EmryZhang opened a new pull request, #531: URL: https://github.com/apache/casbin-jcasbin/pull/531
The merged 1.100.0 preparation still declares `jackson-databind` 2.18.1, which is in the affected ranges of public FasterXML advisories. This changes only that dependency to the same-series patched version 2.18.9. References: [FasterXML 2.18.9 release notes](https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.18.9), [GHSA-5jmj-h7xm-6q6v](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v), and [GHSA-vvgp-rfg2-7rr6](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6). This dependency update does not establish that those advisory-specific conditions are reachable through JCasbin. Validation on top of `8424ca10b2a549ccefeb9d426b2f57f093e89bb6`: Temurin 8u504 and Maven 3.9.16 `clean verify -Dgpg.skip=true` passed all 266 tests, with zero failures, errors or skipped tests. The test JVM classpath contains Jackson Databind 2.18.9. Library, source and Javadoc JARs retain matching LICENSE, NOTICE and DISCLAIMER files. The build retains the existing Javadoc warning about an unknown author tag. Draft for release-scope review: the earlier equivalent Dependabot PR #527 was closed without merging. Please decide whether to include this update before selecting the 1.100.0 RC commit. If merged, the final merged commit and source archives need fresh release verification. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
