[HADOOP-19230] upgrade to jackson 2.14.3

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: common
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 19/Jul/24 21:37
• Updated: 01/Sep/24 21:21

Description

Follow up to HADOOP-18332

I have what I believe fixes the Jackson JAX-RS incompatibility.

https://github.com/pjfanning/jsr311-compat/

The reason that I want to start by just going to Jackson 2.14 is that Jackson has new StreamReadConstraints in Jackson 2.15 to protect against malicious JSON inputs. The constraints are generous but can cause issues with very large or deeply nested inputs.

Jackson has had a lot of security hardening fixes recently and it seems problematic to be stuck on an unsupported version of Jackson (2.12).

Issue Links

• is related to: HADOOP-19259 upgrade to jackson 2.18.0
• relates to: HADOOP-18332 Remove rs-api dependency by downgrading jackson to 2.12.7
• links to: GitHub Pull Request #6761