fabriziofortino opened a new pull request, #712: URL: https://github.com/apache/jackrabbit-oak/pull/712
The original goal of this task was to upgrade jackson-databind since versions before 2.13.0 are affected by [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518). After upgrading to 2.13.4 some tests in `oak-segment-aws` were not working (hung indefinitely). `aws-java-sdk-s3` uses a least recent version of jackson and it does not work with the latest. In general, jackson should not be in the parent pom dependencies otherwise the libraries with transitive dependencies will be forced to use it (and in some cases, it would not work). The parent pom now contains the `jackson.version` only. Submodules are required to reference it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@jackrabbit.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
