Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,11 @@ Currently included are:

## Status

[![Build Status](https://travis-ci.org/FasterXML/jackson-modules-base.svg)](https://travis-ci.org/FasterXML/jackson-modules-base)
[![Build Status](https://api.travis-ci.com/FasterXML/jackson-modules-base.svg)](https://app.travis-ci.com/FasterXML/jackson-modules-base)

## License

All modules are licensed under [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0.txt).
All modules are licensed under [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.txt).

Additionally, 2.x versions of `Afterburner` and `Mr Bean` use [ASM](https://gitlab.ow2.org/asm/asm),
licensed as per:
Expand Down
2 changes: 1 addition & 1 deletion SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ wiki page
## Reporting a Vulnerability

The recommended mechanism for reporting possible security vulnerabilities follows
so-called "Coordinated Disclosure Plan" (see [definition of DCP](https://vuls.cert.org/confluence/display/Wiki/Coordinated+Vulnerability+Disclosure+Guidance)
so-called "Coordinated Disclosure Plan" (see [definition of DCP](https://certcc.github.io/confluence/display/Wiki/Coordinated+Vulnerability+Disclosure+Guidance/)
Copy link
Copy Markdown
Member

@cowtowncoder cowtowncoder May 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per Claude review:


SECURITY.md CERT link — trailing slash and shaky destination. The new URL is
https://certcc.github.io/confluence/display/Wiki/Coordinated+Vulnerability+Disclosure+Guidance/ — a Confluence-style path served from GitHub Pages, ending in /. It currently returns 200 because it's the redirect target of the old vuls.cert.org URL, but this looks like a mirror that may not be stable long-term.

The canonical CERT/CC guidance now lives at https://www.cert.org/vulnerability-analysis/vul-disclosure.cfm or under CMU SEI.

Worth double-checking with maintainers whether they'd prefer the SEI page; at minimum, the trailing slash on a Confluence-style URL is suspicious.

...

Consider replacing with the SEI CERT/CC page (e.g. https://www.cert.org/vulnerability-analysis/vul-disclosure.cfm or
https://insights.sei.cmu.edu/.../coordinated-vulnerability-disclosure-process/) instead — those are more likely to outlive a GitHub Pages mirror.

for general idea). The first step is to file a [Tidelift security contact](https://tidelift.com/security):
Tidelift will route all reports via their system to maintainers of relevant package(s), and start the
process that will evaluate concern and issue possible fixes, send update notices and so on.
Expand Down
4 changes: 2 additions & 2 deletions afterburner/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ There is, however, a potential future replacement available (as of Jackson 2.12)
See the parent README for details.

[![Maven Central](https://img.shields.io/maven-central/v/tools.jackson.module/jackson-module-afterburner.svg?label=Maven%20Central)](https://central.sonatype.com/artifact/tools.jackson.module/jackson-module-afterburner)
[![Javadoc](https://javadoc.io/badge/tools.jackson.module/jackson-module-afterburner.svg)](http://www.javadoc.io/doc/tools.jackson.module/jackson-module-afterburner)
[![Javadoc](https://javadoc.io/badge2/tools.jackson.module/jackson-module-afterburner/javadoc.svg)](https://javadoc.io/doc/tools.jackson.module/jackson-module-afterburner)

## Usage

Expand All @@ -29,7 +29,7 @@ To use module on Maven-based projects, use following dependency:

### Non-Maven

For non-Maven use cases, you download jars from [Central Maven repository](http://repo1.maven.org/maven2/tools/jackson/module/jackson-module-afterburner/).
For non-Maven use cases, you download jars from [Central Maven repository](https://repo1.maven.org/maven2/tools/jackson/module/jackson-module-afterburner/).

Module jar is also a functional OSGi bundle, with proper import/export declarations, so it can be use on OSGi container as is.

Expand Down
2 changes: 1 addition & 1 deletion blackbird/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

_Upgrade your Afterburner for your Java 11+ Environment 🚀_

The [Afterburner](https://github.com/FasterXML/jackson-modules-base/tree/master/afterburner)
The [Afterburner](../afterburner/)
has long been your engine of choice for maximum Jackson performance.
But in the brave new Java 11 world, the trusty Afterburner is showing its age.
It uses horrifying bytecode manipulation and cracks `Unsafe.defineClass` which will
Expand Down
4 changes: 2 additions & 2 deletions mrbean/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Mr Bean is an extension that implements support for "POJO type materialization";
ability for [databinder](jackson-databind) to construct implementation classes for Java interfaces and abstract classes, as part of deserialization.
Extension plugs in using standard `Module` interface, and requires Jackson 2.0 or above.

Module is licensed under [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0.txt)
Module is licensed under [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.txt)

[![Maven Central](https://img.shields.io/maven-central/v/tools.jackson.module/jackson-module-mrbean.svg?label=Maven%20Central)](https://central.sonatype.com/artifact/tools.jackson.module/jackson-module-mrbean)

Expand Down Expand Up @@ -68,7 +68,7 @@ Note: this works transitively as well, meaning that implementation classes will

Module implements Jackson's `AbstractTypeResolver` interface and registers it via Module interface. This is how it gets invoked when an abstract type is encountered, which is problematic for deserialization (unless polymorphic handling is enabled; see the next section).

Actual byte code generation uses [ASM](http://asm.ow2.org/) library, and simply generates methods for all abstract methods.
Actual byte code generation uses [ASM](https://asm.ow2.io/) library, and simply generates methods for all abstract methods.
No naming convention is required; basic signature is enough. This means that zero-argument methods are considered "getters" and one-argument methods "setters".
Naming is considered to be able to generate internal field; but beyond this naming is of no consequence.
Annotations are not introspected at this point; however, Jackson databinding will make use of them later on -- typically annotations from implemented interface or abstract class get used, as no annotations are added to the implementation classes.
Expand Down
2 changes: 1 addition & 1 deletion osgi/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
This module provides a way to inject OSGI services into deserialized objects.
Thanks to the _JacksonInject_ annotations, the _OsgiJacksonModule_ will search for the required service in the OSGI service registry and injects it in the object while deserializing.

Module is licensed under [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0.txt)
Module is licensed under [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.txt)

## Usage

Expand Down