From a99e3c28eb5be4c298524680d2e194b639a5bad6 Mon Sep 17 00:00:00 2001
From: Ryan Duguid <152749594+ryanduguid@users.noreply.github.com>
Date: Thu, 13 Aug 2026 03:30:20 +1000
Subject: [PATCH 1/2] build: update patched Jackson dependencies
---
pom.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index 62fb050e..61150f93 100644
--- a/pom.xml
+++ b/pom.xml
@@ -318,8 +318,8 @@
1.6.14
2.7.0
2.25.1
- 2.18.0
- 2.18.0
+ 2.18.8
+ 2.18.9
2.15.2
4.13.2
4.5.3
From 8ef00be4d5949b6dea0ebc960b4785dffa6b4668 Mon Sep 17 00:00:00 2001
From: Ryan Duguid <152749594+ryanduguid@users.noreply.github.com>
Date: Wed, 19 Aug 2026 15:08:12 +1000
Subject: [PATCH 2/2] build: align Jackson artifacts on patched 2.18.10
jackson-databind 2.18.9 is not the current patched 2.18.x release.
2.18.10 (15-Aug-2026) adds the fixes for CVE-2026-68497 (databind#6127,
StreamReadConstraints number-length limits for XMLGregorianCalendar and
Duration), CVE-2026-19032 (databind#6129, URL scheme allowlist for
java.nio.file.Path deserialization) and GHSA-gx83-3vf8-gh7j (databind#6156,
java.lang.Comparable added to the unsafe polymorphic base types).
jackson-core was left at 2.18.8, which omits two 2.18.10 fixes:
GHSA-2c4j-63jj-9fqr (core#1642, maxDocumentLength bypass in the async parser
single-feedInput() case) and CVE-2026-68498 (core#1643, maxNameLength now
enforced incrementally in ReaderBasedJsonParser). ApiClient
.createDefaultObjectMapper() does not configure StreamReadConstraints, so it
relies on StreamReadConstraints.DEFAULT_MAX_NAME_LEN (50_000). Before
core#1643 that limit was only checked after the name buffer had been
accumulated, so an oversized property name in an API response was buffered
in full rather than raising StreamConstraintsException.
The two properties also sat at different patch levels, so jackson-databind
2.18.9 requested jackson-core and jackson-annotations at 2.18.9 (jackson-bom
2.18.9 sets jackson.version.core and jackson.version.annotations to
${jackson.version}) while this POM pinned them at 2.18.8. A downstream build
running maven-enforcer-plugin requireUpperBoundDeps failed on that, because
the transitive request was higher than the resolved version. All three
artifacts now resolve to 2.18.10.
jackson-datatype-threetenbp is moved 2.15.2 -> 2.18.2, the newest published
release of that artifact, so ThreeTenModule is no longer a 2.15.2 build
registered into a 2.18.x databind. Its only use here is the no-arg
constructor, unchanged between the two versions.
---
pom.xml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/pom.xml b/pom.xml
index 61150f93..b7bf7105 100644
--- a/pom.xml
+++ b/pom.xml
@@ -318,9 +318,9 @@
1.6.14
2.7.0
2.25.1
- 2.18.8
- 2.18.9
- 2.15.2
+ 2.18.10
+ 2.18.10
+ 2.18.2
4.13.2
4.5.3
3.1.5