Which jackson-databind version correctly depends on jackson-core 2.15.0+ to fix SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754?

[MahogaWeerasinghe]

Hello Jackson team,

We're using jackson-databind 2.19.1, which appears to have a transitive dependency on the vulnerable jackson-core 2.14.3 instead of a fixed version (2.15.0+).

So which version of jackson-databind properly depends on jackson-core 2.15.0 or later?

Vulnerability Report: https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754

[cowtowncoder]

jackson-databind 2.19.1 definitely does not depend on 2.14.3 of jackson-core but 2.19.1: versions of databind and core should always much wrt minor version at least.
In fact 2.19 databind is unlikely to work with 2.14 of jackson-core.

So I suggest you first figure out how to use matching jackson-core version.