Bump com.fasterxml.jackson.core/jackson-databind to 2.17.2

[sadiqkassamali]

Bump com.fasterxml.jackson.core/jackson-databind to 2.17.2 due to v3 https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538

[deepy]

Unfortunately merging this would require dropping support for Gradle versions older than 7.6. so this is going to need to wait until the next version bump

But on the bright side, actually using this to attack your build would require very specific circumstances so while the CVE has a high severity, it's almost irrelevant here And Gradle's dependency management would allow this to be patched locally where necessary

[tkrah]

That would be really useful, see e.g. here:

https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/482

[deepy]

Ah, API issues :-/ I was hoping that our usage would be innocuous enough, but I need to take a closer look at this

[tkrah]

@deepy Do you have news about this? Anything you need support with (we could maybe provide)?

[deepy]

@tkrah there's really only two ways to fix this: A. Upgrading - which requires dropping support for older Gradle versions B. Replacing jackson - which has a poor return of investment on the time I'd need to spend on it

When Gradle 9 releases I'm perfectly happy to drop support for older versions, but not right now given the relatively low severity of the issue Although if you have a real scenario that makes a denial of service in a build an issue I'm happy to discuss and re-evaluate, beyond that I'm also open to replacing jackson

[tkrah]

@deepy It is not about the CVE which is the main issue here, it is the API issues (https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/482) which are there because of that old jackson version (2.14 was released Nov 5, 2022 ... which is kind of dated) which clashes with other plugins. Why not release a new version which drops support for those old gradle versions like other plugins do too to solve that problem - if you want to keep support for both, why not maintain 2 release lines?

[tkrah]

JFTR: With the latest Spring Boot Plugin 3.4.0 which uses 2.18.2 this is also going to be a problem because of this runtime Error:

'void com.fasterxml.jackson.core.base.GeneratorBase.<init>(int, com.fasterxml.jackson.core.ObjectCodec, com.fasterxml.jackson.core.io.IOContext)'

Seems I am going to need my own fork until this is fixed someday in the future.

Edit: Using my own fork which uses jackson 2.18.2 works fine with spring-boot-plugin 3.4.0 and cyclonedx-plugin 1.10.0.

Edit 2:

Another workaround which does fit and is much more useful because lightweight (no fork needed) is to add this constraint to the buildScript dependencies:

constraints {
        implementation("com.fasterxml.jackson.core:jackson-databind:2.18.2")
}