mattcasters commented on code in PR #8901:
URL: https://github.com/apache/hop/pull/8901#discussion_r4262786911
##########
pom.xml:
##########
@@ -202,6 +206,63 @@
<ui.test.argLine></ui.test.argLine>
</properties>
+ <dependencyManagement>
+ <dependencies>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-core</artifactId>
+ <version>2.21.4</version>
Review Comment:
**[bug]** These direct root `dependencyManagement` entries win over every
imported BOM. Maven records direct managed dependencies first and then fills
imports only for keys that are not already present
(`DefaultDependencyManagementImporter`), so a child `hop-libs` import cannot
override them.
`lib/pom.xml` on this commit already manages `jackson-core` and
`jackson-databind` at `${jackson.version}` **2.21.7** (annotations stay at
2.21). `hop-core` declares both artifacts with no version and imports that BOM,
so this pin downgrades the main JSON stack to jackson-core 2.21.4 and
jackson-databind 2.21.5.
That drops fixes already selected by Hop. Databind 2.21.6/2.21.7 cover
CVE-2026-68497, CVE-2026-54515, CVE-2026-77310, CVE-2026-59889, CVE-2026-19032,
CVE-2026-83557, CVE-2026-91776, and CVE-2026-91777. jackson-core 2.21.6/2.21.7
cover CVE-2026-68498 and CVE-2026-89407. It also splits versions:
`jackson-dataformat-*`, `jackson-datatype-*`, and `jackson-module-*` stay at
2.21.7 via `hop-libs`, while core and databind are forced older. Jackson's own
2.21.5 BOM pairs databind 2.21.5 with jackson-core 2.21.5, not 2.21.4.
**Suggestion:** Remove these three entries, or set them from root properties
that match `lib/pom.xml` (`jackson.version` 2.21.7 and
`jackson-annotations.version` 2.21) and use that same property in `hop-libs`. A
direct root pin will keep silently beating the BOM if the two copies drift.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
