We inherit this dependency from io.swagger:swagger-jersey2-jaxrs:jar:1.5.19:compile - we are not using Jackson in this repo. The swagger is used for annotations only and not any serialization. eg. we are not vulnerable 

Investigate whether we can exclude this dependency safely.