[Snyk] Security upgrade com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.11

[malhanpraveen]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-20059179	710	com.fasterxml.jackson.core:jackson-databind: 2.13.4.2 -> 2.18.11 No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[malhanpraveen]

This upgrade from version 2.13.4.2 to 2.18.11 is a series of minor version updates. While not a major breaking change, it introduces several significant behavioral changes, new features, and internal refactorings that require careful review and testing.

Key Changes to Verify:

• @JsonIgnore Precedence (from v2.14): The handling of conflicting annotations has changed. @JsonIgnore now takes precedence over @JsonProperty, which could silently alter serialization or deserialization behavior if your code relies on the previous logic.
• StreamReadConstraints (from v2.15): New default limits have been introduced to protect against DoS attacks. These include maximums for string length, number length, and nesting depth. Previously valid large or deeply nested JSON documents may now throw exceptions.
• Property Introspection Rewrite (in v2.18): A core part of how Jackson discovers properties on POJOs and Records was rewritten. While this was done to fix long-standing bugs, such a significant internal change warrants thorough regression testing to catch any subtle behavioral differences.
• Behavioral Change (from v2.14): The JsonNode.with() and JsonNode.withArray() methods now interpret leading slashes as JSON Pointer expressions, which could affect code that uses these methods with property names containing slashes.
• Dependency Updates: If you use jackson-dataformat-yaml, be aware it now depends on SnakeYAML 2.0 (since Jackson 2.15). Similarly, the jackson-dataformat-avro module has updated its Avro dependency in version 2.18.

Recommendation:

Given the number of behavioral changes and the significant internal refactoring, a medium risk is assigned. It is crucial to perform thorough regression testing on your application's JSON serialization and deserialization logic.

Source: Jackson Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.