chore(deps-dev): dependencies and issue update - #124
Open
RVANDO12 wants to merge 1 commit into
Open
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Description
update dependencies
What this PR Provides
Description: We need to resolve multiple security vulnerabilities flagged by Dependabot in our pom.xml. This requires updating the PostgreSQL driver and forcing secure versions of both Jackson 2.x and Jackson 3.x to resolve transitive dependency issues.
Reference:
Dependabot Alert: GitHub Security Alert #100
Vulnerabilities to Address
Issue: The current version is susceptible to a Silent channel-binding authentication downgrade via unsupported certificate algorithms.
Resolution: Update the postgresql dependency to the latest patched version.
Vulnerable Version: 2.21.4
Introduced via: com.schibsted.spt.data:jslt 0.1.14
Affected Range: >= 2.21.0, <= 2.21.4
Patched Version: 2.21.5
Resolution: Force com.fasterxml.jackson.core:jackson-databind version 2.21.5 via .
Vulnerable Version: 3.1.4
Introduced via: org.flywaydb:flyway-database-postgresql 12.4.0
Resolution: Force tools.jackson.core:jackson-databind to a secure version (e.g., 3.1.5 or higher) via .
Fixes
Review
The reviewer must double-check these points:
!after the type/scope to identify the breakingchange in the release note and ensure we will release a major version.
How to test
[ ] Compilation & Mapping: The project compiles successfully, and MapStruct correctly maps record components to domain objects without missing properties.
[ ] Swagger/OpenAPI UI: Verify that the generated OpenAPI documentation accurately reflects the flattened structure and still applies the snake_case naming strategy.
[ ] Integration Tests Passing: All existing MockMvc tests (specifically those POSTing or PUTting JSON payloads) must pass without modification to their JSON string payloads, proving that Jackson deserializes the records exactly as it did the old classes.