{"action":"created","issue":{"url":"https://api.github.com/repos/Ensembl/ensembl-hive/issues/113","repository_url":"https://api.github.com/repos/Ensembl/ensembl-hive","labels_url":"https://api.github.com/repos/Ensembl/ensembl-hive/issues/113/labels{/name}","comments_url":"https://api.github.com/repos/Ensembl/ensembl-hive/issues/113/comments","events_url":"https://api.github.com/repos/Ensembl/ensembl-hive/issues/113/events","html_url":"https://github.com/Ensembl/ensembl-hive/pull/113","id":449867104,"node_id":"MDExOlB1bGxSZXF1ZXN0MjgzMzA4NTE1","number":113,"title":"wrappers/java/pom.xml: bump jackson-databind to 2.9.9","user":{"login":"mkszuba","id":49689,"node_id":"MDQ6VXNlcjQ5Njg5","avatar_url":"https://avatars3.githubusercontent.com/u/49689?v=4","gravatar_id":"","url":"https://api.github.com/users/mkszuba","html_url":"https://github.com/mkszuba","followers_url":"https://api.github.com/users/mkszuba/followers","following_url":"https://api.github.com/users/mkszuba/following{/other_user}","gists_url":"https://api.github.com/users/mkszuba/gists{/gist_id}","starred_url":"https://api.github.com/users/mkszuba/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mkszuba/subscriptions","organizations_url":"https://api.github.com/users/mkszuba/orgs","repos_url":"https://api.github.com/users/mkszuba/repos","events_url":"https://api.github.com/users/mkszuba/events{/privacy}","received_events_url":"https://api.github.com/users/mkszuba/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2019-05-29T15:12:02Z","updated_at":"2019-06-13T14:57:10Z","closed_at":"2019-05-30T14:50:29Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/Ensembl/ensembl-hive/pulls/113","html_url":"https://github.com/Ensembl/ensembl-hive/pull/113","diff_url":"https://github.com/Ensembl/ensembl-hive/pull/113.diff","patch_url":"https://github.com/Ensembl/ensembl-hive/pull/113.patch"},"body":"## Use case\r\n\r\nVersion 2.6.1 of jackson-databind suffers from 5 high-severity and 1 moderate-severity security vulnerabilities. Use the first version known to fix all of these vulnerabilities.\r\n\r\nIncidentally, all but one of these vulnerabilities date back to 2018 and earlier so one can't help but wonder why, seeing as this file was only introduced mid-May 2019, we used such an old and buggy version in the first place.\r\n\r\nCome to think of it, why use fixed versions of Java dependencies rather than ranges?\r\n\r\n## Description\r\n\r\nBump the version number of jackson-databind, one of the dependencies of the eHive Java wrapper, to 2.9.9 in order to address security vulnerabilities in 2.6.1.\r\n\r\n## Possible Drawbacks\r\n\r\njackson-databind-2.9.9 may be incompatible with out code base. I haven't seen anything suggesting that it might in its release docs, that said I haven't tested it because of the size of Maven and co.\r\n\r\n## Testing\r\n\r\n_Have you added/modified unit tests to test the changes?_\r\n\r\nNo.\r\n\r\n_If so, do the tests pass/fail?_\r\n\r\nN/A\r\n\r\n_Have you run the entire test suite and no regression was detected?_\r\n\r\nYes (on Perl 5.26), no errors seen."},"comment":{"url":"https://api.github.com/repos/Ensembl/ensembl-hive/issues/comments/501739538","html_url":"https://github.com/Ensembl/ensembl-hive/pull/113#issuecomment-501739538","issue_url":"https://api.github.com/repos/Ensembl/ensembl-hive/issues/113","id":501739538,"node_id":"MDEyOklzc3VlQ29tbWVudDUwMTczOTUzOA==","user":{"login":"muffato","id":623458,"node_id":"MDQ6VXNlcjYyMzQ1OA==","avatar_url":"https://avatars0.githubusercontent.com/u/623458?v=4","gravatar_id":"","url":"https://api.github.com/users/muffato","html_url":"https://github.com/muffato","followers_url":"https://api.github.com/users/muffato/followers","following_url":"https://api.github.com/users/muffato/following{/other_user}","gists_url":"https://api.github.com/users/muffato/gists{/gist_id}","starred_url":"https://api.github.com/users/muffato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffato/subscriptions","organizations_url":"https://api.github.com/users/muffato/orgs","repos_url":"https://api.github.com/users/muffato/repos","events_url":"https://api.github.com/users/muffato/events{/privacy}","received_events_url":"https://api.github.com/users/muffato/received_events","type":"User","site_admin":false},"created_at":"2019-06-13T14:57:10Z","updated_at":"2019-06-13T14:57:10Z","author_association":"MEMBER","body":"The jackson library v2.6.1 was in reality added in Aug 2015. The May 2019 change you've seen is when @mira13 moved the build system to maven. I advised her to keep the same versions in her PR and to upgrade dependency versions in further commits / PRs to change 1 thing at a time.\r\n\r\nBy the way, did you find this problem via Github new security reports ?"}}
{"actor":{"display_login":"muffato"}}