I have a Java project where I am using jackson-databind:2.10.2
IntelliJ is warning that this version has a vulnerability and is recommending I update to 2.13.4.1
My question is how I should make sure that the new version is backward compatible?
9
The only way you can be sure is by testing your application. Check that everything works as intended.
Yes, this is hard and tedious work but the only way to be sure. Therefore lazy programmers before you have found a way to capture this in code that can be run at will. Unfortunately this is hard and tedious work too, but it pays off in the long run as you will need to upgrade on a regular basis.
First and foremost, you need to check the version. Jackson follows semantic versioning:
Given a version number MAJOR.MINOR.PATCH, increment the:
- MAJOR version when you make incompatible API changes
- MINOR version when you add functionality in a backward compatible manner
- PATCH
version when you make backward compatible bug fixes
Only the minor version has been incremented, so the changes should be backwards compatible.
The only way to be absolutely certain is testing – preferably good coverage with unit tests. If you don’t have enough tests, you will need to test manually.
Some approaches I have used in the past
Automation Tests
What would you say is the reliability of your service’s automation tests? That could serve as a quality assurance of your update.
Release Notes
Generally well reputed libraries like the ones mentioned above maintain any disruptive changes well documented in their release notes.
Compilation Logs / Linting checks
Sometime the maven compiler will throw warnings that have been intentionally added in the newly added libraries that can add hints on behaviours that may have changed. I would compare the builds logs before and after the change and review any such changes
Apologies, I am unaware of any tools that can warn in realtime as you make the change or in compile time.