This is an automated email from the ASF dual-hosted git repository. lhotari pushed a commit to branch branch-3.0 in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 43b6d610892d0ebd522d7147794b979c9d196704 Author: Oneby Wang <[email protected]> AuthorDate: Mon Mar 2 06:46:45 2026 +0800 [fix][sec] Upgrade Jackson version to 2.18.6 (#25264) (cherry picked from commit d992dc530bea4f4737da93f1527133b1c9389a45) --- distribution/server/src/assemble/LICENSE.bin.txt | 22 +++++++++---------- distribution/shell/src/assemble/LICENSE.bin.txt | 22 +++++++++---------- pom.xml | 6 ++++- pulsar-sql/presto-distribution/LICENSE | 28 ++++++++++++------------ 4 files changed, 41 insertions(+), 37 deletions(-) diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt index ad48780f8cd..7c9a3de254b 100644 --- a/distribution/server/src/assemble/LICENSE.bin.txt +++ b/distribution/server/src/assemble/LICENSE.bin.txt @@ -246,17 +246,17 @@ The Apache Software License, Version 2.0 * JCommander -- com.beust-jcommander-1.82.jar * High Performance Primitive Collections for Java -- com.carrotsearch-hppc-0.9.1.jar * Jackson - - com.fasterxml.jackson.core-jackson-annotations-2.17.2.jar - - com.fasterxml.jackson.core-jackson-core-2.17.2.jar - - com.fasterxml.jackson.core-jackson-databind-2.17.2.jar - - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.17.2.jar - - com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.17.2.jar - - com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.17.2.jar - - com.fasterxml.jackson.module-jackson-module-jaxb-annotations-2.17.2.jar - - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.17.2.jar - - com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.17.2.jar - - com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.17.2.jar - - com.fasterxml.jackson.module-jackson-module-parameter-names-2.17.2.jar + - com.fasterxml.jackson.core-jackson-annotations-2.18.6.jar + - com.fasterxml.jackson.core-jackson-core-2.18.6.jar + - com.fasterxml.jackson.core-jackson-databind-2.18.6.jar + - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.18.6.jar + - com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.18.6.jar + - com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.18.6.jar + - com.fasterxml.jackson.module-jackson-module-jaxb-annotations-2.18.6.jar + - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.18.6.jar + - com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.18.6.jar + - com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.18.6.jar + - com.fasterxml.jackson.module-jackson-module-parameter-names-2.18.6.jar * Caffeine -- com.github.ben-manes.caffeine-caffeine-2.9.1.jar * Conscrypt -- org.conscrypt-conscrypt-openjdk-uber-2.5.2.jar * Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-2.9.0.jar diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt index 5ee25ba1895..bbc33955365 100644 --- a/distribution/shell/src/assemble/LICENSE.bin.txt +++ b/distribution/shell/src/assemble/LICENSE.bin.txt @@ -311,17 +311,17 @@ This projects includes binary packages with the following licenses: The Apache Software License, Version 2.0 * JCommander -- jcommander-1.82.jar * Jackson - - jackson-annotations-2.17.2.jar - - jackson-core-2.17.2.jar - - jackson-databind-2.17.2.jar - - jackson-dataformat-yaml-2.17.2.jar - - jackson-jaxrs-base-2.17.2.jar - - jackson-jaxrs-json-provider-2.17.2.jar - - jackson-module-jaxb-annotations-2.17.2.jar - - jackson-module-jsonSchema-2.17.2.jar - - jackson-datatype-jdk8-2.17.2.jar - - jackson-datatype-jsr310-2.17.2.jar - - jackson-module-parameter-names-2.17.2.jar + - jackson-annotations-2.18.6.jar + - jackson-core-2.18.6.jar + - jackson-databind-2.18.6.jar + - jackson-dataformat-yaml-2.18.6.jar + - jackson-jaxrs-base-2.18.6.jar + - jackson-jaxrs-json-provider-2.18.6.jar + - jackson-module-jaxb-annotations-2.18.6.jar + - jackson-module-jsonSchema-2.18.6.jar + - jackson-datatype-jdk8-2.18.6.jar + - jackson-datatype-jsr310-2.18.6.jar + - jackson-module-parameter-names-2.18.6.jar * Conscrypt -- conscrypt-openjdk-uber-2.5.2.jar * Gson - gson-2.13.2.jar diff --git a/pom.xml b/pom.xml index 15ef0a37999..cdfa022b517 100644 --- a/pom.xml +++ b/pom.xml @@ -159,7 +159,7 @@ flexible messaging model and an intuitive client API.</description> <bouncycastle.bcprov-ext-jdk18on.version>1.78.1</bouncycastle.bcprov-ext-jdk18on.version> <bouncycastle.bcpkix-fips.version>2.0.10</bouncycastle.bcpkix-fips.version> <bouncycastle.bc-fips.version>2.0.1</bouncycastle.bc-fips.version> - <jackson.version>2.17.2</jackson.version> + <jackson.version>2.18.6</jackson.version> <reflections.version>0.10.2</reflections.version> <swagger.version>1.6.10</swagger.version> <puppycrawl.checkstyle.version>10.14.2</puppycrawl.checkstyle.version> @@ -863,6 +863,10 @@ flexible messaging model and an intuitive client API.</description> <groupId>jakarta.activation</groupId> <artifactId>jakarta.activation-api</artifactId> </exclusion> + <exclusion> + <groupId>javax.xml.bind</groupId> + <artifactId>jaxb-api</artifactId> + </exclusion> </exclusions> </dependency> diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE index 59852166b0b..e30b1301e0d 100644 --- a/pulsar-sql/presto-distribution/LICENSE +++ b/pulsar-sql/presto-distribution/LICENSE @@ -207,19 +207,19 @@ This projects includes binary packages with the following licenses: The Apache Software License, Version 2.0 * Jackson - - jackson-annotations-2.17.2.jar - - jackson-core-2.17.2.jar - - jackson-databind-2.17.2.jar - - jackson-dataformat-smile-2.17.2.jar - - jackson-datatype-guava-2.17.2.jar - - jackson-datatype-jdk8-2.17.2.jar - - jackson-datatype-joda-2.17.2.jar - - jackson-datatype-jsr310-2.17.2.jar - - jackson-dataformat-yaml-2.17.2.jar - - jackson-jaxrs-base-2.17.2.jar - - jackson-jaxrs-json-provider-2.17.2.jar - - jackson-module-jaxb-annotations-2.17.2.jar - - jackson-module-jsonSchema-2.17.2.jar + - jackson-annotations-2.18.6.jar + - jackson-core-2.18.6.jar + - jackson-databind-2.18.6.jar + - jackson-dataformat-smile-2.18.6.jar + - jackson-datatype-guava-2.18.6.jar + - jackson-datatype-jdk8-2.18.6.jar + - jackson-datatype-joda-2.18.6.jar + - jackson-datatype-jsr310-2.18.6.jar + - jackson-dataformat-yaml-2.18.6.jar + - jackson-jaxrs-base-2.18.6.jar + - jackson-jaxrs-json-provider-2.18.6.jar + - jackson-module-jaxb-annotations-2.18.6.jar + - jackson-module-jsonSchema-2.18.6.jar * Guava - guava-32.1.1-jre.jar - listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar @@ -453,7 +453,7 @@ The Apache Software License, Version 2.0 * Snappy - snappy-java-1.1.10.5.jar * Jackson - - jackson-module-parameter-names-2.17.2.jar + - jackson-module-parameter-names-2.18.6.jar * Java Assist - javassist-3.25.0-GA.jar * Java Native Access
