There is a vulnerability in Jackson Core 2.9.6 ,upgrade recommended

[QiAnXinCodeSafe]

geometry-api-java/pom.xml

Lines 112 to 117 in a1af661

	<dependency>
	<groupId>com.fasterxml.jackson.core</groupId>
	<artifactId>jackson-core</artifactId>
	<version>${jackson.version}</version>
	<optional>false</optional>
	</dependency>

Reference source:FasterXML/jackson-core#488

[stolstov]

@randallwhitman fyi

[randallwhitman]

The deployed version of Jackson would matter more than the compile-dependency version. In production, one should almost always deploy a newer version than the declared compile-time dependency.
That said, Jackson-2.10 finally resolves the issue underlying the perpetual jackson-databind vulnerabilities.