spuru9 opened a new pull request, #166:
URL: https://github.com/apache/flink-shaded/pull/166
## What
Bump the bundled Jackson on the `release-20.0` line from `2.18.2` to
`2.18.10`, and update the affected `NOTICE` files and hardcoded module version
coordinates to match.
## Why
`2.18.10` is the current `2.18.x` maintenance release and carries fixes for
a series of `jackson-databind` / `jackson-core` CVEs and GHSA advisories
reported against `2.18.2`:
- GHSA-r7wm-3cxj-wff9 (jackson-core) — fixed in 2.18.8 / 2.21.4 (Confluent
CF-4067)
- CVE-2026-59888 / GHSA-3pjw-73gf-8qr5 (jackson-databind) — fixed in 2.18.8
/ 2.21.4 / 3.1.4 (Confluent CF-4063)
- CVE-2026-59889 / GHSA-5gvw-p9qm-jgwh (jackson-databind) — fixed in 2.18.9
/ 2.21.5 / 2.22.1 (Confluent CF-4060)
- GHSA-mhm7-754m-9p8w (jackson-databind) — fixed in 2.18.9 / 2.21.5
(Confluent CF-4057)
- CVE-2026-54512 / GHSA-j3rv-43j4-c7qm (jackson-databind) — fixed in 2.18.8
/ 2.21.4 / 3.1.4 (Confluent CF-3897)
- CVE-2026-54513 / GHSA-rmj7-2vxq-3g9f (jackson-databind) — fixed in 2.18.8
/ 2.21.4 / 3.1.4 (Confluent CF-3892)
- CVE-2026-54514 / GHSA-hgj6-7826-r7m5 (jackson-databind) — fixed in 2.18.8
/ 2.21.4 / 3.1.4 (Confluent CF-3887)
- CVE-2026-54515 / GHSA-5jmj-h7xm-6q6v (jackson-databind) — fixed in 2.18.9
/ 2.21.5 / 2.22.1 / 3.1.4 (Confluent CF-3882)
`2.18.10` clears every one of these `2.18.x` fix thresholds. Because
`flink-shaded` bundles (relocates) Jackson, consumers of `flink-shaded-jackson`
/ `flink-shaded-jackson-module-jsonSchema` / `flink-shaded-swagger` can only
pick up these fixes via a rebuild of the shaded artifacts from a bumped source
branch — the bundled copy is invisible to downstream `dependencyManagement`.
## Changes
- **`pom.xml`** — `jackson.version` `2.18.2` → `2.18.10`.
- **`flink-shaded-jackson-parent/pom.xml`** — hardcoded
`<version>2.18.2-20.0</version>` → `2.18.10-20.0` (this module's version
coordinate is `<jackson.version>-<flink-shaded-revision>` by convention, not a
resolvable property).
- **`flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml`**,
**`flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml`**,
**`flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml`** — matching
`<parent><version>` bump to `2.18.10-20.0`.
-
**`flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE`**
— 8 bundled `com.fasterxml.jackson.*` version lines → `2.18.10`.
-
**`flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE`**
— 4 bundled `com.fasterxml.jackson.*` version lines → `2.18.10`.
- **`flink-shaded-swagger/src/main/resources/META-INF/NOTICE`** — the 2
bundled `com.fasterxml.jackson.*` lines → `2.18.10`. This module imports
`com.fasterxml.jackson:jackson-bom:${jackson.version}` in
`dependencyManagement`, so the bump changes the Jackson it bundles too.
## Verification
Built with Java 21 / Maven 3.9.4 (`mvn clean install -DskipTests
-Plicense-check` equivalent reactor, against Maven Central):
- `BUILD SUCCESS` across all 16 modules.
- `flink-shaded-jackson-2-2.18.10-20.0.jar` bundles Jackson `2.18.10`, keeps
the `org.apache.flink.shaded.jackson2.com.fasterxml.jackson` relocation, and
shows no un-relocated `com/fasterxml/jackson` leakage.
- `license-check` profile (NoticeFileChecker) passes with the updated NOTICE
files.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
