alexa / alexa-skills-kit-sdk-for-java

The Alexa Skills Kit SDK for Java helps you get a skill up and running quickly, letting you focus on skill logic instead of boilerplate code.
http://developer.amazon.com/ask
Apache License 2.0
817 stars 747 forks source link

fix:bump jackson version to 2.13.2 in ask-sdk-runtime #324

Closed tkm22 closed 2 years ago

tkm22 commented 2 years ago

Bumps jackson from 2.10.5 to 2.13.2 to fix the security vulnerability in https://github.com/alexa/alexa-skills-kit-sdk-for-java/pull/317

Description

Bumps jackson from 2.10.5 to 2.13.2 to fix the security vulnerability in https://github.com/alexa/alexa-skills-kit-sdk-for-java/pull/317 Also adding jackson-annotation in pom file because when bumping to latest version, the tests in ask-sdk-local-debug failed due to NoClassDefException for jackson-annotation.jsonkey. After adding this in runtime pom file, tests passed and build succeeded.

Motivation and Context

mentions here https://github.com/alexa/alexa-skills-kit-sdk-for-java/pull/317. Jackson-databind and others have vulnerability issue

Testing

mvn install build success.

Screenshots (if appropriate)

image

latest build after change on 04/29

image

Types of changes

Checklist

License