[ https://issues.apache.org/jira/browse/OOZIE-3650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17478652#comment-17478652 ]
Andras Salamon commented on OOZIE-3650: --------------------------------------- Spotbugs give us false errors, I think we can ignore that. I tried to compile Oozie with this patch, but it failed because it was not able to download jackson-annotations:jar:2.6.7.5 and jackson-core:jar:2.6.7.5. And those versions are really not available: * [https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core] * [https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations] * [https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind] Only jackson-databind has version 2.6.7.5 the others have only version 2.6.7 In the pom.xml we try to use the same version everywhere: {noformat} <dependency> <groupId>com.fasterxml.jackson.module</groupId> <artifactId>jackson-module-scala_${spark.scala.binary.version}</artifactId> <version>${jackson.version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-annotations</artifactId> <version>${jackson.version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>${jackson.version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>${jackson.version}</version> </dependency> {noformat} I think we need two versions here, one for jackson in general (2.6.7) and one for the jackson-databing (2.6.7.5). I don't really understand how is it possible that compilation was working in pre-commit and also for you. > upgrade jackson - ideally to v2.13.1 > ------------------------------------ > > Key: OOZIE-3650 > URL: https://issues.apache.org/jira/browse/OOZIE-3650 > Project: Oozie > Issue Type: Improvement > Reporter: PJ Fanning > Priority: Major > Labels: patch-available > Attachments: OOZIE-3650-003.patch, OOZIE-3650-004.patch > > > Oozie currently has a dependency on an old version of Jackson (2.6.5) - > [https://github.com/apache/oozie/blob/master/pom.xml#L119] > There are a number of CVEs open affecting this version. > https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.6.5 -- This message was sent by Atlassian Jira (v8.20.1#820001)