[Fix for jackson-databind 2.9.x CVEs via simple pom updates?]

Hello everyone,

Can we please have an update to jasper reports where the version of jackson-databind has been bumped to avoid some CVEs? Jackson-databind versions 2.9.9 are the cause. Version 2.11 is available, can we move to it please?

Regards,

Andrew Marlow

[Jasper Reports Licensing]

I know this post is very old but I still think it is an issue. I am new to JasperReports. I just started reading up on it today. I started with the entry on wikipedia and the project webpage on sourceforge.  Wikipedia at https://en.wikipedia.org/wiki/JasperReports has a section that says:

"Jaspersoft provides commercial software around the JasperReports product, and negotiate contracts with software developers that wish to embed the JasperReports engine into a closed source product."

This makes it looks like JasperReports cannot be used in proprietary software. Going to the sourceforge page no further light is shed on this. I had to google and found this discussion thread. I think that a link to a page that discusses software licenses would be very useful.

If such a page is created then I hope it will talk about free versus proprietary. Mentioning free of charge only confuses the issue. It seems to me that the cummunity edition of JasperReports is released under the LGPL. This should make it free software. That's free as in freedom.