Downgrade Jackson 2.18.0 to 2.17.2

Running Parcelo in a container via our current Dockerfile revealed that "uses-sdk" fields were not being parsed from applications' Android manifests, effectively preventing app uploads since the targetSdk property of uses-sdk is required by Parcelo. This bug wasn't caught until now because it only seems to manifest itself when running via the Dockerfile; running locally as in our recommended development environment does not have the issue. The Jackson 2.18.0 upgrade has not yet been included in a production release, so it's uncertain whether the issue would have surfaced in our production environment. We tracked the issue down to a regression in Jackson 2.18.0. The exact cause is unknown. However, a number of seemingly related issues were reported for Jackson 2.18.0 [1], so we plan to closely monitor those issues and test upcoming Jackson releases carefully to prevent breakage. [1]: See below: - FasterXML/jackson-module-kotlin#841 - FasterXML/jackson-module-kotlin#842 - FasterXML/jackson-module-kotlin#843 - FasterXML/jackson-module-kotlin#832 - FasterXML/jackson-databind#4508 - FasterXML/jackson-databind#4752
accrescent · Oct 27, 2024 · ed8966e · ed8966e
1 parent 100e45e
commit ed8966e
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 96 deletions.
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -9,7 +9,7 @@ dokka = "1.9.20"
 exposed = "0.55.0"
 flyway = "10.19.0"
 github = "1.326"
-jackson = "2.18.0"
+jackson = "2.17.2"
 jobrunr = "7.2.3"
 koin = "4.0.0"
 kotlin = "2.0.20"

diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
@@ -671,16 +671,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="5670e6ac1c4ddcc9d413cf87997a5da2efaa4d2abe439363af9ef102a0a09e40" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml" name="oss-parent" version="59">
-         <artifact name="oss-parent-59.pom">
-            <sha256 value="8e54db60e1080e03b6ddb96b14db3e3e6dbde244a713040204106c167f135233" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
-      <component group="com.fasterxml" name="oss-parent" version="61">
-         <artifact name="oss-parent-61.pom">
-            <sha256 value="3649513cf597e9186da0855986a8c543e12bdbd805edeef9c124db56dd036544" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson" name="jackson-base" version="2.12.7">
          <artifact name="jackson-base-2.12.7.pom">
             <sha256 value="179e54fe26c8d4dfe925fee31d4a87d1cc25f8b7e00948a4e656b1229e2b76ae" origin="Generated by Gradle"/>
@@ -701,11 +691,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="7cf9c59fbd14c9056747137b90d70a95e87760dfe1b82456b9f02317d5b56faf" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson" name="jackson-base" version="2.18.0">
-         <artifact name="jackson-base-2.18.0.pom">
-            <sha256 value="10564cbffb857f9065aa11b5849a8c308c3535f0f53c6f4cbb2b6fb7b3507f97" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson" name="jackson-bom" version="2.12.7">
          <artifact name="jackson-bom-2.12.7.pom">
             <sha256 value="1955432f6d8af32806d82d8218fedfe4be3bb3e23d59a74d81449ffc74bf7bd1" origin="Generated by Gradle"/>
@@ -726,11 +711,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="1f472b0bc2004d5cf421ac48871417f84189e78f35c049718387fd8b44fb9f32" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson" name="jackson-bom" version="2.18.0">
-         <artifact name="jackson-bom-2.18.0.pom">
-            <sha256 value="badde864ca73b6ca04de9f7ee49e649e1a5e8af8f8c7c1682c746be5e234c587" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson" name="jackson-parent" version="2.12">
          <artifact name="jackson-parent-2.12.pom">
