mirror of
https://github.com/lancedb/lancedb.git
synced 2026-10-13 07:12:27 +00:00
Will JonesandClaude Opus 5.5
c2c8269fc8
## Summary The Java SDK pinned `jackson-databind` 2.17.1, and `jackson-core` and the other Jackson modules came in transitively via `arrow-vector` and `lance-namespace-apache-client` at 2.16.x–2.17.x, all affected by known CVEs. This imports `jackson-bom` 2.18.11 in the parent POM, and declares `jackson-core`, `jackson-annotations`, `jackson-datatype-jsr310`, and `jackson-jaxrs-json-provider` as direct (BOM-managed) dependencies of `lancedb-core`. The direct declarations are needed because the parent's dependency management doesn't apply to a consumer's transitive resolution; without them, Maven's nearest-wins mediation still hands downstream apps the older versions from `arrow-vector`. ## Evidence `mvn dependency:list` in a separate consumer project depending only on `lancedb-core`: | Artifact | Before | After | |---|---|---| | jackson-core | 2.16.0 | 2.18.11 | | jackson-annotations | 2.16.0 | 2.18.11 | | jackson-databind | 2.17.1 | 2.18.11 | | jackson-datatype-jsr310 | 2.16.0 | 2.18.11 | | jackson-jaxrs-base / json-provider | 2.17.1 | 2.18.11 | | jackson-module-jaxb-annotations | 2.17.1 | 2.18.11 | ## Merge Risk **Door:** Two-way. Dependency versions only, and they stay within Jackson 2.x. **Blast Radius:** `java` dependencies. Downstream users of `lancedb-core` now get Jackson 2.18.11 transitively. Fixes OSS-2360, OSS-2337 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
137 lines
4.5 KiB
XML
137 lines
4.5 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<parent>
|
|
<groupId>com.lancedb</groupId>
|
|
<artifactId>lancedb-parent</artifactId>
|
|
<version>0.41.0-beta.3</version>
|
|
<relativePath>../pom.xml</relativePath>
|
|
</parent>
|
|
|
|
<artifactId>lancedb-core</artifactId>
|
|
<name>${project.artifactId}</name>
|
|
<description>Utilities to work with LanceDB Cloud and Enterprise via Lance REST Namespace</description>
|
|
<packaging>jar</packaging>
|
|
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.lance</groupId>
|
|
<artifactId>lance-core</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.apache.arrow</groupId>
|
|
<artifactId>arrow-vector</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.apache.arrow</groupId>
|
|
<artifactId>arrow-memory-netty</artifactId>
|
|
</dependency>
|
|
|
|
<!-- Transport for the LanceDB routes outside the Lance Namespace spec.
|
|
Versions match what lance-namespace-apache-client resolves to. -->
|
|
<dependency>
|
|
<groupId>org.apache.httpcomponents.client5</groupId>
|
|
<artifactId>httpclient5</artifactId>
|
|
<version>5.2.1</version>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-databind</artifactId>
|
|
</dependency>
|
|
|
|
<!-- Declared directly so downstream consumers resolve the patched versions:
|
|
the parent's jackson-bom only manages our own build, and otherwise Maven's
|
|
nearest-wins mediation picks older versions via arrow-vector and
|
|
lance-namespace-apache-client. -->
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-core</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-annotations</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.datatype</groupId>
|
|
<artifactId>jackson-datatype-jsr310</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.jaxrs</groupId>
|
|
<artifactId>jackson-jaxrs-json-provider</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.mockito</groupId>
|
|
<artifactId>mockito-junit-jupiter</artifactId>
|
|
<version>5.18.0</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.slf4j</groupId>
|
|
<artifactId>slf4j-api</artifactId>
|
|
<version>2.0.16</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.apache.logging.log4j</groupId>
|
|
<artifactId>log4j-slf4j2-impl</artifactId>
|
|
<version>2.25.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.apache.logging.log4j</groupId>
|
|
<artifactId>log4j-core</artifactId>
|
|
<version>2.25.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.apache.logging.log4j</groupId>
|
|
<artifactId>log4j-api</artifactId>
|
|
<version>2.25.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-source-plugin</artifactId>
|
|
<version>3.3.0</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-sources</id>
|
|
<goals>
|
|
<goal>jar-no-fork</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</project>
|