search

opendatalab-de / geojson-jackson

GeoJson POJOs for Jackson - serialize and deserialize objects with ease
http://blog.opendatalab.de
Apache License 2.0
266 stars 95 forks source link

Dependency on a vulnerable version of jackson-databind #64

Open sergeykad opened 1 year ago

sergeykad commented 1 year ago

The project uses Jackson version 2.10.0. This version of jackson-databind has the following security vulnerabilities:

TimQuist commented 9 months ago

It was blocking my spring-boot upgrade. I tried to open a PR but no permissions.

I've created a fork and fixed it there. File is not on maven-central, so you'll have to include it yourself: https://github.com/42BV/geojson-jackson

@grundid If you give me permissions to push to a branch I'll open up a PR here too.