Use explicit jackson-bom dependencies to control Jackson versions

Author: emlun

NEWS

@@ -2,8 +2,9 @@
 
 Fixes:
 
-* Removed version constraints on non-core Jackson modules; Jackson ships its own
-  BOM constraints to align module versions.
+* Added explicit `dependencyManagement` dependencies on `jackson-bom`, and
+  replaced version constraints on other Jackson modules with version constraint
+  on `jackson-bom`.
 * Fixed incompatibility with Jackson version 2.15.0-rc1 and later.
 * Fixed linking issue when running in Java 8.
 

build.gradle

@@ -33,7 +33,7 @@ wrapper {
 dependencies {
   constraints {
     api('com.augustcellars.cose:cose-java:[1.0.0,2)')
-    api('com.fasterxml.jackson.core:jackson-databind:[2.13.2.1,3)')
+    api('com.fasterxml.jackson:jackson-bom:[2.13.2.1,3)')
     api('com.google.guava:guava:[24.1.1,32)')
     api('com.upokecenter:cbor:[4.5.1,5)')
     api('org.apache.httpcomponents.client5:httpclient5:[5.0.0,6)')

webauthn-server-attestation/build.gradle.kts

@@ -30,6 +30,7 @@ dependencies {
 
   api(project(":webauthn-server-core"))
 
+  implementation(platform("com.fasterxml.jackson:jackson-bom"))
   implementation(project(":yubico-util"))
   implementation("com.fasterxml.jackson.core:jackson-databind")
   implementation("org.slf4j:slf4j-api")

webauthn-server-core/build.gradle.kts

@@ -15,6 +15,7 @@ description = "Yubico WebAuthn server core API"
 dependencies {
   api(platform(rootProject))
 
+  implementation(platform("com.fasterxml.jackson:jackson-bom"))
   implementation(project(":yubico-util"))
   implementation("com.augustcellars.cose:cose-java")
   implementation("com.fasterxml.jackson.core:jackson-databind")

yubico-util/build.gradle.kts

@@ -16,6 +16,7 @@ dependencies {
   api(platform(rootProject))
 
   api("com.fasterxml.jackson.core:jackson-databind")
+  api(platform("com.fasterxml.jackson:jackson-bom"))
 
   implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-cbor")
   implementation("com.fasterxml.jackson.datatype:jackson-datatype-jdk8")