-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Upgrade jackson to 2.19 and snakeyaml to 2.14 #10258
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Code hygene and clearing falsely flagged CVEs
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ive doubled checked, these are the latest versions as of today.
Thanks
@eddumelendez Can you enable the tests CI flows so we can confirm this does not break and review? |
The easiest way to run CI and get that feedback is to send a pull request to your own fork's main and let CI run I did that in my fork + your changes here: yeikel#1 Unfortunately, your changes are not passing some of the workflows ie:
There are also other failures
Refer to the link above to see the full CI Run. Example: https://github.com/yeikel/testcontainers-java/actions/runs/15290585561/job/43009689378?pr=1 I also sent you an invite in case it is more convenient to just push to my fork |
It seems that the issue is a mismatch as Although we may be able to overwrite that, it seems safer to upgrade |
Code hygene and clearing falsely flagged CVEs
Upgrade jackson and snakeyaml to the latest version. Aside from providing code hygene, these two dependencies are flagged by FOSS scanning tools as having critical severity CVEs. Although not exploitable in testcontainers, this causes a headache for developers.
This is to address Issue #9289