This is an automated email from the ASF dual-hosted git repository.
shahar1 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 8ad4d615e74 Bump Java SDK Jackson to 2.22.4 for high-severity
advisories (#76670)
8ad4d615e74 is described below
commit 8ad4d615e74ef29897886076bdd77780ecef81fb
Author: Shahar Epstein <[email protected]>
AuthorDate: Sat Nov 7 13:16:59 2026 +0200
Bump Java SDK Jackson to 2.22.4 for high-severity advisories (#76670)
jackson-core 2.22.2 is affected by GHSA-p6pp-m3f8-5c89 and
GHSA-7hhh-6rmp-j9qf, and jackson-databind 2.22.2 by GHSA-wv8q-qhhj-9h54
and GHSA-cxp5-3px4-pw24, all high severity and fixed from 2.22.3. The SDK
pulls them into every Java Dag project, and dependency review rejects PRs
whose dependency snapshot includes them. The YAML and JSR-310 modules move
with them to stay on one Jackson release, and the trust list is
regenerated so the Gradle build verifies the new artifacts.
Claude-Session: https://claude.ai/code/session_01BVx6g7jkA4GssqTQRrKRSj
---
java-sdk/gradle/verification-metadata.xml | 64 +++++++++++++++----------------
java-sdk/sdk/build.gradle.kts | 8 ++--
2 files changed, 36 insertions(+), 36 deletions(-)
diff --git a/java-sdk/gradle/verification-metadata.xml
b/java-sdk/gradle/verification-metadata.xml
index 170dd07993b..7a7d457bb4e 100644
--- a/java-sdk/gradle/verification-metadata.xml
+++ b/java-sdk/gradle/verification-metadata.xml
@@ -158,9 +158,9 @@
<sha256
value="7cf9c59fbd14c9056747137b90d70a95e87760dfe1b82456b9f02317d5b56faf"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson" name="jackson-base"
version="2.22.2">
- <artifact name="jackson-base-2.22.2.pom">
- <sha256
value="a8c82982bdcd64e5b7cc8575a0459eab53d535a8309d6966274c93536e354234"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson" name="jackson-base"
version="2.22.4">
+ <artifact name="jackson-base-2.22.4.pom">
+ <sha256
value="51b5cc57df78f50a43210e577075f68399e31dde7150455e179d249e637582a1"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.jackson" name="jackson-bom"
version="2.15.3">
@@ -183,9 +183,9 @@
<sha256
value="22006be70fd018099e99c6c27ac0982320f3a0f3c2ce053c55703579a5eea303"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson" name="jackson-bom"
version="2.22.2">
- <artifact name="jackson-bom-2.22.2.pom">
- <sha256
value="a93ad5b8462f8d5920b128647a9b9f236342b4fd4e71287da9f7187fd8642f02"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson" name="jackson-bom"
version="2.22.4">
+ <artifact name="jackson-bom-2.22.4.pom">
+ <sha256
value="a3c00688a7bf8e128451137b68f90d9137957a372756083d74555a47241d1636"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.jackson" name="jackson-parent"
version="2.15">
@@ -253,12 +253,12 @@
<sha256
value="38282fb75c733d2395dd34dc0b59eccbb43aa7cc31a21a2616baaa8afcb7f236"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson.core" name="jackson-core"
version="2.22.2">
- <artifact name="jackson-core-2.22.2.jar">
- <sha256
value="ff167a6317be15895706c26668f45b898efe40ab8780970658210fe1393d52a6"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson.core" name="jackson-core"
version="2.22.4">
+ <artifact name="jackson-core-2.22.4.jar">
+ <sha256
value="2d30c375cddea9657a1e1ef97547a2694b663b355facb4de53a097782b312d1a"
origin="Generated by Gradle"/>
</artifact>
- <artifact name="jackson-core-2.22.2.module">
- <sha256
value="887d785bff6f964c554b339bf0f0da008e0618cd20ade3c3e56c68ed2c674e9d"
origin="Generated by Gradle"/>
+ <artifact name="jackson-core-2.22.4.module">
+ <sha256
value="f48a33005b4950f90af0aed735c29c9e7e43df9e2a4d649db7a2dc2e90ce96f5"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.jackson.core" name="jackson-databind"
version="2.15.3">
@@ -277,12 +277,12 @@
<sha256
value="f470bde8944d57d6b150caa8bf53bb982a99eb1d6591e731afcb972ab3dd771f"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson.core" name="jackson-databind"
version="2.22.2">
- <artifact name="jackson-databind-2.22.2.jar">
- <sha256
value="d0da14c12b16b5d54719aa172d83b542ff4abeb8b0fb7db476fde8ceece760ca"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson.core" name="jackson-databind"
version="2.22.4">
+ <artifact name="jackson-databind-2.22.4.jar">
+ <sha256
value="d4cbf8947087f305869826801913abdc50735a1fab2074a1993e7bc67ca974a3"
origin="Generated by Gradle"/>
</artifact>
- <artifact name="jackson-databind-2.22.2.module">
- <sha256
value="a1ec25addcc3f5d5aaae8f702bd72926ab5753170e8a4b1d9c9024ce902400a2"
origin="Generated by Gradle"/>
+ <artifact name="jackson-databind-2.22.4.module">
+ <sha256
value="fdf629a455277b8696a0e79533d99531bea7f5f5edaf6cab38646608b8cbb9c3"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.jackson.dataformat"
