Override transitive dependency

[pkfec]

Summary (required)

Override jackson-databind transitive dependencies and enforce strict version

I have noticed that this transitive dependencies problem only appears on the Snyk UI, but it doesn’t show up when running scans through the CLI. In our CircleCI pipeline, both jackson-databind versions 2.22.1 and 3.1.5 are being downloaded. To be on safe side, I have pinned version 2.22.1 as a constraint in the build.gradle file, and I have also excluded the group "com.fasterxml.jackson.core" just in case.

FYI, the CLI does not flag jackson-databind as a transitive vulnerable package.

Some discrepancy between SCM imports and CLI scan is expected due to the environments. 
Stated in documentation here:

https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-open-source/manage-vulnerabilities/differences-in-open-source-vulnerability-counts-across-environments

• Resolves [Snyk: Critical] Flyway (Due: 09/07/26 ) #6675

Required reviewers

1-2 reviewers

Impacted areas of the application

• database flyway migration

How to test

• run: git checkout feature/exclude-flyway-transitive-dependencies
• run: dropdb cfdm_test
• run: createdb cfdm_test
• run: invoke create-sample-db
• run: snyk test --file=data/flyway/build.gradle (No transitive dependency issues flagged here)
• run pytest
• run flask run (optional, test endpoints)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.00%. Comparing base (8895354) to head (cbf9c81).
⚠️ Report is 6 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #6686   +/-   ##
========================================
  Coverage    86.00%   86.00%           
========================================
  Files           99       99           
  Lines        10611    10611           
========================================
  Hits          9126     9126           
  Misses        1485     1485           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.