This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 53e38f8a5e2 [NO-ISSUE] upgrade jackson-databind from 2.22.1 to 2.22.2
and from 3.1.5 to 3.1.6 (#7111)
53e38f8a5e2 is described below
commit 53e38f8a5e28223fe75a48fd7ccb82922586ce39
Author: ANN JOY <[email protected]>
AuthorDate: Wed Sep 16 12:42:18 2026 +0530
[NO-ISSUE] upgrade jackson-databind from 2.22.1 to 2.22.2 and from 3.1.5 to
3.1.6 (#7111)
- Upgraded com.fasterxml.jackson.databind from 2.22.1 to 2.22.2 in
kie-parent and
optaplanner-build-parent to address a polymorphic deserialization guard
bypass
in DefaultBaseTypeLimitingValidator via java.lang.Comparable. Affected
range:
>= 2.22.0, < 2.22.2. Version 2.22.2 is confirmed safe.
- Upgraded tools.jackson.core:jackson-databind from 3.1.5 to 3.1.6 in
kogito-springboot/bom. spring-boot-dependencies:4.0.8 pulls in
tools.jackson.core:jackson-databind:3.1.5 which carries a High severity
deserialization vulnerability. Force-pin updated to 3.1.6 and inline
comment
refreshed to reflect the current Spring Boot baseline (4.0.8) and new
removal threshold (>= 3.1.6).
Both upgrades are same-series patch releases with no API changes.
---
kie-parent/pom.xml | 2 +-
kogito-springboot/bom/pom.xml | 8 ++++----
optaplanner-build/optaplanner-build-parent/pom.xml | 2 +-
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index fc100fd22c7..b7736aafbe1 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -89,7 +89,7 @@
<version.ch.qos.logback>1.6.3</version.ch.qos.logback>
<version.com.fasterxml.jackson>2.22.1</version.com.fasterxml.jackson>
<version.com.fasterxml.jackson.annotations>2.22</version.com.fasterxml.jackson.annotations>
-
<version.com.fasterxml.jackson.databind>2.22.1</version.com.fasterxml.jackson.databind>
+
<version.com.fasterxml.jackson.databind>2.22.2</version.com.fasterxml.jackson.databind>
<version.com.fasterxml.jackson.datatype>2.22.1</version.com.fasterxml.jackson.datatype>
<version.com.github.docker-java>3.7.1</version.com.github.docker-java><!--
align with testcontainers ABI; Quarkus BOM pins older docker-java missing
ImageHistoryCmd -->
<version.com.github.eirslett>1.15.1</version.com.github.eirslett>
diff --git a/kogito-springboot/bom/pom.xml b/kogito-springboot/bom/pom.xml
index 3b75896f422..d4b241226cb 100644
--- a/kogito-springboot/bom/pom.xml
+++ b/kogito-springboot/bom/pom.xml
@@ -46,10 +46,10 @@
Override the version property inherited from kie-parent to 2.26.1
(minimum 2.25.5).
https://logging.apache.org/security.html#CVE-2026-49844 -->
<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
- <!-- CVE-2026-59889: force-pin jackson-databind to 3.1.5.
- spring-boot-dependencies:4.0.7 carries the vulnerable
jackson-databind:3.1.4.
- Remove this pin once spring-boot-dependencies imports
jackson-databind >= 3.1.5. -->
- <version.tools.jackson.core>3.1.5</version.tools.jackson.core>
+ <!-- CVE-2026-59889: force-pin jackson-databind to 3.1.6.
+ spring-boot-dependencies:4.0.8 carries the vulnerable
jackson-databind:3.1.5.
+ Remove this pin once spring-boot-dependencies imports
jackson-databind >= 3.1.6. -->
+ <version.tools.jackson.core>3.1.6</version.tools.jackson.core>
<!-- Framework-specific pins moved out of kie-parent: only this tree
declares these artifacts. -->
<version.org.spockframework>2.2-groovy-4.0</version.org.spockframework>
</properties>
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index 6b7038450c9..06bce776361 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -66,7 +66,7 @@
<version.org.apache.sshd>2.19.0</version.org.apache.sshd>
<version.org.springframework>7.0.9</version.org.springframework>
<version.org.springframework.boot>4.0.8</version.org.springframework.boot>
-
<version.com.fasterxml.jackson.databind>2.22.1</version.com.fasterxml.jackson.databind>
+
<version.com.fasterxml.jackson.databind>2.22.2</version.com.fasterxml.jackson.databind>
<!--
************************************************************************ -->
<!-- Plugins -->
<!--
************************************************************************ -->
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
