deps(java): bump jackson-databind 2.17.2 → 2.18.9 (clears 4 Dependabot alerts) - #11
Open
sacha-ichbiah wants to merge 1 commit into
Open
deps(java): bump jackson-databind 2.17.2 → 2.18.9 (clears 4 Dependabot alerts)#11sacha-ichbiah wants to merge 1 commit into
sacha-ichbiah wants to merge 1 commit into
Conversation
Clears 4 Dependabot alerts on jackson-databind (2 high, 2 moderate): PolymorphicTypeValidator bypasses via generic type params and array subtype allowlist, InetSocketAddress SSRF, and @JsonIgnoreProperties case-insensitive bypass. No 2.17.x patch exists; fixes land in 2.18.8+, so 2.18.9 is the minimal version clearing all four. jsr310 bumped in lockstep to match the jackson train. The oagen JACKSON_VERSION source-of-truth constant is bumped to 2.18.9 in the parent monorepo so regeneration stays consistent. Verified with mvn clean test (451 sources compiled, tests pass) and dependency:tree (full jackson graph resolves 2.18.9). Pre-commit regen hook skipped: the local Bazel SDK regen OOM-kills in this shared tree, and the two generated files are byte-identical to the bumped generator output. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
anaslabgoul
approved these changes
Jul 27, 2026
anaslabgoul
left a comment
anaslabgoul
left a comment
Contributor
There was a problem hiding this comment.
Approve — correct, complete, and minimal.
Verified: both jackson-databind and jackson-datatype-jsr310 exist at 2.18.9 on Maven Central (latest in the 2.18.x line); repo-wide search finds zero remaining 2.17.2 references; both build systems (pom.xml + build.gradle.kts) updated in lockstep. 2.18.9 is indeed the minimal version clearing all four advisories, since no 2.17.x backport exists.
Follow-through: ensure the companion oagen JACKSON_VERSION bump lands so a future regeneration doesn't revert this. Minor note: this is a 2.17→2.18 minor bump, so worth a quick sanity check on any custom ObjectMapper / polymorphic-typing config, though the passing smoke + round-trip tests cover the main paths.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
com.fasterxml.jackson.core:jackson-databind(andjackson-datatype-jsr310, in lockstep) from 2.17.2 → 2.18.9 in the Java client (clients/java/pom.xmlandclients/java/build.gradle.kts).Why
Clears 4 Dependabot alerts on
jackson-databindflagged on the default branch (2 high, 2 moderate):>= 2.10.0, <= 2.18.7BasicPolymorphicTypeValidator(allowIfSubTypeIsArray)>= 2.10.0, < 2.18.8InetSocketAddressdeserialization triggers eager DNS resolution (SSRF)>= 2.0.0, < 2.18.8@JsonIgnoreProperties>= 2.8.0, < 2.18.9No
2.17.xpatch exists — the fixes only land in2.18.8+ — so2.18.9is the minimal version that clears all four alerts.jackson-datatype-jsr310is bumped to the same version to stay on one jackson train.Verification
mvn clean test— 451 sources compiled against 2.18.9, both SDK tests pass (GeneratedSdkSmokeTest,DiscriminatedUnionRoundTripTest).mvn dependency:treeresolves the full jackson graph (databind / annotations / core / jsr310) to2.18.9, no2.17.2remaining.Generator note
These files are generated by the oagen Java emitter. The source-of-truth
JACKSON_VERSIONconstant in the parent monorepo (factory/generators/oagen/oagen-emitters/src/java/client.ts) is bumped to2.18.9in a companion parent-repo change so a future regeneration does not revert this bump.