'Unable to update jackson-databind reference
I'm using IntelliJ v2019. I have vulnerabilities in my java (maven) app. Some vulnerabilities involve jackson-databind v2.9.6 that need to be replaced by a newer version (2.9.8). I cannot find any references in my pom files for this jar. I've cleared my local jar repo and done a mvn clean install and it keeps downloading that jar. I've searched within all jar files on my system and cannot find the reference. I've only found it referenced in Maven__com_fasterxml_jacson_core_jackson..._2_9_6.xml located in the ....idea\libraries folder of my project. So I moved it to another location and replaced it with the 2_9_8 version. I cleared my local repo again, doing another mvn clean install and yet v2.9.6 continues to be downloaded but NOT 2.9.8. I've searched all over the internet and cannot find what other jar library might referencing the 2.9.6 version or how to remedy this issue. Do I need to update my maven installation?
Solution 1:[1]
Another team member gave me the command 'mvn dependency:tree' and it displayed the jar referencing what I was looking for.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Mark |