The latest version of Databricks-jdbc available through Maven (2.6.29) now has these two vulnerabilities:

• https://nvd.nist.gov/vuln/detail/CVE-2022-42004
• https://nvd.nist.gov/vuln/detail/CVE-2022-42003

All due to depending on and including in the jar the library jackson-databind 2.13.2.2.

Is there a possibility to have a new updated version of Databricks-jdbc that uses jackson 2.14.0-rc1? (the currently only jackson-databind version that passes the two vulnerability checks above)

We are currently using the databricks-jdbc driver in an environment where we can only get an exception for this that lasts a short time.

Also - If databricks-jdbc was available in thin form on Maven, we would be able to fix it ourselves. Is that possible to do?

Thanks! - Lars