Skip to content

fix: align shenyu-e2e Jackson version with root POM (#6599) - #6970

Open
yykaue wants to merge 1 commit into
apache:masterfrom
yykaue:fix-6599-align-jackson-version
Open

fix: align shenyu-e2e Jackson version with root POM (#6599)#6970
yykaue wants to merge 1 commit into
apache:masterfrom
yykaue:fix-6599-align-jackson-version

Conversation

@yykaue

@yykaue yykaue commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

What this PR does

  • Upgrade the shenyu-e2e Jackson BOM from 2.13.3 to 2.15.3.
  • Align the E2E Jackson version with the root POM.
  • Avoid the vulnerable jackson-databind version affected by CVE-2022-42003 and CVE-2022-42004.

Testing

  • All 15 shenyu-e2e modules passed Maven validation.
  • All relevant unit tests passed: 5 tests, 0 failures, 0 errors.
  • Main and test sources of all 15 modules compiled successfully.
  • Jackson Core, Databind, and Annotations were confirmed to resolve to 2.15.3.

Fixes #6599

@Aias00 Could you please help review this PR? Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Task] Vulnerable jackson-databind 2.13.3 pinned in shenyu-e2e BOM (CVE-2022-42003/42004)

1 participant