Update jackson to 2.15.3 which doesn't have known vulnerabilities #4189
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Attempt to fix #4162
5bb9b05 to
bc6c3f6
Compare
|
Agreed, let's drop Gradle 6 support.
Let's just make sure the supported Gradle versions get documented in the docs and 2.1 release notes? |
adam-enko
approved these changes
Aug 6, 2025
vmishenev
approved these changes
Aug 8, 2025
|
Does it mean that we do not support the KGP 1.9.0–1.9.10? |
Nope, we still support them. In this PR, we only stop supporting Gradle 6.x. While we do test only 7.6.3, as 7.6.x is the latest still supported Gradle 7.x release, it might even work on some earlier 7.x Gradle versions. Regarding KGP support:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #4162
Fixes #3194
Fixes #2572
Fixes #3657
Jackson 2.15.3 doesn't have known vulnerabilities (at the time this PR was created) and works fine for projects with Gradle 7.6.3+. Transitively from
jackson-dataformat-xml, we now also have thewoodstox-coredependency of version 6.5.1, which doesn't have vulnerabilities as well.So, strictly speaking, this PR drops support for Gradle 6.x.
According to Kotlin Gradle Plugin compatibility matrix, Gradle 7.6.3 is supported by KGP 2.1.0+ (earlier KGP versions support Gradle 6.x)
At the same time, DGPv2 will be enabled by default in Dokka 2.1.0, and according to migration guide, it supports Gradle 7.6.x and Kotlin 1.9.x
WDYT?