Vulnerability issue in dependent lib

WhiteSource flagged vulnerability issue in one of the dependent libraries - jackson-databind version 2.10.1

Following is the maven dependency tree for ring-defaults:
[INFO] +- metosin:compojure-api🫙2.0.0-alpha31:compile
[INFO] | +- potemkin:potemkin🫙0.4.5:compile
[INFO] | | +- (clj-tuple:clj-tuple🫙0.2.2:compile - omitted for duplicate)
[INFO] | | - (riddley:riddley🫙0.1.12:compile - omitted for conflict with 0.1.14)
[INFO] | +- prismatic:schema🫙1.1.12:compile
[INFO] | +- prismatic:plumbing🫙0.5.5:compile
[INFO] | | +- (prismatic:schema🫙1.1.7:compile - omitted for conflict with 1.1.12)
[INFO] | | - de.kotka:lazymap🫙3.1.0:compile
[INFO] | +- ikitommi:linked🫙1.3.1-alpha1:compile
[INFO] | +- metosin:muuntaja🫙0.6.6:compile
[INFO] | | +- metosin:jsonista🫙0.2.5:compile
[INFO] | | | +- (com.fasterxml.jackson.core:jackson-databind🫙2.10.0:compile - omitted for conflict with 2.10.1)
[INFO] | | | - com.fasterxml.jackson.datatype:jackson-datatype-jsr310🫙2.10.0:compile
[INFO] | | | +- (com.fasterxml.jackson.core:jackson-annotations🫙2.10.0:compile - omitted for duplicate)
[INFO] | | | +- (com.fasterxml.jackson.core:jackson-core🫙2.10.0:compile - omitted for conflict with 2.9.0)
[INFO] | | | - (com.fasterxml.jackson.core:jackson-databind🫙2.10.0:compile - omitted for duplicate)
[INFO] | | - com.cognitect:transit-clj🫙0.8.319:compile
[INFO] | | - com.cognitect:transit-java🫙0.8.337:compile
[INFO] | | +- (com.fasterxml.jackson.core:jackson-core🫙2.8.7:compile - omitted for conflict with 2.9.0)
[INFO] | | +- org.msgpack:msgpack🫙0.6.12:compile
[INFO] | | | +- com.googlecode.json-simple:json-simple🫙1.1.1:compile
[INFO] | | | - org.javassist:javassist🫙3.18.1-GA:compile
[INFO] | | +- (commons-codec:commons-codec🫙1.6:compile - omitted for conflict with 1.11)
[INFO] | | - javax.xml.bind:jaxb-api🫙2.3.0:compile
[INFO] | +- com.fasterxml.jackson.datatype:jackson-datatype-joda🫙2.10.1:compile
[INFO] | | +- com.fasterxml.jackson.core:jackson-annotations🫙2.10.1:compile
[INFO] | | +- com.fasterxml.jackson.core:jackson-core🫙2.10.1:compile
[INFO] | | +- com.fasterxml.jackson.core:jackson-databind🫙2.10.1:compile
[INFO] | | | +- (com.fasterxml.jackson.core:jackson-annotations🫙2.10.1:compile - omitted for duplicate)
[INFO] | | | - (com.fasterxml.jackson.core:jackson-core🫙2.10.1:compile - omitted for duplicate)
[INFO] | | - (joda-time:joda-time🫙2.9.9:compile - omitted for conflict with 2.10.5)

...

This is the whitesource complain:
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

References:
https://github.com/FasterXML/jackson-databind/issues/2589
https://bugzilla.redhat.com/show_bug.cgi?id=1887664
https://github.com/FasterXML/jackson-databind/issues/2589

We tried to update the version of jackson-databind to 2.11.0 and run through the whitesource, and it went through successfully.

Would it be possible for you to update the version of jackson-databind in "compojure-api"? If yes, how soon can you provide updated build?

Also, from the above dep tree you can see that metosin:jsonista🫙0.2.5 also used jackson-databind. Probably, that one also needs to be changed..?

FYI: I know that similar ticket exists - https://github.com/metosin/compojure-api/issues/433 . But, it's description is a bit different than mine, that's why opening new one.

Inizia esaminando la configurazione delle dipendenze Maven per compojure-api e l’albero delle dipendenze in questa issue, prestando attenzione a jackson-databind e alla dipendenza transitiva jsonista. Aggiorna le versioni delle dipendenze secondo necessità, quindi verifica che l’albero risolto contenga una versione non vulnerabile di jackson-databind e che WhiteSource non segnali più la vulnerabilità XXE.