             <sha256 value="62aa1c1679ade09f173dbf1b6c32d35c55e75800238fd5e48f13aa4337c0875b" origin="Generated by Gradle"/>
@@ -746,11 +726,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="aee6de4a97283b040e43f4dad575e7b74796cd984d89276f7ec7567380c8a29d" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson" name="jackson-parent" version="2.18">
-         <artifact name="jackson-parent-2.18.pom">
-            <sha256 value="569dc00d68b4e6df7dde856299e1c0353fa40bdaf123e0df563ecbee416586d9" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.core" name="jackson-annotations" version="2.12.7">
          <artifact name="jackson-annotations-2.12.7.jar">
             <sha256 value="3cacef714a89f3d68b69fa11263afa55a6aa2fdef1fff93ded22caa16b54687c" origin="Generated by Gradle"/>
@@ -775,14 +750,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="28cc43e98e7881803e1e828521e38ab7aed2f977a36c2551dd1790f430f3ebcf" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.core" name="jackson-annotations" version="2.18.0">
-         <artifact name="jackson-annotations-2.18.0.jar">
-            <sha256 value="a09367d2eeb526873abf737ff754c5085f82073a382ee72c3bbe15412217671f" origin="Generated by Gradle"/>
-         </artifact>
-         <artifact name="jackson-annotations-2.18.0.module">
-            <sha256 value="0f098c0830576fc9c755d43d7f316e8a757c93812b35775125b368febcd6035d" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.core" name="jackson-core" version="2.12.7">
          <artifact name="jackson-core-2.12.7.jar">
             <sha256 value="3987a6a335046e226e56b81d69668fb5a91b155ea7fd96b0851adbb7d4ac1ca6" origin="Generated by Gradle"/>
@@ -807,14 +774,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="38282fb75c733d2395dd34dc0b59eccbb43aa7cc31a21a2616baaa8afcb7f236" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.core" name="jackson-core" version="2.18.0">
-         <artifact name="jackson-core-2.18.0.jar">
-            <sha256 value="215bbd7c8fd65be504cb92ff3aa1c4b790fc7b14cca72f4546aac4143c101bb5" origin="Generated by Gradle"/>
-         </artifact>
-         <artifact name="jackson-core-2.18.0.module">
-            <sha256 value="c529814eeefb7f044fcf650bfa527eeb4b68b696067cb64c1a699472fb356587" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.core" name="jackson-databind" version="2.12.7.1">
          <artifact name="jackson-databind-2.12.7.1.jar">
             <sha256 value="3f504cac405ce066d5665ff69541484d5322f35ac7a7ec6104cf86a01008e02d" origin="Generated by Gradle"/>
@@ -839,14 +798,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="f470bde8944d57d6b150caa8bf53bb982a99eb1d6591e731afcb972ab3dd771f" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.core" name="jackson-databind" version="2.18.0">
-         <artifact name="jackson-databind-2.18.0.jar">
-            <sha256 value="2bf1927b7f3224683ed0157a1ec3b0ede75179da3e597d78c572d56ed00f9f3c" origin="Generated by Gradle"/>
-         </artifact>
-         <artifact name="jackson-databind-2.18.0.module">
-            <sha256 value="2c49ec7e74306d487f95591ba898904619c32a2e3fd1b586fb3e6322c91a4e62" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformat-toml" version="2.15.2">
          <artifact name="jackson-dataformat-toml-2.15.2.module">
             <sha256 value="b8d047ff9685cd147c73a86438ce322beb4180064f90d24514624d98d718fe57" origin="Generated by Gradle"/>
@@ -860,14 +811,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="ae9a3ddf6260daeb17034e4c2bef4eecefc3317d755174458c1e93d19574b7bc" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformat-toml" version="2.18.0">
-         <artifact name="jackson-dataformat-toml-2.18.0.jar">
-            <sha256 value="c0b998aacdc7791d5a1b8425508e7ddf0c794c9fe768d1ce092265568c24e0c3" origin="Generated by Gradle"/>
-         </artifact>
-         <artifact name="jackson-dataformat-toml-2.18.0.module">
-            <sha256 value="59e3ab943c66e52617b89cf988ec33aba84c4cbdd4f9fe82ee43d8e4dc5e2799" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformat-xml" version="2.12.7">
          <artifact name="jackson-dataformat-xml-2.12.7.jar">
             <sha256 value="b9d8b459a3fdf087044bc4f36163b185a0adb084a9390df8db627b115087efa0" origin="Generated by Gradle"/>
@@ -884,12 +827,12 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="4ca87ee2d6384972beeb1007bc0bdfd5d554045f3f2ba79c033c20d2d8980bde" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformat-xml" version="2.18.0">
-         <artifact name="jackson-dataformat-xml-2.18.0.jar">
-            <sha256 value="c67fc996305cda34ccae5298d76dd87f5398a6bf530f5159de87e501869d2d8b" origin="Generated by Gradle"/>
+      <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformat-xml" version="2.17.2">
+         <artifact name="jackson-dataformat-xml-2.17.2.jar">
+            <sha256 value="517add5f3848517894b319a93a7ebfc1c21737b2c17c9acccd38fea97d6adc6f" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="jackson-dataformat-xml-2.18.0.module">
-            <sha256 value="22fd218775b8bdcaf23bda2048190480a4b233a12597432d6b2db263190428bd" origin="Generated by Gradle"/>
+         <artifact name="jackson-dataformat-xml-2.17.2.module">
+            <sha256 value="fa006e0127759b3b385965031b57e0c0dd3c8c63d9eb11899798a9a7bcc025fa" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformats-text" version="2.15.2">
@@ -902,11 +845,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="e698323330a9a82c920e5a89b65b0f7225c8e733c122a18f796a04a6e31fa5cb" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.dataformat" name="jackson-dataformats-text" version="2.18.0">
-         <artifact name="jackson-dataformats-text-2.18.0.pom">
-            <sha256 value="fb2c1c9eaf1746be66f7ead98c79b3f0a9579c7f2484a5ac5f1d2920b5594569" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.datatype" name="jackson-datatype-jsr310" version="2.15.2">
          <artifact name="jackson-datatype-jsr310-2.15.2.jar">
             <sha256 value="7574c81ad570476ef6aad26f419288fd466733f3315bee3012f2f29c9dc008c8" origin="Generated by Gradle"/>
@@ -928,14 +866,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="850e9b2edfab154d1b41501b0197351ad67a2baf7e4829a6566212200252a68d" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.datatype" name="jackson-datatype-jsr310" version="2.18.0">
-         <artifact name="jackson-datatype-jsr310-2.18.0.jar">
-            <sha256 value="f95f8482fe8d634ded7be5e582f3b3604c868324a3c99e2f1f4396c268b63b7a" origin="Generated by Gradle"/>
-         </artifact>
-         <artifact name="jackson-datatype-jsr310-2.18.0.module">
-            <sha256 value="4127ba790ce1d4f049af8812d86e94583a2ff7bef79cc0472970f023cf056633" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.jackson.module" name="jackson-module-jaxb-annotations" version="2.12.7">
          <artifact name="jackson-module-jaxb-annotations-2.12.7.jar">
             <sha256 value="84686ef549abf053ee3632925b024be3f330bc6f34f7e166f0537799e7f90dbd" origin="Generated by Gradle"/>
@@ -960,12 +890,12 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="1b88506f3f4a102e26cf3d72d08f4055bad3a876c227ea9ee9d54f3f354814a0" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.module" name="jackson-module-kotlin" version="2.18.0">
-         <artifact name="jackson-module-kotlin-2.18.0.jar">
-            <sha256 value="f21118a355edba8d363cb395ded285d631345b74ee350d8c6e3cd84c5e182c2a" origin="Generated by Gradle"/>
+      <component group="com.fasterxml.jackson.module" name="jackson-module-kotlin" version="2.17.2">
+         <artifact name="jackson-module-kotlin-2.17.2.jar">
+            <sha256 value="f96986fe7bc25559f938324065bd7a0e96c0d59acf17a48e26e517a9abd411e8" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="jackson-module-kotlin-2.18.0.module">
-            <sha256 value="6b92b95f9996a74997df4090a9ea212c757a644e0783fdbc80e6982234cd8811" origin="Generated by Gradle"/>
+         <artifact name="jackson-module-kotlin-2.17.2.module">
+            <sha256 value="44a3670a99cd31ac262e0c559b4d106cf725af2bf6108991a12816244571d084" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="com.fasterxml.jackson.module" name="jackson-modules-base" version="2.12.7">
@@ -988,11 +918,6 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="3f39c55109f51a228817b4b185e4351b9ef0501c09fc1e1a3075ae9547cc2d03" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.jackson.module" name="jackson-modules-java8" version="2.18.0">
-         <artifact name="jackson-modules-java8-2.18.0.pom">
-            <sha256 value="b454d7fcfe3b87b8ec93a98be40411277547d6ee02899e6f43a9744218aa1ae1" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.fasterxml.woodstox" name="woodstox-core" version="6.2.4">
          <artifact name="woodstox-core-6.2.4.jar">
             <sha256 value="5fa734d5050f097405a801022d09377bbc81e811ef9a17cd0279ed3279f495a5" origin="Generated by Gradle"/>
@@ -1009,12 +934,12 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="4839654e16b1714e74f51abcb378d8356814ab8f4d5273d1dd2f1ce8a390addc" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.fasterxml.woodstox" name="woodstox-core" version="7.0.0">
-         <artifact name="woodstox-core-7.0.0.jar">
-            <sha256 value="eeb3853282c24964a93a6eb4c1bbcb60c8d09fd8e0ffc75ab64ad21045a1fa78" origin="Generated by Gradle"/>
+      <component group="com.fasterxml.woodstox" name="woodstox-core" version="6.7.0">
+         <artifact name="woodstox-core-6.7.0.jar">
+            <sha256 value="81cdeef50567735bda9f6b4aabe0cc0a3f6c04f15569192bc6505393d2612c25" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="woodstox-core-7.0.0.pom">
-            <sha256 value="184c25e1bc38428af2bbeb67d77632ec9fe30a82cf20b10f513bed3f92c4e6e4" origin="Generated by Gradle"/>
+         <artifact name="woodstox-core-6.7.0.pom">
+            <sha256 value="a11608fb92e1980f3d8c946265247140fbe37db691e115343875ab897abc4cc7" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="com.github.johnrengelman.shadow" name="com.github.johnrengelman.shadow.gradle.plugin" version="7.1.2">
@@ -3273,12 +3198,12 @@ SPDX-License-Identifier: AGPL-3.0-only
             <sha256 value="57905524274a00ae028aaccc27283f6bc5925a934a046c1cc5d06c8ee4d6d5a9" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.jetbrains.kotlin" name="kotlin-reflect" version="1.8.10">
-         <artifact name="kotlin-reflect-1.8.10.jar">
-            <sha256 value="99672410459045090d062a0194ed87008e2371f06946b6bfa7287c697f924bea" origin="Generated by Gradle"/>
+      <component group="org.jetbrains.kotlin" name="kotlin-reflect" version="1.7.22">
+         <artifact name="kotlin-reflect-1.7.22.jar">
+            <sha256 value="4d4471d1cbc203d3f9e51d6123956dddbb96d5747f1aee02463c7b920feb2baf" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="kotlin-reflect-1.8.10.pom">
-            <sha256 value="8530d0707113ea20bf6f4f1562119a31bce760a56910ac155f16cae818997d17" origin="Generated by Gradle"/>
+         <artifact name="kotlin-reflect-1.7.22.pom">
+            <sha256 value="e8872fc76b139645d07c17da3b3c71829410630b16cb108f74cd74bed634ca71" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.jetbrains.kotlin" name="kotlin-reflect" version="1.9.20">