chore(deps): update dependency com.fasterxml.jackson.core:jackson-databind to v2.21.1#23
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
82b4793 to
64c3591
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
64c3591 to
178c5ca
Compare
178c5ca to
3971b03
Compare
3971b03 to
2c749fc
Compare
agu-token-java-core/build.gradle.kts
Outdated
| // We publish with a higher version (see below) to ensure users depend on a secure version by default. | ||
| force("com.fasterxml.jackson.core:jackson-core:2.13.4") | ||
| force("com.fasterxml.jackson.core:jackson-databind:2.13.4") | ||
| force("com.fasterxml.jackson.core:jackson-databind:2.21.0") |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
2c749fc to
9a147dd
Compare
| force("com.fasterxml.jackson.core:jackson-core:2.13.4") | ||
| force("com.fasterxml.jackson.core:jackson-databind:2.13.4") | ||
| force("com.fasterxml.jackson.core:jackson-databind:2.21.1") | ||
| force("com.fasterxml.jackson.core:jackson-annotations:2.13.4") |
There was a problem hiding this comment.
Bug: The build configuration forces a minor version mismatch between jackson-databind (2.21.1) and other Jackson core libraries (2.13.4), violating compatibility requirements and risking runtime serialization errors.
Severity: MEDIUM
Suggested Fix
Align all Jackson library versions in the build.gradle.kts file. Ensure that jackson-databind, jackson-core, jackson-annotations, and other related Jackson modules all use the same version, for example, by upgrading all of them to the latest compatible version like 2.21.1 or 2.18.2 consistently across all configurations.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: agu-token-java-core/build.gradle.kts#L10-L12
Potential issue: The `build.gradle.kts` file configures mismatched minor versions for
Jackson libraries. During compilation, `jackson-databind` is set to version `2.21.1`
while `jackson-core` and `jackson-annotations` are at `2.13.4`. This violates Jackson's
strict requirement that all core components share the same minor version. This
incompatibility can lead to unpredictable runtime errors, such as `NoSuchMethodError`,
during JSON serialization or deserialization, as different modules expect different
method signatures. The existing custom version check,
`checkJacksonVersionCompatibility()`, is insufficient as it only validates major
versions and a minimum minor version, failing to enforce the required minor version
alignment across all Jackson modules.
Did we get this right? 👍 / 👎 to inform future reviews.
This PR contains the following updates:
2.18.2→2.21.12.13.4→2.21.1Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
This change is