Merge pull request yahoo#608 from alexey-kotlyar/upgrade-jackson-to-2…

….9.6 Update json4s to 3.6.3 to get rid of vulnerable jackson version
lukehuang · Jan 23, 2019 · f671f1b · f671f1b
2 parents 151953d + 38f934e
commit f671f1b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/build.sbt b/build.sbt
@@ -30,8 +30,8 @@ libraryDependencies ++= Seq(
   "org.webjars" % "dustjs-linkedin" % "2.6.1-1",
   "org.apache.curator" % "curator-framework" % "2.10.0" exclude("log4j","log4j") exclude("org.slf4j", "slf4j-log4j12") force(),
   "org.apache.curator" % "curator-recipes" % "2.10.0" exclude("log4j","log4j") exclude("org.slf4j", "slf4j-log4j12") force(),
-  "org.json4s" %% "json4s-jackson" % "3.4.0",
-  "org.json4s" %% "json4s-scalaz" % "3.4.0",
+  "org.json4s" %% "json4s-jackson" % "3.6.3",
+  "org.json4s" %% "json4s-scalaz" % "3.6.3",
   "org.slf4j" % "log4j-over-slf4j" % "1.7.12",
   "com.adrianhurt" %% "play-bootstrap3" % "0.4.5-P24",
   "org.clapper" %% "grizzled-slf4j" % "1.0.2",