Pin jackson-databind/core to 2.22.0 to clear 7 advisories - #7
Merged
Conversation
All seven open Dependabot alerts (#9-#15) are jackson-databind (CVE-2026-54512 ... CVE-2026-54518): PolymorphicTypeValidator bypasses, @JSONVIEW / @JsonIgnore / @JsonIgnoreProperties bypasses, and an InetSocketAddress eager-DNS SSRF. jackson is a transitive of the CycloneDX and JReleaser plugins, resolving to 2.21.2 on the buildscript classpath. Force-resolve jackson-databind and jackson-core to 2.22.0 in the existing buildscript resolutionStrategy block (alongside the tika-core and plexus-utils pins). 2.22.0 is the first published release exceeding every vulnerable range -- the named 2.21.5 fix was never released to Maven Central. jackson-annotations tracks its own 2.22 line via the BOM. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
taer
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
All seven open Dependabot alerts (#9–#15) on this repo are
com.fasterxml.jackson.core:jackson-databind(CVE-2026-54512 … CVE-2026-54518):@JsonView/@JsonIgnore/@JsonIgnorePropertiesbypasses (CVE-2026-54517, CVE-2026-54516, CVE-2026-54515, CVE-2026-54518)InetSocketAddresseager-DNS SSRF (CVE-2026-54514)jackson is not a direct dependency — it's a transitive of the CycloneDX and JReleaser Gradle plugins, resolving to
2.21.2on the root buildscript classpath.How
Force-resolve
jackson-databindandjackson-coreto 2.22.0 in the existingbuildscript { … resolutionStrategy.eachDependency }block, alongside the pre-existingtika-coreandplexus-utilspins (also JReleaser transitives).2.22.0is the first published release exceeding every vulnerable range — the2.21.5fix some advisories name was never released to Maven Central.jackson-coreis bumped in lock-step to avoid databind/core skew;jackson-annotationsis left to track its own 2.22 line via the BOM.This mirrors the identical fix shipped in
engine-public/protoc-gen-markdownandengine-public/protoc-gen-mermaid(their PR #11).Verification
./gradlew ktlintFormat✅./gradlew buildEnvironment | grep jackson→ everyjackson-databind/jackson-coreresolves… -> 2.22.0(incl. the previously-vulnerable2.21.2 -> 2.22.0);jackson-annotationson2.22,jackson-bomat2.22.0✅./gradlew build→ BUILD SUCCESSFUL (compile + ktlint + tests) ✅Closes Dependabot alerts #9–#15 once merged to
main.🤖 Generated with Claude Code