[Snyk] Fix for 1 vulnerabilities

[md-khadeer]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• parent/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	710	com.fasterxml.jackson.core:jackson-core: 2.13.4 -> 2.18.8 com.fasterxml.jackson.core:jackson-databind: 2.13.4 -> 2.18.8 No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[md-khadeer]

This upgrade from version 2.13.4 to 2.18.8 is a minor version update but spans several releases, introducing changes that require verification.

Key Changes & Potential Impacts:

• Processing Limits for Security: The most significant change is the introduction of StreamReadConstraints in version 2.15 to mitigate Denial of Service (DoS) attacks. This adds default limits on:

  • Maximum string value length (initially 5MB, raised to 20MB in 2.15.1).
  • Maximum nesting depth (default 1000).
  • Other token and document size limits were added in subsequent releases.
    Applications processing very large or deeply nested JSON documents may now encounter exceptions if they exceed these new default limits.

• Stricter Parsing: Version 2.17 introduced stricter parsing for numbers represented as strings. For example, strings with leading zeros like "07" are no longer automatically converted to numbers for Enum indexes, which may affect deserialization logic that relied on this coercion.

• Internal Refactoring: Version 2.18 includes a major rewrite of the internal property introspection logic. While this fixed numerous bugs, such a significant change could introduce subtle behavioral differences in edge cases.

• Java Version: The minimum requirement for jackson-core was raised to Java 8 in version 2.14.

Recommendation:
This upgrade is assessed as medium risk. While there are no major API-breaking changes, the new processing limits are a behavioral change that could impact applications handling large payloads. It is crucial to verify that your application's JSON processing is not affected by these new default constraints. If necessary, these limits can be configured to accommodate larger inputs.

Source: Jackson 2.14-2.18 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.