⬆️ Bump com.fasterxml.jackson.core:jackson-core from 2.18.6 to 2.18.8 in /weixin-java-channel - #4075
Conversation
Bumps [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) from 2.18.6 to 2.18.8. - [Commits](FasterXML/jackson-core@jackson-core-2.18.6...jackson-core-2.18.8) --- updated-dependencies: - dependency-name: com.fasterxml.jackson.core:jackson-core dependency-version: 2.18.8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🤖 Augment PR SummarySummary: 将 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
|
|
||
| <properties> | ||
| <jackson.version>2.18.6</jackson.version> | ||
| <jackson.version>2.18.8</jackson.version> |
There was a problem hiding this comment.
weixin-java-channel 这里通过 <jackson.version> 显式覆盖父 POM 导入的 jackson-bom（根 pom.xml 当前为 2.18.4），可能导致 Jackson 组件出现 patch 版本不一致（例如 jackson-dataformat-xml 2.18.8 与被管理的 jackson-databind 等）。建议确认是否需要同步对齐相关 Jackson 组件版本，以降低运行期兼容性风险。
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
|
||
| <properties> | ||
| <jackson.version>2.18.6</jackson.version> | ||
| <jackson.version>2.18.8</jackson.version> |
There was a problem hiding this comment.
PR 标题/描述只提到 jackson-core，但该 <jackson.version> 属性同时影响 jackson-annotations 和 jackson-dataformat-xml 的实际版本升级。建议确认这是否符合本次依赖升级的预期，避免后续审计/回溯时产生误解。
Severity: low
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
1 participant
Bumps com.fasterxml.jackson.core:jackson-core from 2.18.6 to 2.18.8.
Commits
899d70a[maven-release-plugin] prepare release jackson-core-2.18.8a006b52Prep for 2.18.8 release88e3941Add back JDK 11 in CI1665ef1Fix release notes4cdd529Apply number-length validator on streaming integer path of async parser (#1611)cd4d6b2Post-release dep version bump0345882[maven-release-plugin] prepare for next development iterationa7a5562[maven-release-plugin] prepare release jackson-core-2.18.7cd647eaPrep for 2.18.7 release8c91dbbFix #1602: enforce StreamReadConstraints.maxNameLen on UTF8DataInputJsonParse...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.