Jackson-databind: Version 2.9.9.1 is not available on Maven central

[victornoel]

I saw a security-related release was made some weeks ago, 2.9.9.1, but I can't find it on Maven Central.

[cowtowncoder]

It's here:

http://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.9.9.1/

But perhaps you were assuming that all components had 2.9.9.1? This is not the case, micro-patches (version with 4th digit) are ONLY point releases for specific components. So only jackson-databind has been released. Eventually there will be 2.9.10 once there are more meaningful fixes, but right now there's just this "override"

[victornoel]

@cowtowncoder indeed, sorry for the confusion, apparently I'm not the only one, see https://github.com/jdbi/jdbi/pull/1562 and https://github.com/FasterXML/jackson-bom/issues/21 for example

[cowtowncoder]

@victornoel No I understand, it's... not that obvious a thing. Given that there are now 2 new reports, but not many other fixes to 2.9, I will probably do another micro-patch, and this time also do matching -bom release to help with version sets.