[iot-pmc] [CQ 22960] com.fasterxml.jackson.core:jackson-databind:2.11.3

[emo-ip-team@xxxxxxxxxxx]

http://dev.eclipse.org/ipzilla/show_bug.cgi?id=22960





--- Comment #6 from Kai Hudalla <kai.hudalla@xxxxxxxx>  2021-01-18 09:51:38 ---
(In reply to comment #5)
> Hi Kai,
> 
> thanks a lot for pointing me to the Dash Tool. Didn't know that it exists.
> Awesome! However since I have quite a long list of updated dependencies to
> check, I'd like to sort this out and safe both of us quite some time dealing
> with not required CQs :)
> 
> I followed the Handbook (cf.
> https://www.eclipse.org/projects/handbook/#ip-prereq-versions):  
> 
> > [...] project teams are required to engage the due diligence process with each separate version of Prerequisite content they require.
> > This applies specifically to major and minor versions of prerequisites. [...] If a project team isn’t sure whether or not a particular
> > release is a service release, they should submit the content for review by the IP Team
> 
> I only found CQ21968 for jackson-databind in version 2.10.3, Clearly Defined
> score is too low and I'm not 100% sure that 2.11.3 is a service release, hence
> I had the impression that filing a CQ is required. Did I missed something? 
> 
> You're totally right, I run Dash Tool against hawkBit and indeed jackson
> databind is not listed as "requires review".
> 
> Thanks a lot for your advice!
> 
> /Dominic
> 

Then you can withdraw this CQ (and the other jackson related ones), I guess ...


-- 
Configure CQmail: http://dev.eclipse.org/ipzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the CQ.