From 2ee786633b602c5220f2372fe0c724c3a9d420a2 Mon Sep 17 00:00:00 2001
From: Takahiro Nagao <nagao.takahiro@fujitsu.com>
Date: Mon, 11 Jul 2022 13:50:06 +0900
Subject: [PATCH] Update jackson-databind and commons-codec

---
 launcher-impl/glassfish/pom.xml | 11 +++++++++++
 pom.xml                         | 14 ++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/launcher-impl/glassfish/pom.xml b/launcher-impl/glassfish/pom.xml
index e7e334f..030b32d 100644
--- a/launcher-impl/glassfish/pom.xml
+++ b/launcher-impl/glassfish/pom.xml
@@ -339,6 +339,17 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <!-- Use newer jackson-databind for security fix -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
         <dependency>
             <groupId>org.glassfish.main.extras</groupId>
             <artifactId>glassfish-embedded-web</artifactId>
diff --git a/pom.xml b/pom.xml
index e5da304..e3bc9ab 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,6 +100,8 @@
         <concurrent-api.version>2.0.0</concurrent-api.version>
         <concurrent-ri.version>2.0.0</concurrent-ri.version>
         <jakarta.validation.version>3.0.0</jakarta.validation.version>
+        <jackson.databind.version>2.13.2.2</jackson.databind.version>
+        <commons.codec.version>1.13</commons.codec.version>
     </properties>
 
     <dependencyManagement>
@@ -407,6 +409,18 @@
                 <artifactId>jakarta.validation-api</artifactId>
                 <version>${jakarta.validation.version}</version>
             </dependency>
+            <!-- jackson -->
+            <dependency>
+                <groupId>com.fasterxml.jackson.core</groupId>
+                <artifactId>jackson-databind</artifactId>
+                <version>${jackson.databind.version}</version>
+            </dependency>
+            <!-- commons-codec -->
+            <dependency>
+                <groupId>commons-codec</groupId>
+                <artifactId>commons-codec</artifactId>
+                <version>${commons.codec.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>