Jackson 2.6.6 critical bug

[aniltoshniwal]

As per, FasterXML/jackson-databind#849

AFIK, aws_java_sdk_s3 version 1.11.34 is using jackson 2.6.6.

[varunnvs92]

We will have to do some tests to understand the criticality of the bug. I will discuss with the team and update you. As of now, we have not heard any customer issues due to this.

[fernomac]

Shouldn't affect the SDK directly, but might be worth double checking that you are and remain runtime-compatible with 2.5.x so consumers who also use jackson-databind directly and are broken by this change can still pick up newer versions of the SDK in the meantime.

[varunnvs92]

We are not using the affected "NON_EMPTY" option in the SDK, so it shouldn't affect the SDK directly as @fernomac mentioned.

Customers who are broken by this change should be able to use Jackson-databind 2.7 along with Java SDK. Unfortunately they cannot use 2.5.x as the SDK uses new features introduced in 2.6.x.

Closing this issue as the SDK is not affected. Please let me know if you have more questions. Thank you for bringing this issue to our notice.