Hello Jean-Louis- This has come up in the past. Iirc, the discussion was leaning towards using json-b and then Jackson as the out-of-the-box provider.
This sounds like a good change for 5.19.x line Thanks, -Matt Pavlovich > On May 16, 2023, at 5:17 AM, Jean-Louis Monteiro <jlmonte...@tomitribe.com> > wrote: > > Hi all, > > Jackson seems to be frequently affected by CVEs and it's really a pain for > users. > > Looks like Jackson is only used in the WebConsole to read/write a few > attributes. I'm sure we can get rid of it and either use a standard API so > one can plugin any implementation, or just write down a utility class to > parse the small attribute we have to. > > thoughts? > > I'm happy to do a PR to remove it if that's the consensus. > > -- > Jean-Louis Monteiro > http://twitter.com/jlouismonteiro > http://www.tomitribe.com
