[Snyk] Upgrade org.glassfish.jersey.core:jersey-common from 2.29.1 to 2.48

[snyk-io]

Snyk has created this PR to upgrade org.glassfish.jersey.core:jersey-common from 2.29.1 to 2.48.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 21 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Information Disclosure SNYK-JAVA-ORGGLASSFISHJERSEYCORE-1255637	114	No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[snyk-io]

This upgrade of org.glassfish.jersey.core:jersey-common from version 2.29.1 to 2.48 spans a significant number of minor releases and includes several documented changes that require developer attention.

Key Changes:

• OpenTracing Dependency (v2.38): A breaking change was introduced in version 2.38. Jersey updated its Open Tracing dependency to a new version (0.33.0) which is not compatible with the previous one (0.30.0). If your project uses Jersey's Open Tracing integration, you must update your Open Tracing dependencies accordingly.
• Jackson JSON Parsing Limits (v2.41): Starting with version 2.41, which supports Jackson 2.15, default limits are imposed on the length of parsed JSON text, numbers, and nesting depth. This is a potential behavioral change that could affect applications processing large JSON payloads, possibly causing unexpected parsing errors.
• Jakarta EE Migration (v2.29.1): Your starting version, 2.29.1, was the first to migrate from javax.* to jakarta.* namespaces as part of the move to Jakarta EE 8. This upgrade continues that path, but applications should already be compliant with this change.

Recommendation:

• Verify OpenTracing Usage: Check if your project utilizes jersey-opentracing and, if so, ensure your Open Tracing dependencies are updated to version 0.33.0 or later.
• Test JSON Processing: Thoroughly test endpoints that handle large or complex JSON payloads to ensure they are not affected by the new default parsing limits introduced in version 2.41.

Source: Jersey 2.x Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.