RHPAM-4700: Upgrade Jackson to 2.15.2 to make it work with SnakeYAML …

[mareknovotny]

…2.0 (#870)

https://issues.redhat.com/browse/RHPAM-4700

No org.yaml:snakeyaml:jar:1.33.0 traces on optaweb* or kogito-examples projects after related PRs

Related PRs:

• Sync main branch with Apache main branch kogito-runtimes#9
• [8.13.x][RHPAM-4700][CVE-2022-1471] snakeyaml to 1.33 optaplanner#25

[mareknovotny]

jenkins retest this please

[lucamolteni]

I'm still convinced we should have been fine anyway with this quarkusio/quarkus#30440 but I'm fine with this solution

[yurloc]

I'm still convinced we should have been fine anyway with this quarkusio/quarkus#30440 but I'm fine with this solution

@lucamolteni I don't think so because smallrye-config-source-yaml:2.12.3 depends on snakeyaml:1.33, see https://mvnrepository.com/artifact/io.smallrye.config/smallrye-config-source-yaml/2.12.3. Am I missing something?

[lucamolteni]

I'm still convinced we should have been fine anyway with this quarkusio/quarkus#30440 but I'm fine with this solution

@lucamolteni I don't think so because smallrye-config-source-yaml:2.12.3 depends on snakeyaml:1.33, see https://mvnrepository.com/artifact/io.smallrye.config/smallrye-config-source-yaml/2.12.3. Am I missing something?

You're correct, it uses snakeyaml 1.33. We don't need to use snakeyaml 2.0.0 necessarily, as long as we don't use that specific no args constructor

[yurloc]

I'm still convinced we should have been fine anyway with this quarkusio/quarkus#30440 but I'm fine with this solution

@lucamolteni I don't think so because smallrye-config-source-yaml:2.12.3 depends on snakeyaml:1.33, see https://mvnrepository.com/artifact/io.smallrye.config/smallrye-config-source-yaml/2.12.3. Am I missing something?

You're correct, it uses snakeyaml 1.33. We don't need to use snakeyaml 2.0.0 necessarily, as long as we don't use that specific no args constructor

Yes, that is true but our ultimate goal is not only to prevent the vulnerability (which is technically not present in this project) but also to escape the reporting tools, which mark the project as vulnerable just because it depends on SnakeYAML 1.33.

[yurloc]

Jenkins retest this.

I want to check if kiegroup/optaplanner#33 actually disables Sonar analysis.

[yurloc]

LGTM.