Fix PRISMA-2023-0067 in main.jar (#16169)

h2oai · Jun 26, 2024 · a5eb7b9 · a5eb7b9
1 parent 62d0afe
commit a5eb7b9
Showing 1 changed file with 3 additions and 5 deletions.
diff --git a/h2o-assemblies/main/build.gradle b/h2o-assemblies/main/build.gradle
@@ -55,8 +55,10 @@ dependencies {
     api "com.google.protobuf:protobuf-java:3.21.7"
 
     constraints {
-        api('com.fasterxml.jackson.core:jackson-databind:2.13.4.2') {
+        api('com.fasterxml.jackson.core:jackson-databind:2.16.1') {
             because 'Fixes CVE-2022-42003'
+            because 'Fixes PRISMA-2023-0067'
+            because 'Fixes CVE-2023-35116'
         }
         api('org.jetbrains.kotlin:kotlin-stdlib:1.6.21') {
             because 'Fixes CVE-2020-29582'
@@ -93,10 +95,6 @@ shadowJar {
   zip64 true
   mergeServiceFiles()
   classifier = ''
-  // CDH 5.3.0 provides joda-time v1.6 which is too old, shadow the library instead
-  if (!project.hasProperty("jacocoCoverage")) {
-    relocate 'org.joda.time', 'ai.h2o.org.joda.time'
-  }
   exclude 'META-INF/*.DSA'
   exclude 'META-INF/*.SF'
   exclude 'synchronize.properties'