bad jackson version

[Grimoren]

Describe the bug
A clear and concise description of what the bug is.

Could not resolve all artifacts for configuration ':classpath'.

Could not find com.fasterxml.jackson:jackson-bom:2.13.2.1.
Searched in the following locations:
- https://artifacts.apple.com/plugins-release/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
- https://artifacts.apple.com/plugins-snapshot/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
Required by:
project : > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1
Could not find com.fasterxml.jackson:jackson-bom:2.13.2.1.
Searched in the following locations:
- https://artifacts.apple.com/plugins-release/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
- https://artifacts.apple.com/plugins-snapshot/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
Required by:
project : > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1 > com.fasterxml.jackson.core:jackson-annotations:2.13.2
project : > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1 > com.fasterxml.jackson.core:jackson-core:2.13.2

Version of dependency-check used
The problem occurs using version 7.0.2 of the gradle (cli, gradle plugin, maven plugin, etc.)

Log file

Could not resolve all artifacts for configuration ':classpath'.

Could not find com.fasterxml.jackson:jackson-bom:2.13.2.1.
Searched in the following locations:
- https://artifacts.apple.com/plugins-release/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
- https://artifacts.apple.com/plugins-snapshot/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
Required by:
project : > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1
Could not find com.fasterxml.jackson:jackson-bom:2.13.2.1.
Searched in the following locations:
- https://artifacts.apple.com/plugins-release/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
- https://artifacts.apple.com/plugins-snapshot/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
Required by:
project : > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1 > com.fasterxml.jackson.core:jackson-annotations:2.13.2
project : > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1 > com.fasterxml.jackson.core:jackson-core:2.13.2

To Reproduce
Steps to reproduce the behavior:

1. executing latest dependencyCheck gives this error.

Expected behavior
No error when executing

Additional context
Add any other context about the problem here.

[Grimoren]

https://github.com/jeremylong/DependencyCheck/pull/4281/files

[philsegal]

2.13.2.2 has been released and works when manually imported. Can a bumped version of this project be released?

[pkubowicz]

I don't see this being fixed.

% cat build.gradle 
plugins {
    id('org.owasp.dependencycheck') version '7.0.2'
}

repositories {
    mavenCentral()
}
% gradle tasks

FAILURE: Build failed with an exception.

* What went wrong:
A problem occurred configuring root project 'springboot265'.
> Could not resolve all files for configuration ':classpath'.
   > Could not find com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Searched in the following locations:
       - https://plugins.gradle.org/m2/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom
     If the artifact you are trying to retrieve can be found in the repository but without metadata in 'Maven POM' format, you need to adjust the 'metadataSources { ... }' of the repository declaration.
     Required by:
         project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:7.0.2 > org.owasp:dependency-check-gradle:7.0.2 > org.owasp:dependency-check-core:7.0.2 > com.fasterxml.jackson.core:jackson-databind:2.13.2.1

When I change the version to 7.0.3 I get:

Plugin [id: 'org.owasp.dependencycheck', version: '7.0.3'] was not found in any of the following sources:

https://plugins.gradle.org/plugin/org.owasp.dependencycheck does not show release 7.0.3.

[jeremylong]

@pkubowicz - that is because you didn't use 7.0.3. I was interrupted during the release process this morning and only just now was able to push the updated version.

[jrmcdonald]

Hi @jeremylong, I appreciate that this issue is closed, I just noticed that the build of dependency check gradle failed due to the jackson-databind invalid metadata issue in 2.13.2.1

My apologies if you are already aware of this but jackson released a new version of the bom (jackson-bom:2.13.2.20220328) which addresses the issue with jackson-databind by referencing the newly released 2.13.2.2. Details are here:

FasterXML/jackson-databind#3428 (comment)

[jeremylong]

@jrmcdonald thanks - I guess I'll be release 7.0.4 tomorrow.... ugh.

[jeremylong]

the release build worked locally...

[jrmcdonald]

No worries, it's been confusing trying to keep up with the versions. As another FYI, the jackson maintainers have stated that they've published a version 2.13.2.1 of jackson-bom, which should fix the the issue for 2.13.2.1 of jackson-databind.

FasterXML/jackson-bom#52 (comment)

It doesn't seem to be on maven yet (at least as of 09:50 BST).