Upgrade Jackson Dependency to address security vulnerabilities

[newcron]

Hi There,

I understand that it's not possible to upgrade to Jackson 3 due to compatibility issues with older Gradle versions.

However, the current used Version (2.14.2) of Jackson has a few pretty urgent security violations.

I understand, that this does not directly affect the security of applications that use the plugins, however there are two aspects worth considering:

• Many applications are built on public CI runners such as "Github-hosted runners" for Github Actions. There it's not clear, what else is on these machines and how hardened they are. So security at build time does actually matter.
• Gradle offers the Dependency Submission Github action that reports all dependencies to github's dependabot. This plugin also reports build time dependencies.
  In an enterprise context, these security findings are often monitored and mitigation is mandatory (such is my case).

Therefore, I would really appreciate to upgrade at least to the latest patched version of Jackson 2.

[deepy]

Let me first debunk the initial point, if you're running on a compromised CI runner then a vulnerable dependency in your build is the least of your concerns, you have essentially lost the game before even starting to play it.

With that said, I can't even see any way you'd be able to trigger the vulnerabilities without being in a position where you fully control the build anyways

Now the enterprise context is different, it's probably not worth fighting bureaucracy :-)
But the problem is not that I can't upgrade to Jackson 3, the problem is I can't upgrade past the current version without dropping support for old versions (which I've planned to do, but won't be able to find the time for until my vacation starts). So in the meantime I suggest you work around it by setting a constraint in your buildscript: #317 (comment)