewed changes
Copy link
Contributor

@terrywbrady terrywbrady left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested legacy rest with these changes. Works as expected.

kshepherd
kshepherd approved these changes May 9, 2018
View reviewed changes
Copy link
Member

@kshepherd kshepherd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also tested legacy rest with JSON and XML responses successfully. +1, let's merge!

@kshepherd kshepherd merged commit 8c9e6af into DSpace:master May 9, 2018
@mwoodiupui mwoodiupui deleted the DS-3795 branch May 11, 2018 14:53
@tdonohue tdonohue mentioned this pull request Jun 18, 2018
Merged
@tdonohue tdonohue modified the milestones: 7.0, 7.0preview Jan 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tdonohue tdonohue tdonohue left review comments

@kshepherd kshepherd kshepherd approved these changes

@hardyoyo hardyoyo hardyoyo approved these changes

@terrywbrady terrywbrady terrywbrady approved these changes

Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
7.0preview
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@mwoodiupui @kshepherd @tdonohue @hardyoyo @terrywbrady