Skip to content

Remove dependency on jackson-databind #3

@cygri

Description

@cygri

Maui Server should abandon the use of jackson-databind and use some other JSON library instead.

There has been an ongoing stream of vulnerability reports for jackson-databind. These vulnerabilities don't affect Maui Server as it doesn't make use of Jackson's object mapper capabilities. But automated vulnerability scanners pick up on the use of these vulnerable dependencies, and their reports cast doubt on the security of Maui Server.

My preference for a replacement would be javax.json as it's the closest to being a part of the standard library, doesn't include an object mapper that Maui Server doesn't need, and has some interesting capabilities like support for JSON Pointer and JSON Patch that could potentially be useful.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions