Keep jackson-databind in alignment with OpenSearch #1817
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
While addressing CVE-2020-36518 the security team updated to the latest minor version of jackson-databind, whereas the OpenSearch team took the CVE specific update. Aligning with OpenSearch's version. Signed-off-by: Peter Nied <[email protected]>
DarshitChanpura
approved these changes
May 2, 2022
Codecov Report
@@ Coverage Diff @@
## 1.3 #1817 +/- ##
============================================
+ Coverage 64.64% 64.67% +0.03%
- Complexity 3219 3221 +2
============================================
Files 247 247
Lines 17363 17363
Branches 3086 3086
============================================
+ Hits 11224 11230 +6
+ Misses 4590 4587 -3
+ Partials 1549 1546 -3
Continue to review full report at Codecov.
|
davidlago
approved these changes
May 2, 2022
cliu123
reviewed
May 2, 2022
| @@ -81,7 +81,7 @@ dependencies { | |||
| implementation 'org.greenrobot:eventbus:3.2.0' | |||
| implementation 'commons-cli:commons-cli:1.3.1' | |||
| implementation 'org.bouncycastle:bcprov-jdk15on:1.67' | |||
| implementation 'com.fasterxml.jackson.core:jackson-databind:2.13.2.1' | |||
| implementation 'com.fasterxml.jackson.core:jackson-databind:2.12.6.1' | |||
There was a problem hiding this comment.
Can jackson dependency be removed from security plugin given that it's been added in OpenSearch core?
There was a problem hiding this comment.
I've created #1816 for follow up so we can avoid these kinds of problems in the future
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
While addressing CVE-2020-36518 the security team updated to the latest
minor version of jackson-databind, whereas the OpenSearch team took the
CVE specific update. Aligning with OpenSearch's version.
Issues Resolved
Check List
New functionality includes testingNew functionality has been documentedBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.