Upgrade to Jackson 2.17

[kozell]

Hi,

It seems that the used Jackson version of 2.12.7 in dependency management is quite old (released over 2 years ago), and that version is no longer maintained (as that was the last in that series).

Can we upgrade to the Jackson 2.17.x line?

(If yes, I'll do the PR.)

Thanks,
Joe

[lhazlewood]

Hi Joe - thanks for discussing first!

I'd definitely appreciate a PR, but it'll have to pass our build/CI matrix (naturally), and that includes JDK 7, so as long as that all passes, we're fine.

Thanks!

[kozell]

JDK 7?

Yeah, there will be a problem with this upgrade, then...

https://github.com/FasterXML/jackson-core/blob/jackson-core-2.17.1/pom.xml#L37 says:

<!-- 03-May-2022: Change Java compatibility for Jackson-Core 2.14 from Java6 to Java8,
   still use Moditect to get JDK9+ module info support; need newer bundle plugin as well
   (can just defaults from `jackson-parent`)
  -->

So this request seems like a big no.

[lhazlewood]

We're trying to get off of JDK 7 as soon as feasible, we're just not there yet.

[lhazlewood]

P.S. Don't forget you're always able to exclude the JJWT Jackson dependency in maven/gradle and explicitly define the Jackson version you prefer within your project's build configuration. If you use Jackson in your own application elsewhere (outside of JJWT's needs), this is a best practice anyway since you won't be 'surprised' when you upgrade a library that depends on Jackson.

[kozell]

Yes, we already do the exclusion way.

Is there an open issue for the JDK7 removal?

[lhazlewood]

Yes, there are a few issues labeled as jdk8. However, we cannot work on any of them until non-compact JWTs (i.e. full JSON, not comma-delimited) is finished. That's the last feature required before moving to 1.0, at which time we'll remove JDK 7 compatibility.