name="jackson-dataformat-xml" version="2.15.3">
@@ -309,12 +309,12 @@
<sha256
value="b276d25157f88beea69d3f4434658564b71f31acde1d4b1a14f8984be953c343"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson.dataformat"
name="jackson-dataformat-yaml" version="2.22.2">
- <artifact name="jackson-dataformat-yaml-2.22.2.jar">
- <sha256
value="f5e52c7d8914f23c5fcc00d0afbef77e20557228a6200e184bb61f69ab03fc44"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson.dataformat"
name="jackson-dataformat-yaml" version="2.22.4">
+ <artifact name="jackson-dataformat-yaml-2.22.4.jar">
+ <sha256
value="2f55e2b864f6354b24d4bcccd488f7c4a3fce4977f8c8dbad07242a68e11dde9"
origin="Generated by Gradle"/>
</artifact>
- <artifact name="jackson-dataformat-yaml-2.22.2.module">
- <sha256
value="09414d7eb37811a86452f032079b60446b20a203730b9a92cc12652f586cae57"
origin="Generated by Gradle"/>
+ <artifact name="jackson-dataformat-yaml-2.22.4.module">
+ <sha256
value="a5df18de7021c89a16609350d009e084347bb9aaaf1a171fb75b7897a801a997"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.jackson.dataformat"
name="jackson-dataformats-text" version="2.17.2">
@@ -322,17 +322,17 @@
<sha256
value="e698323330a9a82c920e5a89b65b0f7225c8e733c122a18f796a04a6e31fa5cb"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson.dataformat"
name="jackson-dataformats-text" version="2.22.2">
- <artifact name="jackson-dataformats-text-2.22.2.pom">
- <sha256
value="c2852080f6ff44734cb9ff9052c708fe257784e5f648533f939a8c6bbeb59c96"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson.dataformat"
name="jackson-dataformats-text" version="2.22.4">
+ <artifact name="jackson-dataformats-text-2.22.4.pom">
+ <sha256
value="57ca2b45f3b4015ee42e8bcea4b886baa8569eab4bc34654cbf3410bcbb7a8fe"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson.datatype"
name="jackson-datatype-jsr310" version="2.22.2">
- <artifact name="jackson-datatype-jsr310-2.22.2.jar">
- <sha256
value="9df71cc7fb3781fd0bed6c05eebbfa8b39292a49f5619e76fdd0d889f64c8f33"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson.datatype"
name="jackson-datatype-jsr310" version="2.22.4">
+ <artifact name="jackson-datatype-jsr310-2.22.4.jar">
+ <sha256
value="ec961697cbd631935b6fb6f673406861c75243521fb67fec10b59f1412ac50f7"
origin="Generated by Gradle"/>
</artifact>
- <artifact name="jackson-datatype-jsr310-2.22.2.module">
- <sha256
value="07efa64b68880e77caa0fe22c256db4ebef28a95c637f401fdd5bbed504cf239"
origin="Generated by Gradle"/>
+ <artifact name="jackson-datatype-jsr310-2.22.4.module">
+ <sha256
value="72b7dda0fe250d022c9de456fc26047f3656b27f31cb9aeda5d3ab18c97c21ff"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.jackson.module"
name="jackson-module-kotlin" version="2.15.3">
@@ -351,9 +351,9 @@
<sha256
value="44a3670a99cd31ac262e0c559b4d106cf725af2bf6108991a12816244571d084"
origin="Generated by Gradle"/>
</artifact>
</component>
- <component group="com.fasterxml.jackson.module"
name="jackson-modules-java8" version="2.22.2">
- <artifact name="jackson-modules-java8-2.22.2.pom">
- <sha256
value="f0c4c3354b0c8f08f33542ed3e6ba6c271b1b3c0eaaca8710376fe5499865a36"
origin="Generated by Gradle"/>
+ <component group="com.fasterxml.jackson.module"
name="jackson-modules-java8" version="2.22.4">
+ <artifact name="jackson-modules-java8-2.22.4.pom">
+ <sha256
value="20cdf333d224a91e6a4b548f8f4515790e34efc19cadc41f06173f51d97ac70d"
origin="Generated by Gradle"/>
</artifact>
</component>
<component group="com.fasterxml.woodstox" name="woodstox-core"
version="6.5.1">
diff --git a/java-sdk/sdk/build.gradle.kts b/java-sdk/sdk/build.gradle.kts
index 539ac8e88d1..5ac2c66a8fe 100644
--- a/java-sdk/sdk/build.gradle.kts
+++ b/java-sdk/sdk/build.gradle.kts
@@ -52,10 +52,10 @@ dependencies {
compileOnly("javax.annotation:javax.annotation-api:1.3.2")
implementation("com.fasterxml.jackson.core:jackson-annotations:2.22")
- implementation("com.fasterxml.jackson.core:jackson-core:2.22.2")
- implementation("com.fasterxml.jackson.core:jackson-databind:2.22.2")
-
implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.22.2")
-
implementation("com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.2")
+ implementation("com.fasterxml.jackson.core:jackson-core:2.22.4")
+ implementation("com.fasterxml.jackson.core:jackson-databind:2.22.4")
+
implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.22.4")
+
implementation("com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.4")
implementation("com.xenomachina:kotlin-argparser:2.0.7")
implementation("io.ktor:ktor-network:3.6.0")
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.11.0")
