[codefish1]

Issue

Related to #9528. This addresses the Testcontainers 2.0.5 case reported in #11912, which was closed as a duplicate.

Problem

Testcontainers 2.0.5 embeds shaded Jackson 2.18.4 classes in the core JAR. A downstream dependency override cannot replace those relocated classes. The embedded version is within the affected range of CVE-2026-54512 and CVE-2026-54513, among other Jackson advisories.

Change

• Pin jackson-core, jackson-databind, and jackson-datatype-jsr310 together at 2.18.12 in the core shaded build. Pinning core explicitly avoids mixing Jackson versions.
• Update JarFileShadingTest to match the META-INF resources in the Jackson-only rebuilt JAR.

This branch is based on main and contains no Bouncy Castle version change; that is tracked separately in #12135.

Verification

• :testcontainers:dependencies --configuration shaded resolves Jackson core and databind at 2.18.12 while Bouncy Castle remains at 1.82.
• :testcontainers:build -x :testcontainers:test -x :testcontainers:spotlessJavaCheck passes on the fork's main baseline, including compilation, shaded JAR tests, Checkstyle, Javadoc, and japicmp.
• git diff --check passes.

The Docker integration suite has not completed locally: earlier runs hit Docker Model Runner and MCP gateway failures and an image-context streaming stall. The Java Spotless check could not run because npm is unavailable on this host. CI should run the complete checks before merge.

Summary by CodeRabbit

• Tests
  • Updated packaging checks to verify the expected third-party license metadata entries. This keeps validation aligned with the license files currently included in the packaged output and helps catch unexpected changes to that metadata in future builds.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 75a43e35-34c9-4451-a35e-a3806378de11

Commits

Reviewing files that changed from the base of the PR and between f74d167 and 6c85670.

Files selected for processing: 2

• core/build.gradle
• core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The build now forces jackson-core, jackson-databind, and jackson-datatype-jsr310 to version 2.18.12. The shaded JAR test expects updated license filenames in META-INF.

Changes: Jackson dependency update

Layer / File(s)	Summary
Jackson versions and shaded metadata core/build.gradle, core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java	The build forces the three Jackson artifacts to version 2.18.12. The shaded JAR test expects Schubfach-LICENSE and FastDoubleParser-ThirdParty-LICENSE instead of the previous filenames.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: eddumelendez, zachchuba

Merge Risk: Minimal · up to 6c856

This change updates the bundled Jackson libraries to a patched version and adjusts the matching JAR test. No actionable merge-blocking risk is identified, and CI should confirm the full build.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title is concise, specific, and accurately summarizes the primary change to the shaded Jackson dependencies.
Description check		The description clearly documents the issue, affected versions, implemented changes, related issues, verification results, and incomplete local checks. It provides the information required by the temp…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly documents the issue, affected versions, implemented changes, related issues, verification results, and incomplete local checks. It provides the information required by the template.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}