Migrate to SnakeYAML Engine

[manusa]

Description

Supersedes closes #4753

Migrate from SnakeYAML to SnakeYAML Engine

Originally posted by @asomov in #4753

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change
• Chore (non-breaking change which doesn't affect codebase;
  test, version modification, documentation, etc.)

Checklist

• Code contributed by me aligns with current project license: Apache 2.0
• I Added CHANGELOG entry regarding this change
• I have implemented unit tests to cover my changes
• I have added/updated the javadocs and other documentation accordingly
• No new bugs, code smells, etc. in SonarCloud report
• I tested my code in Kubernetes
• I tested my code in OpenShift

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

100.0% Coverage
0.0% Duplication

[asomov]

@manusa do you expect anything from me or you can continue ?

[manusa]

@manusa do you expect anything from me or you can continue ?

Hi @asomov,

I created a new PR because I couldn't push to your branch, the CI failures are unrelated to these changes. I'll merge once they're green.

Thanks a lot for these changes 🙌

[asomov]

@manusa can you please clarify why a dependency to SnakeYAML was added back ? I removed it to use the SnakeYAML Engine

[manusa]

The dependency is only added for the Karaf Bundle.

Jackson Dataformat YAML has a transitive dependency to SnakeYAML (2.14.2 -> 1.33). Karaf requires to add the bundle to the container in order to be able to run the test application.

So yes, our internal usage of SnakeYAML has now shifted to SnakeYAML Engine thanks to your changes. However, I guess Jackson is still using the regular SnakeYAML.

I'm also assuming that Jackson does a responsible use of SnakeYAML internally.

[asomov]

@manusa thank you for the clarification.

I'm also assuming that Jackson does a responsible use of SnakeYAML internally.

correct assumption (but the quasi-security tooling still creates a false positive for Jackson)

Jackson already migrated to SnakewYAML Engine in version 3.0

[manusa]

Jackson already migrated to SnakewYAML Engine in version 3.0

I guess someone had something to do with that :) FasterXML/jackson-dataformats-text#106

Looking forward for the 3.0 release