shahar1 opened a new pull request, #76670: URL: https://github.com/apache/airflow/pull/76670
The `Reject vulnerable dependency changes` check fails on PRs whose head has Java SDK dependency snapshots (for example #76357), because the SDK pins Jackson 2.22.2: - `jackson-core` 2.22.2: GHSA-p6pp-m3f8-5c89, GHSA-7hhh-6rmp-j9qf (high) - `jackson-databind` 2.22.2: GHSA-wv8q-qhhj-9h54, GHSA-cxp5-3px4-pw24 (high) All are fixed from 2.22.3. This moves `jackson-core`, `jackson-databind`, `jackson-dataformat-yaml` and `jackson-datatype-jsr310` to 2.22.4, which is the version the regular Dependabot group (#76616) already proposes. It also regenerates `java-sdk/gradle/verification-metadata.xml` with the `regenerate-java-sdk-verification-metadata` hook. The trust-list diff is a 1:1 swap of the eight Jackson 2.22.2 components for 2.22.4. `jackson-annotations` stays on `2.22`, since it no longer has patch releases. This supersedes the Dependabot security PR #74309, which bumps only core and databind to 2.22.3 without the trust-list update and is red. Once this merges, #76616 needs a rebase. Not covered here: the dependency graph also reports high-severity transitive dependencies that Spark pulls into `java-sdk/scala_spark_example` (jackson 2.15.2, netty 4.1.96, guava, protobuf) and `plexus-utils` 4.0.2 in `java-sdk/example`. The failing job did not report them, and they need separate handling. Checked locally: - The metadata hook's full Gradle build (`build`, Dokka, source tarball, `publishToMavenLocal`) succeeded. - `dependencyInsight` shows `jackson-core` resolving to 2.22.4 in both `example/` and `scala_spark_example/`. - `ktlintCheck --rerun` passes. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01BVx6g7jkA4GssqTQRrKRSj -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
