fix CVEs in typescript and java client subtrees (#1324)

fixes Dependabot alerts in two subtrees. all vulns are dev-scope dependencies.

Author: appsec-tpc

build.savant

@@ -15,7 +15,8 @@
  */
 
 fusionauthJWTVersion = "5.2.4"
-jacksonVersion = "2.15.4"
+jacksonVersion = "2.21.1"
+jacksonAnnotationsVersion = "2.21"  // No 2.21.1 version available, annotations dropped patch versioning in 2.20+
 jackson5Version = "3.0.1"
 javaErrorVersion = "2.2.3"
 restifyVersion = "4.3.0"
@@ -39,11 +40,13 @@ project(group: "io.fusionauth", name: "fusionauth-java-client", version: "1.64.0
 
   dependencies {
     group(name: "compile") {
-      dependency(id: "com.fasterxml.jackson.core:jackson-annotations:${jacksonVersion}")
+      dependency(id: "com.fasterxml.jackson.core:jackson-annotations:${jacksonAnnotationsVersion}")
       dependency(id: "com.fasterxml.jackson.core:jackson-core:${jacksonVersion}")
       dependency(id: "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}")
       dependency(id: "com.inversoft:jackson5:${jackson5Version}")
-      dependency(id: "com.inversoft:java-error:${javaErrorVersion}")
+      dependency(id: "com.inversoft:java-error:${javaErrorVersion}") {
+        exclusion(id: "com.inversoft:jackson5")
+      }
       dependency(id: "com.inversoft:restify:${restifyVersion}")
       dependency(id: "io.fusionauth:fusionauth-jwt:${fusionauthJWTVersion}")
     }

fusionauth-java-client.iml

@@ -65,33 +65,33 @@
     <orderEntry type="module-library">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-databind/2.21.1/jackson-databind-2.21.1.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-databind/2.21.1/jackson-databind-2.21.1-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-annotations/2.15.4/jackson-annotations-2.15.4.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-annotations/2.21.0/jackson-annotations-2.21.0.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-annotations/2.15.4/jackson-annotations-2.15.4-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-annotations/2.21.0/jackson-annotations-2.21.0-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-core/2.15.4/jackson-core-2.15.4.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-core/2.21.1/jackson-core-2.21.1.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-core/2.15.4/jackson-core-2.15.4-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/fasterxml/jackson/core/jackson-core/2.21.1/jackson-core-2.21.1-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
@@ -140,4 +140,5 @@
       </library>
     </orderEntry>
   </component>
-</module>
+</module>
+

pom.xml

@@ -76,23 +76,23 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-annotations</artifactId>
-      <version>2.15.4</version>
+      <version>2.21.0</version>
       <type>jar</type>
       <scope>compile</scope>
       <optional>false</optional>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.15.4</version>
+      <version>2.21.1</version>
       <type>jar</type>
       <scope>compile</scope>
       <optional>false</optional>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.15.4</version>
+      <version>2.21.1</version>
       <type>jar</type>
       <scope>compile</scope>
       <optional>false</optional>
@@ -112,6 +112,12 @@
       <type>jar</type>
       <scope>compile</scope>
       <optional>false</optional>
+      <exclusions>
+        <exclusion>
+          <groupId>com.inversoft</groupId>
+          <artifactId>jackson5</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.inversoft</groupId>