Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Jackson 2.12.6 compatibility with Spring Boot 2.4.13 #29569

Closed
meier-th opened this issue Jan 26, 2022 · 3 comments
Closed

Jackson 2.12.6 compatibility with Spring Boot 2.4.13 #29569

meier-th opened this issue Jan 26, 2022 · 3 comments
Labels
status: declined A suggestion or change that we don't feel we should currently apply

Comments

@meier-th
Copy link

A vulnerability (WS-2021-0616) was discovered in jackson library. It is fixed in versions 2.12.6 and 2.13.1.
Spring Boot 2.4.13 comes with jackson 2.11.4. The fixed version seems to be a different major version. Therefore, the compatibility is unclear.
Requesting you to clarify if Spring Boot 2.4.13 is compatible with jackson 2.12.6
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jan 26, 2022
@snicoll
Copy link
Member

snicoll commented Jan 26, 2022 •
edited
Loading

Spring Boot 2.4.x is out of OSS support so please upgrade at your earliest convenience to a supported version.

@snicoll snicoll closed this as completed Jan 26, 2022
@snicoll snicoll added status: declined A suggestion or change that we don't feel we should currently apply and removed status: waiting-for-triage An issue we've not yet triaged labels Jan 26, 2022
@bclozel
Copy link
Member

bclozel commented Jan 26, 2022

I don't think Spring Boot 2.4.x will be binary compatible with Jackson 2.12. You can see the changes made in Spring Boot 2.5.0 (see #24415) to adapt to the Jackson changes. We've made sure that Spring Boot 2.5.x works with previous Jackson versions, but I don't think the other way around can work.

Note that Spring Boot 2.4.x is out of OSS support, so this might be a good idea to upgrade anyway.

@meier-th meier-th mentioned this issue Jan 26, 2022
Open
@meier-th
Copy link
Author

@bclozel , thank you for the clarification!

@cyber-barrista cyber-barrista mentioned this issue Jan 27, 2022
Closed
@bclozel bclozel mentioned this issue Mar 14, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
status: declined A suggestion or change that we don't feel we should currently apply
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@bclozel @snicoll @spring-projects-issues @meier-th