[Snyk] Fix for 1 vulnerabilities

[avade]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• todolist-goof/todolist-web-common/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	710	com.fasterxml.jackson.core:jackson-core: 2.6.5 -> 2.18.8 com.fasterxml.jackson.core:jackson-databind: 2.6.5 -> 2.18.8 No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[avade]

This is a major upgrade across twelve minor versions, from 2.6.5 to 2.18.8. It introduces significant breaking changes, requires a Java version update, and includes a major internal rewrite that necessitates thorough testing.

Key Breaking Changes:

• Java Version Requirement: The minimum required Java version is now Java 8. Jackson 2.14 raised the baseline for jackson-core to Java 8, whereas version 2.6 could run on Java 6/7. [9, 17]

• API Deprecation and Removal: Jackson's policy is to remove deprecated methods after two minor versions. [16] Given the span of twelve minor versions, it is highly likely that any APIs that were deprecated in version 2.6 or earlier have been removed.

• Major Behavioral Changes:

  • Property Introspection Rewrite (v2.18): Version 2.18 contains a complete rewrite of the POJO property introspection logic to unify handling of fields and creators. While this fixes many long-standing bugs, a change of this magnitude can introduce subtle behavioral differences and new edge cases. [1, 4]
  • Stricter Type Coercion: Default behaviors have changed over time. For example, in version 2.17, coercion of strings with leading zeros (e.g., "07") into numbers was restricted. [3]

• Security Hardening: This upgrade includes years of security enhancements. Many of these involve adding new safeguards, such as StreamReadConstraints to prevent DoS attacks, and blocking potentially malicious "gadget classes" for deserialization. [1, 17] These changes can cause previously working deserialization to fail with new exceptions.

Recommendation:
This upgrade cannot be treated as a simple drop-in replacement. A full regression testing cycle is mandatory. Pay close attention to:

1. Ensuring your project is running on Java 8 or later.
2. Compiler errors indicating that removed APIs are being used.
3. Runtime exceptions like MismatchedInputException or InvalidDefinitionException, which may indicate reliance on old, insecure, or now-changed default behaviors.

Source: Jackson Release Notes [4, 9, 17]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.