We can update, sure, but we don't do releases for updating converter
dependencies. If you need a newer version the consumer should specify it.

On Tue, Dec 18, 2018, 11:07 AM dGhlb3ds <notifications@github.com wrote:

> Snyk analysis flags up security vulnerabilities in
> com.squareup.retrofit2:converter-jackson:2.5.0 due to the dependency on
> com.fasterxml.jackson.core:jackson-databind@2.9.4
>
> https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72451
>
> Could you please upgrade to jackson-databind@2.9.7?
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/square/retrofit/issues/2991>, or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AAEEEQHAhV1oM95KCdnnLVJ2IUgxciCkks5u6RKngaJpZM4ZYmmM>
> .
>
 How does the consumer specify the newer version ?  They declare it explicitly as a dependency and their dependency tool will
resolve the newer version. Basically the same as how you declare any other
dependency.

On Fri, Feb 15, 2019, 3:16 AM pavankumarvvijapur <notifications@github.com
wrote:

> How does the consumer specify the newer version ?
>
> —
> You are receiving this because you commented.
>
>
> Reply to this email directly, view it on GitHub
> <https://github.com/square/retrofit/issues/2991#issuecomment-463947736>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AAEEEYNVGNNO8M58UENlY2PVFkHCBTDAks5vNmzYgaJpZM4ZYmmM>
> .
>

Deserialisation of untrusted data in jackson-databind  [,2.9.7)
Snyk analysis flags up security vulnerabilities in com.squareup.retrofit2:converter-jackson:2.5.0 due to the dependency on com.fasterxml.jackson.core:jackson-databind@2.9.4

https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-72451

Could you please upgrade to jackson-databind@2.9.7?
pom.xml
pom.xml
diff --git a/pom.xml b/pom.xml
index 85a3ceebfe..d1ac09dba3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -62,7 +62,7 @@
     <!-- Converter Dependencies -->
     <gson.version>2.8.2</gson.version>
     <protobuf.version>3.0.0</protobuf.version>
-    <jackson.version>2.9.4</jackson.version>
+    <jackson.version>2.9.8</jackson.version>
     <wire.version>2.2.0</wire.version>
     <simplexml.version>2.7.1</simplexml.version>
     <moshi.version>1.5.0</moshi.version>
