Update build.gradle - Update com.fasterxml.jackson.core dependencies to version 2.22(.1)#1712
Update build.gradle - Update com.fasterxml.jackson.core dependencies to version 2.22(.1)#1712github-pawo wants to merge 1 commit into
Conversation
…to version 2.22(.1) This will fix 10 vulnerabilities of jackson-databind in version 2.21.2 More: https://guide.sonatype.com/component/maven/com.fasterxml.jackson.core:jackson-databind/2.21.2/vulnerabilities
📝 WalkthroughWalkthroughJackson dependency versions are updated in the root Gradle configuration: annotations to 2.22, and core and databind to 2.22.1. ChangesJackson dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@build.gradle`:
- Around line 52-54: Update the jackson-datatype-jsr310 dependency declaration
to version 2.22.1, matching the jackson-core and jackson-databind versions while
preserving the existing dependency configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d7b08913-e272-4874-8d25-c3257fadbda3
📒 Files selected for processing (1)
build.gradle
| api 'com.fasterxml.jackson.core:jackson-annotations:2.22' | ||
| api 'com.fasterxml.jackson.core:jackson-core:2.22.1' | ||
| api 'com.fasterxml.jackson.core:jackson-databind:2.22.1' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the relevant dependency declarations in build.gradle
grep -nE "jackson-(annotations|core|databind|datatype-jsr310)" build.gradle || true
echo
echo "Context around the jackson-datatype-jsr310 declaration:"
sed -n '235,260p' build.gradle
echo
echo "Context around the Jackson core/databind declarations:"
sed -n '45,60p' build.gradleRepository: minio/minio-java
Length of output: 2081
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Look for any Jackson BOM, version constraints, or forced resolution rules
rg -n --hidden --glob '!*.git/*' \
-e "jackson-bom" \
-e "platform\\(" \
-e "enforcedPlatform\\(" \
-e "resolutionStrategy" \
-e "force 'com\\.fasterxml\\.jackson" \
-e "com\\.fasterxml\\.jackson" \
build.gradle settings.gradle gradle.properties . || true
echo
echo "Files containing jackson references:"
git ls-files | rg '(^|/)build\.gradle$|(^|/)settings\.gradle$|(^|/)gradle\.properties$|jackson|gradle/libs\.versions\.toml'Repository: minio/minio-java
Length of output: 11252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the full dependency blocks that mention Jackson
awk '
BEGIN { show=0; n=0 }
/dependencies \{/ { n++; if (n<=3) {show=1; print "\n=== dependencies block " n " starts at line " NR " ===" } }
show { print NR ":" $0 }
/^\s*\}/ { if (show) { print "=== block ends at line " NR " ==="; show=0 } }
' build.gradle | sed -n '1,220p'
echo
echo "Search for resolution/constraint/substitution logic involving Jackson:"
rg -n -C 3 \
"resolutionStrategy|constraints \{|force |dependencySubstitution|platform\(|enforcedPlatform\(|jackson-datatype-jsr310|jackson-annotations|jackson-core|jackson-databind" \
build.gradle settings.gradle || trueRepository: minio/minio-java
Length of output: 2580
Align the Jackson module versions. build.gradle:249 still pins jackson-datatype-jsr310 to 2.21.2 while the other Jackson artifacts are on 2.22.1; keep the modules on the same release line to avoid runtime compatibility issues.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@build.gradle` around lines 52 - 54, Update the jackson-datatype-jsr310
dependency declaration to version 2.22.1, matching the jackson-core and
jackson-databind versions while preserving the existing dependency
configuration.
|
already taken care in PR #1709 |
Checked PR #1709 Thank you in advance. |
Yes, sure. |
2 participants
This will fix 10 vulnerabilities of jackson-databind in version 2.21.2 More: https://guide.sonatype.com/component/maven/com.fasterxml.jackson.core:jackson-databind/2.21.2/vulnerabilities
Summary by CodeRabbit