search

eirslett / frontend-maven-plugin

"Maven-node-grunt-gulp-npm-node-plugin to end all maven-node-grunt-gulp-npm-plugins." A Maven plugin that downloads/installs Node and NPM locally, runs NPM install, Grunt, Gulp and/or Karma.
Apache License 2.0
4.23k stars 867 forks source link

Update Jackson dependency #944

Closed achimmihca closed 3 years ago

achimmihca commented 3 years ago

Do you want to request a feature or report a bug?

Request a feature (kind of)

What is the current behavior?

The pom.xml of frontend-plugin-core contains

        <dependency>
            <groupId>org.codehaus.jackson</groupId>
            <artifactId>jackson-mapper-asl</artifactId>
            <version>1.9.13</version>
        </dependency>

        <dependency>
            <groupId>org.codehaus.jackson</groupId>
            <artifactId>jackson-core-asl</artifactId>
            <version>1.9.13</version>
        </dependency>

These are very old versions of Jackson (see StackOverflow).

Because this plugin pulls these old dependencies, my IDE shows autocomplete suggestions for Jackson-annotations twice: the old versions from codehaus and the new ones from fasterxml.

Furthermore, #863 says that these old Jackson dependencies contain security issues.

What is the expected behavior?

Would be nice if the frontend-maven-plugin uses current version of Jackson2. You can search the available projects via mvnrepository

Please mention your frontend-maven-plugin and operating system version.

frontend-maven-plugin: 1.10 OS: does not matter