This is an automated email from the ASF dual-hosted git repository.
capistrant pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 1a05649d005 build(deps): Update Jackson to 2.21.4 to address multiple
CVEs (#19618)
1a05649d005 is described below
commit 1a05649d00557018fe982a657781736fd084ce9d
Author: Ashwin Tumma <[email protected]>
AuthorDate: Fri Jun 26 08:04:15 2026 -0700
build(deps): Update Jackson to 2.21.4 to address multiple CVEs (#19618)
* build(deps): Update Jackson to 2.22.0 to address multiple CVEs
Updates Jackson from version 2.21.3 to 2.22.0 to address 4 high severity
security vulnerabilities in jackson-core, jackson-databind, and
jackson-annotations.
* Update Jackson version 2.21 to 2.22 in licenses.yaml for shortened
version format
* Change Jackson version to 2.21.4 instead of 2.22.0 for a more
conservative patch-level upgrade
---------
Co-authored-by: Ashwin Tumma <[email protected]>
---
licenses.yaml | 8 ++++----
pom.xml | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/licenses.yaml b/licenses.yaml
index 9895cb1b639..10036e4d3f5 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -321,7 +321,7 @@ name: Jackson
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 2.21.3
+version: 2.21.4
libraries:
- com.fasterxml.jackson.core: jackson-core
- com.fasterxml.jackson.core: jackson-annotations
@@ -374,7 +374,7 @@ name: Jackson
license_category: binary
module: extensions-contrib/druid-deltalake-extensions
license_name: Apache License version 2.0
-version: 2.21.3
+version: 2.21.4
libraries:
- com.fasterxml.jackson.core: jackson-databind
notice: |
@@ -1002,7 +1002,7 @@ name: Jackson
license_category: binary
module: extensions-core/kubernetes-overlord-extensions
license_name: Apache License version 2.0
-version: 2.21.3
+version: 2.21.4
libraries:
- com.fasterxml.jackson.dataformat: jackson-dataformat-properties
notice: |
@@ -3076,7 +3076,7 @@ libraries:
---
name: Jackson Dataformat Yaml
-version: 2.21.3
+version: 2.21.4
license_category: binary
module: extensions/druid-avro-extensions
license_name: Apache License version 2.0
diff --git a/pom.xml b/pom.xml
index 38d1a245b19..9128fca053a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,7 +105,7 @@
<iceberg.core.version>1.10.0</iceberg.core.version>
<jetty.version>12.1.8</jetty.version>
<jersey.version>1.19.4</jersey.version>
- <jackson.version>2.21.3</jackson.version>
+ <jackson.version>2.21.4</jackson.version>
<codehaus.jackson.version>1.9.13</codehaus.jackson.version>
<log4j.version>2.25.4</log4j.version>
<mysql.version>8.2.0</mysql.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
