Open hkorpi opened 4 years ago
Wow, that's an old dependency. As a workaround, you can add an explicit dependency on jackson-databind
and I think it should work.
[com.fasterxml.jackson.core/jackson-databind "2.9.9"]
The version of jackson-databind should always be the same as the version of jackson-core; otherwise you will have problems.
I'm not super-eager to add dependency version overrides to compojure-api – it's better to upgrade libraries deeper in the dependency tree and wait until the upgrades bubble up to compojure-api – but it will take a while.
What happens if I exclude metosin/scjsv like:
[metosin/compojure-api "1.1.13" :exclusions [metosin/scjsv]]
?
... seems to at least break my test:
https://github.com/solita/livijuku/blob/develop/juku-backend/test/clj/juku/service/swagger_test.clj
Is that library metosin/scjsv
only used for testing?
So can I exclude it from normal dependencies and include it in dev dependencies?
Yeah, I think that should work. scjsv is only needed for the compojure.api.validator
namespace so as long as you use that only in tests, it should be fine.
Seems to work and my uberjar is also 5Mb thinner, thanks
Library Version(s)
metosin/compojure-api "1.1.13"
Problem
Compojure api seem to have an old transitive dependency:
[com.fasterxml.jackson.core/jackson-databind "2.2.3"]
lein nvd check
complains vulnerabilities: CVE-2018-14721, CVE-2018-14720, CVE-2018-14719, CVE-2017-7525, CVE-2018-19360, CVE-20...Dependency tree: