Is the upgrade to Snakeyaml 2.0 safe?

[dave2wave]

I noticed that Apache jclouds just reverted their upgrade to snakeyaml 2.0 - See
See apache/jclouds@cf4a926

There are several PRs recently applied to Pulsar to do a similar upgrade. I think that these updates may be cherry picked which might be a problem.

[tisonkun]

I remember there is a jackson imcompatible issue. cc @Technoboy- @mattisonchao

[hezhangjian]

IIRC, jackson also upgrade to snakeyaml 2.0 in 2.15.0

[tisonkun]

Yes. You remind me of the whole story:

• Jackson 2.14.x doesn't bump to snakeyaml 2.0. Pulsar depends on 2.14.2 now. Then in some modules the snakeyaml version will be resolved to < 2.0.
• We ever bumped the version of jackson but later revert it due to regression:
  • [improve][build] Upgrade jackson version to 2.15.0 for CVE-2022-1471 #20177
  • [improve][build] Revert "Upgrade jackson version to 2.15.0 for CVE-2022-1471 (#20177)" #20182