#3 update to version 2.10.1
Merged 4 years ago by decathorpe. Opened 4 years ago by decathorpe.
Unknown source master  into  master

file modified
+9 -10
@@ -1,17 +1,11 @@

  Name:          jackson-annotations

- Version:       2.10.0

+ Version:       2.10.1

  Release:       1%{?dist}

  Summary:       Core annotations for Jackson data processor

  License:       ASL 2.0

- URL:           https://github.com/FasterXML/jackson-annotations

  

- # The upstream release of jackson-annotations @ 2.10.0 was botched a couple

- # of times; this suffix is necessary to pull the latest, correct, non-SNAPSHOT

- # 2.10.0 release.

- #

- # See: https://github.com/FasterXML/jackson-annotations/releases

- %global relsuffix -try-3

- Source0:       %{url}/archive/%{name}-%{version}%{relsuffix}.tar.gz

+ URL:           https://github.com/FasterXML/jackson-annotations

+ Source0:       %{url}/archive/%{name}-%{version}.tar.gz

  

  BuildRequires:  maven-local

  BuildRequires:  mvn(com.fasterxml.jackson:jackson-parent:pom:)
@@ -31,8 +25,10 @@

  This package contains API documentation for %{name}.

  

  %prep

- %setup -q -n %{name}-%{name}-%{version}%{relsuffix}

+ %setup -q -n %{name}-%{name}-%{version}

+ 

  %pom_remove_plugin "org.moditect:moditect-maven-plugin"

+ %pom_remove_plugin "org.sonatype.plugins:nexus-staging-maven-plugin"

  

  sed -i 's/\r//' LICENSE

  
@@ -52,6 +48,9 @@

  %license LICENSE

  

  %changelog

+ * Wed Nov 13 2019 Fabio Valentini <decathorpe@gmail.com> - 2.10.1-1

+ - Update to version 2.10.1.

+ 

  * Thu Oct 3 2019 Alexander Scheel <ascheel@redhat.com> - 2.10.0-1

  - Update to latest upstream release

  

file modified
+1 -1
@@ -1,1 +1,1 @@

- SHA512 (jackson-annotations-2.10.0-try-3.tar.gz) = a5549fbfd98a4be1cc59761f54670b52c5efee6e9ad2e53bdbb454cbd8a96fb8e566e9f22818919c3538ec7e66e48cbde06f49c3b1aa95886f0a9b091a90a5b6

+ SHA512 (jackson-annotations-2.10.1.tar.gz) = 718a23dfafed8390bcaeb98a50504076fcbb2a6c0491366ec91eeac4203dfc3eb3722f27a287919361a9da6e9ca820f3794f64e4de098bcab59a7762e18009e8

  • update to latest version (2.10.0 → 2.10.1)
  • drop workarounds for the botched release last time
  • remove useless nexus-staging-maven-plugin

All good test rebuilds here:

https://copr.fedorainfracloud.org/coprs/decathorpe/jackson-2.10.1-pr/monitor/

+1, let's ship this update.

Do we need to keep upgrading these in the future for this class of CVEs? My understanding is they're considering them less important now since they've deprecated the vulnerable functionality.

Not saying that we should quit updating these packages, just that they're of less importance now.

I agree, let's give this stuff a lower priority until we get security issues again.

Pull-Request has been merged by decathorpe

4 years ago
Metadata