Move from com.sun.jersey to org.glassfish.jersey

[leventov]

com.sun.jersey groupID seems to be legacy and not going to be updated anymore. See https://github.com/jersey/jersey

[pjfanning]

@FrankChen021 could this be marked as a security issue - jersey v1 depends on jackson v1 which has security issues

https://mvnrepository.com/artifact/com.sun.jersey/jersey-json/1.19.4

The jackson v1 security issues are probably far greater than the 1 that is official. Dozens of CVEs have been fixed in jackson v2.

[FrankChen021]

Oh god, so old this issue is.

[FrankChen021]

From this hint on this page, jersey-json is moved to org.glassfish.jersey.core. But I don't see such artifact under that group id.

I have not looked through the CVEs yet. To upgrade the jersey-json, which jersey version are you suggestting to use? The latest 3.0.4?

I don't if it's easy for us to upgrade from current 1.19.4 to 3.0.4. @pjfanning

[pjfanning]

Fair enough. There are some risks in not upgrading but I appreciate there is effort involved. This page describes how JSON support works in jersey v2 - https://cassiomolin.com/2016/08/10/using-jackson-as-json-provider-in-jersey-2x/

[github-actions]

This issue has been marked as stale due to 280 days of inactivity.
It will be closed in 4 weeks if no further activity occurs. If this issue is still
relevant, please simply write any comment. Even if closed, you can still revive the
issue at any time or discuss it on the dev@druid.apache.org list.
Thank you for your contributions.

[github-actions]

This issue has been closed due to lack of activity. If you think that
is incorrect, or the issue requires additional review, you can revive the issue at
any time.