Jackson 2.10.0

[barchetta]

Upgrade Jackson to 2.10.0. This should reduce the stream of CVE patches. For more details see

https://medium.com/@cowtowncoder/jackson-2-10-features-cd880674d8a2

[barchetta]

Hmmm...I've seen what looks to be a webserver crash both in the pipeline and now on my local machine with this change. Investigating...

[barchetta]

I've reproduced a failure locally:

java.lang.NoClassDefFoundError: com/fasterxml/jackson/core/TSFBuilder
        at io.smallrye.openapi.runtime.io.OpenApiSerializer.serialize(OpenApiSerializer.java:106)
        at io.helidon.openapi.OpenAPISupport.formatDocument(OpenAPISupport.java:224)

Looks like this class might not exist in 2.10.

[ljnelson]

Hmm, no, TSFBuilder exists only in 2.10 and later (see http://fasterxml.github.io/jackson-core/javadoc/2.10/com/fasterxml/jackson/core/TSFBuilder.html).

[barchetta]

OK, the problem was microprofile/tests/tck/tck-opentracing depends on Jackson 2.9.0 and implements this dependency in source using shrinkwrap. Due to a bug in shrinkwrap having to do with proxies, we added some explicit dependencies in the pom to trigger downloads so we don't hit the proxy bug.

Because of the above we ended up with a combination of Jackson 2.10.0 and 2.9.0 on the classpath leading to issues. The work-around is to force the use of Jackson 2.9.0 for this test.

With this change the pipeline is passing.