Question: Does jackson-dataformat-yaml support snakeyaml 2.x?

[wilx]

Does jackson-dataformat-yaml support snakeyaml 2.x? Their change log (https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes) mentions multiple "Backwards-incompatible" items. I need to update snakeyaml to fix vulnerabilities.

[yawkat]

yes it does

[yawkat]

please see #369, #405 and the issues linked from there for more information

[cowtowncoder]

And specifically, 2.14.2 does work with 2.0, as will upcoming 2.15.0. There was one backwards-incompatible change for earlier versions.

Also: as usual, please note that Jackson did not expose any of reported SnakeYAML vulnerabilities so the main (... only) reason for upgrade is to silence false warning by security scanning tools. Meaning that there is no vulnerability being fixed; there is just compliancy to satisfy tools that cannot express conditional vulnerabilities.