Variable range of net.minidev:json-smart causing dependency resolution issues

[Former user]

We use oauth2-oidc-sdk:9.7 which brings in net.minidev:json-smart:[1.3.3,2.4.7] as a transitive dependency into our SDK. Customers of our SDK are reporting that the variable version range is causing issues in their applications.

Is there a reason why you are using a variable range here as opposed to pinning to a specific version? If not, could you pin to a specific version?

[Yavor Vasilev]

The dependency was pinned a while ago:

        <dependency>
            <groupId>net.minidev</groupId>
            <artifactId>json-smart</artifactId>
            <version>2.4.11</version>
        </dependency>