bump jackson versions

Author: frantuma

modules/swagger-jaxrs/pom.xml

@@ -132,7 +132,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-version}</version>
+            <version>${jackson-databind-version}</version>
             <exclusions>
                 <exclusion>
                     <groupId>com.fasterxml.jackson.core</groupId>
@@ -149,6 +149,10 @@
                     <groupId>com.fasterxml.jackson.core</groupId>
                     <artifactId>jackson-annotations</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>jakarta.activation</groupId>
+                    <artifactId>jakarta.activation-api</artifactId>
+                </exclusion>
             </exclusions>
             <scope>test</scope>
         </dependency>

pom.xml

@@ -518,7 +518,7 @@
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>${jackson-version}</version>
+                <version>${jackson-databind-version}</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.dataformat</groupId>
@@ -621,7 +621,12 @@
         <servlet-api-version>2.5</servlet-api-version>
         <jersey-version>1.13</jersey-version>
         <jersey2-version>2.25.1</jersey2-version>
-        <jackson-version>2.11.1</jackson-version>
+        <jackson-version>2.13.2</jackson-version>
+        <!--
+            jackson-databind 2.13.2 is still affected by CVE-2020-36518.
+            This version pin for jackson-databind can be removed when bumping jackson to 2.14
+        -->
+        <jackson-databind-version>2.13.2.2</jackson-databind-version>
         <logback-version>1.2.9</logback-version>
         <reflections-version>0.9.11</reflections-version>
         <guava-version>31.0.1-android</guava-version>