[
https://issues.apache.org/jira/browse/OOZIE-3650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17475229#comment-17475229
]
PJ Fanning commented on OOZIE-3650:
-----------------------------------
Is this what is expected?
{code:java}
git diff master origin/master --no-prefix
diff --git pom.xml pom.xml
index dc06f27d8..a5a9d3c8a 100644
--- pom.xml
+++ pom.xml
@@ -116,7 +116,7 @@
<derby.version>10.14.2.0</derby.version>
<xerces.version>2.11.0</xerces.version>
<curator.version>2.5.0</curator.version>
- <jackson.version>2.6.7.5</jackson.version>
+ <jackson.version>2.6.5</jackson.version>
<log4j.version>1.2.17</log4j.version>
<log4j2.version>2.17.1</log4j2.version>
<activemq.version>5.15.9</activemq.version> {code}
If it's what is expected, then I can create a new patch file (yesterday's file
was this but run without the `--no-prefix`.
> upgrade jackson - ideally to v2.13.1
> ------------------------------------
>
> Key: OOZIE-3650
> URL: https://issues.apache.org/jira/browse/OOZIE-3650
> Project: Oozie
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
> Labels: patch-available
>
> Oozie currently has a dependency on an old version of Jackson (2.6.5) -
> [https://github.com/apache/oozie/blob/master/pom.xml#L119]
> There are a number of CVEs open affecting this version.
> https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.6.5
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
