[Snyk] Security upgrade org.jboss.resteasy:resteasy-jackson2-provider from 3.0.11.Final to 6.2.0.Final

[snyk-io]

Snyk has created this PR to fix 8 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• samples/server/petstore/jaxrs-resteasy/eap-joda/pom.xml

---

This is a major upgrade from version 3.x to 6.x, which includes multiple significant breaking changes. The most critical change is the migration from Java EE to Jakarta EE, requiring a codebase-wide package name change.

Breaking Changes:

• Jakarta EE Namespace Migration: RESTEasy 6.x implements Jakarta REST 3.x, which means all javax.* package imports must be changed to jakarta.*. For example, javax.ws.rs.Path becomes jakarta.ws.rs.Path. [4, 8, 11]
• Module Reorganization: Support for Spring and MicroProfile has been moved to separate projects. You will need to update your build dependencies to include artifacts like org.jboss.resteasy.spring:resteasy-spring or org.jboss.resteasy.microprofile:microprofile-rest-client if you use these features. [2, 4]
• Removed Modules & Classes: Many deprecated classes and modules from version 3.x were removed in 4.x, including providers for Jettison and Jackson 1. [5, 13]

Source: RESTEasy Documentation and Release Announcements

Recommendation: This upgrade requires a significant migration effort. Plan to refactor your application's imports from javax.* to jakarta.* and update your project's dependencies to account for the reorganized modules.

Notice 🤖: This content was generated using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

---

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426	243	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade Reachable Proof of Concept
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424	146	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade No Path Found Proof of Concept
	XML External Entity (XXE) Injection SNYK-JAVA-COMFASTERXMLJACKSONCORE-1048302	133	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final No Path Found No Known Exploit
	Stack-based Buffer Overflow SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754	124	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade No Path Found No Known Exploit
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244	115	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade No Path Found No Known Exploit
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538	115	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade No Path Found No Known Exploit
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698	101	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade No Path Found No Known Exploit
	Information Exposure SNYK-JAVA-COMFASTERXMLJACKSONCORE-10332631	55	org.jboss.resteasy:resteasy-jackson2-provider: 3.0.11.Final -> 6.2.0.Final Major version upgrade No Path Found Proof of Concept

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Information Exposure
🦉 Denial of Service (DoS)
🦉 XML External Entity (XXE) Injection

[snyk-io]

⛔ Snyk checks have failed. 3 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (3)
⛔	Open Source Security	0	0	3	0	3 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.