From 951f403a58911f8989207ce1868661ddd5a90841 Mon Sep 17 00:00:00 2001 From: Mohammad Saddam Hossain Date: Wed, 30 Sep 2026 10:38:18 +0530 Subject: [PATCH] fix(deps): bump jackson-databind to 2.21.7 to fix CVE-2026-54512/54513 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Our own direct pin (2.21.0) falls in the vulnerable range (>=2.19.0, <2.21.4) for both CVEs — a PolymorphicTypeValidator bypass allowing arbitrary class instantiation during deserialization. Fixed upstream in 2.21.4; bumped to the latest 2.21.x patch (2.21.7). Dependabot's PR #89 targeted json-schema-validator 1.4.3 -> 3.0.7 instead, but that dependency is optional and its transitive jackson version is overridden by our direct pin anyway (Maven dependency mediation), so bumping it doesn't touch the actually-vulnerable artifact. It also doesn't build: 3.0.7 replaced the whole JsonSchemaFactory/ValidationMessage API with a jackson 3.x (tools.jackson) rewrite, which would pull in a second, incompatible Jackson major version. Bumping our own jackson-databind pin fixes the CVEs directly without any of that. 547 tests green. Closes #94. Co-Authored-By: Claude Sonnet 5 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 72b6210..d61e5ed 100644 --- a/pom.xml +++ b/pom.xml @@ -64,7 +64,7 @@ com.fasterxml.jackson.core jackson-databind - 2.21.0 + 2.21.7