[chrislin22]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-20059179	710	org.glassfish.jersey.media:jersey-media-json-jackson: 2.34 -> 4.0.3 Major version upgrade No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[chrislin22]

This is a major version upgrade from Jersey 2.x to 4.x, which spans two highly disruptive major releases (3.x and 4.x). This is a high-risk migration that requires significant code and environment changes.

Key Breaking Changes (Jersey 2.x → 3.x):

• Jakarta Namespace Migration: The most critical change is the migration from Java EE to Jakarta EE 9. All javax.* package imports must be refactored to the new jakarta.* namespace. This is a mandatory and extensive code modification. [1, 2, 11]
• Environment Requirements:
  • JDK Version: Jersey 3.1.0 and later require a minimum of Java 11, dropping support for Java 8. [1, 2]
  • Application Server: A Jakarta EE 9 (or newer) compatible application server is required, such as Tomcat 10+, Jetty 11+, or GlassFish 6+. [1, 2]
• API and Dependency Removals: Support for the older Jackson 1 library has been completely removed. [1, 2]

Key Breaking Changes (Jersey 3.x → 4.x):

• Jakarta EE 11: Jersey 4.0 is the reference implementation for Jakarta REST 4.0, which is part of the Jakarta EE 11 platform. [4, 6]

Recommendation:
This is not a drop-in replacement. A dedicated migration effort is required. Developers must:

1. Perform a codebase-wide refactoring of javax.* to jakarta.* imports.
2. Ensure the build environment and deployment targets are updated to at least JDK 11 and a compatible Jakarta EE application server.
3. Thoroughly test the application, as the underlying API implementations and dependencies have fundamentally changed.

Source: Jersey 3.x Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.