Bump Jackson to v2.9.4 to resolve CVE-2017-15095 et al

[guyboertje]

Thanks to @alex-dr for #66

Deletes old versions of jackson from the repository so they don't get included in the final artifact or show up on security scans. I really am not very comfortable with how this repo checks in binaries; I grabbed these from mvnrepository.com, but the author or any other contributor could have injected their own binaries with any malicious code they want and 99.999% of consumers (read; everyone running Logstash) would never know. For context on upstream fix, see: https://bugzilla.redhat.com/show_bug.cgi?id=1506612 CVE-2017-17485: FasterXML/jackson-databind#1855 CVE-2018-5968: FasterXML/jackson-databind#1899
--

The binaries and package only files are now not committed to the repo.
They will be packaged into the gem and pushed to rubygems by the author.

[alex-dr]

Awesome, thanks for this.

One more request if you wouldn't mind; it appeared that both the 2.7 and 2.9 jar's were present in my logstash, even though 2.9 was the only one used. Would you be able to git rm all jar files from this repo as well, so that we don't accidentally bundle old artifacts?

[colinsurprenant]

are you sure you want that in the .gitignore?

[guyboertje]

yeah I think so. They are only needed during the package phase. AFACT they don't need to be in Github. No?

[colinsurprenant]

👍

[guyboertje]

@alex-dr

Would you be able to git rm all jar files from this repo as well, so that we don't accidentally bundle old artifacts?

I think I have covered that this time. The previous mechanism of gem files was git ls-files meaning that any old file not ignored by git would be included in the gem. Now, I have made it very specific about exactly which files are to be packaged into the gem and they are predicated on the version in build_info. In future a contributor only needs to alter build_info and CHANGELOG in a PR.

From now on, the packaged gem published to rubygems should not have undesirable jars in it.

[alex-dr]

Awesome, thank you.

[colinsurprenant]

LGTM