playframework
jackson-core, jackson-databind 2.17.1 (was 2.14.3)
About this PR
📦 Updates
from 2.14.3 to 2.17.1
Usage
✅ Please merge!
I'll automatically update this PR to resolve conflicts as long as you don't change it yourself.
If you'd like to skip this version, you can just close this PR. If you have any feedback, just mention me in the comments below.
Configure Scala Steward for your repository with a .scala-steward.conf file.
Have a fantastic day writing Scala!
🔍 Files still referring to the old version number
The following files still refer to the old version number (2.14.3). You might want to review and update them manually.
build.sbt
⚙ Adjust future updates
Add this to your .scala-steward.conf file to ignore future updates of this dependency:
updates.ignore = [ { groupId = "com.fasterxml.jackson.core" } ]
Or, add this to slow down future updates of this dependency:
dependencyOverrides = [{
pullRequests = { frequency = "30 days" },
dependency = { groupId = "com.fasterxml.jackson.core" }
}]
https://github.com/playframework/play-json/pull/999 contains code to set the stream-read-constraints in Jackson and fixes the test issue by setting the Jackson max number size to unlimited. Play-JSON has its own check for number length so doesn't need Jackson to do it too. JSON Number parsing is something that can be exploited if users allow untrusted JSON inputs to be parsed.
See https://github.com/apache/pekko/pull/564 for the Pekko change to support the stream-read-constraints.
