any plans to addresslatest CVEs thanks

[SteveS7777]

any plans to address the 2 latest jackson-databind CVEs? Apcache Commons-text CVE? thanks

[hmottestad]

Which versions are affected? What is the minimum version we need to upgrade to?

[SteveS7777]

for Jackson-databind it is 2.13.4.2, for apache commons text 1.10.0. thank you

…

________________________________ From: Håvard M. Ottestad ***@***.***> Sent: Monday, October 31, 2022 4:27 PM To: eclipse/rdf4j ***@***.***> Cc: Steve Serra ***@***.***>; Author ***@***.***> Subject: [External] : Re: [eclipse/rdf4j] any plans to addresslatest CVEs thanks (Discussion #4260) Which versions are affected? What is the minimum version we need to upgrade to? — Reply to this email directly, view it on GitHub<https://urldefense.com/v3/__https://github.com/eclipse/rdf4j/discussions/4260*discussioncomment-4022169__;Iw!!ACWV5N9M2RV99hQ!OYgSIGeu37B3_JuHSKR0--0skzzWkFQHz02XH8nEhqxZDWXnE9ZAXY0P_7yADWj2bTrSuSSJJQHjaS-JWXEAM7m3QQ$>, or unsubscribe<https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/A2P4WEL36DWSQNGLAA3JR3TWGATTRANCNFSM6AAAAAARTGLWOE__;!!ACWV5N9M2RV99hQ!OYgSIGeu37B3_JuHSKR0--0skzzWkFQHz02XH8nEhqxZDWXnE9ZAXY0P_7yADWj2bTrSuSSJJQHjaS-JWXECoQYMnw$>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[barthanssens]

Thanks for the heads-up. The Apache Commons Text is at 1.10.0 in the main tree, so should be in the next patch release

[barthanssens]

Also upgrading to jackson 2.13.4 and jackson-databind 2.13.4.2