Merge pull request #434 from skyflowapi/himanshupal/SK-2909-policy-voilation-fix

SK-2909, SK-2908-Added-fix-for-Policy-Voilation

Author: skyflow-himanshupal

pom.xml

@@ -51,7 +51,12 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.13.0</version>
+            <version>2.18.11</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.18.11</version>
         </dependency>
         <dependency>
             <groupId>com.googlecode.json-simple</groupId>
@@ -61,7 +66,7 @@
         <dependency>
             <groupId>io.jsonwebtoken</groupId>
             <artifactId>jjwt</artifactId>
-            <version>0.9.1</version>
+            <version>0.12.6</version>
         </dependency>
         <dependency>
             <groupId>commons-codec</groupId>
@@ -73,18 +78,6 @@
             <artifactId>jaxb-api</artifactId>
             <version>2.3.1</version>
         </dependency>
-        <dependency>
-            <groupId>io.jsonwebtoken</groupId>
-            <artifactId>jjwt-impl</artifactId>
-            <version>0.11.2</version>
-            <scope>runtime</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.jsonwebtoken</groupId>
-            <artifactId>jjwt-jackson</artifactId>
-            <version>0.11.2</version>
-            <scope>runtime</scope>
-        </dependency>
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
@@ -234,3 +227,4 @@
     </profiles>
 
 </project>
+

samples/pom.xml

@@ -20,6 +20,17 @@
             <artifactId>skyflow-java</artifactId>
             <version>1.15.0</version>
         </dependency>
+        <!-- Override vulnerable jackson-databind 2.9.6 (via io.jsonwebtoken:jjwt@0.9.1) and jackson-core 2.13.0 pulled transitively by skyflow-java 1.15.0 -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.18.11</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>2.18.11</version>
+        </dependency>
 
     </dependencies>