[Snyk] Fix for 1 vulnerabilities

[chrislin22]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	710	io.vertx:vertx-core: 3.9.8 -> 4.5.28 Major version upgrade No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade com.fasterxml.jackson.dataformat:jackson-dataformat-yaml@2.16.0 to com.fasterxml.jackson.dataformat:jackson-dataformat-yaml@2.18.8; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/com/fasterxml/jackson/jackson-bom/2.16.0/jackson-bom-2.16.0.pom

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[chrislin22]

This upgrade includes a major version increase for io.vertx:vertx-core from 3.x to 4.x, which introduces significant breaking changes. The jackson-dataformat-yaml upgrade is minor but includes a behavioral change that requires verification.

Top 2 Most Impactful Upgrades

• io.vertx:vertx-core from 3.9.8 to 4.5.28 (High Risk)
  This is a major upgrade with substantial breaking changes requiring code modifications. Developers must consult the official migration guide before upgrading.

  Key Breaking Changes:

  • Asynchronous Model: Vert.x 4 fully embraces Future-based asynchronous operations. While callback-based methods are still present to ease migration, many new and existing APIs now return Futures.
  • API Removals: Numerous methods deprecated in Vert.x 3 have been removed. For example, EventBus.send() is replaced by EventBus.request(), and HttpServerRequest.upgrade() is replaced by the async toWebSocket().
  • WriteStream API Change: The write() and end() methods on WriteStream are no longer fluent (they do not return the stream instance). Code relying on chaining these calls will break.
  • Vert.x Web: Several interfaces and handler methods have been removed or refactored, such as cookie interfaces and methods for mounting sub-routers.
  • Optional Dependencies: jackson-databind is now an optional dependency and must be explicitly added to the project if its functionality is required.

  Recommendation: A dedicated effort is required to migrate the codebase. Review the official Vert.x 3 to 4 migration guide and address the deprecated API usage and breaking changes before merging this upgrade.

• com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.16.0 to 2.18.8 (Medium Risk)
  This upgrade spans minor versions and introduces a behavioral change that could impact applications.

  Key Changes:

  • Stricter Number Parsing: Starting in version 2.17, Jackson no longer coerces JSON strings with leading zeros (e.g., "07") into numbers. This stricter validation could cause MismatchedInputException in applications that relied on this behavior.
  • Kotlin Support: Version 2.18 drops support for Kotlin 1.7.

  Recommendation: Verify that your application does not rely on the lenient parsing of stringified numbers that was present in older versions. Test deserialization logic carefully after the upgrade.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.