[orbit-dev] Intent to upgrade Jackson stack from 2.6.2 to 2.8.9 for Phot

[Roland Grunberg <rgrunber@xxxxxxxxxx>]

Due to https://github.com/FasterXML/jackson-databind/issues/1599 and many consumers choosing the option of upgrading to 2.8.9, I think it makes sense to do the same in Orbit. By default, consumers shouldn't be vulnerable unless they enable default typing.

Looking at the bundles themselves, there don't appear to be any new dependencies and it should not require any changes other than to just ensure builds are made to take the newer version.

I've CC'd those that have a Piggy-Back CQ against Orbit's jackson-databind 2.6.2 in the hopes that if there's any known issues with such a change, we'll know about them sooner.

Cheers,

Roland Grunberg