This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/master by this push:
new 3754f07a0fcf [fix][sec] Upgrade Jackson to 2.22.0 (#26101)
3754f07a0fcf is described below
commit 3754f07a0fcfa9314fa157f2f87c6d3ab2cd63ce
Author: Matteo Merli <[email protected]>
AuthorDate: Mon Jun 29 08:14:09 2026 -0700
[fix][sec] Upgrade Jackson to 2.22.0 (#26101)
---
distribution/server/src/assemble/LICENSE.bin.txt | 22 +++++++++++-----------
distribution/shell/src/assemble/LICENSE.bin.txt | 22 +++++++++++-----------
gradle/libs.versions.toml | 4 ++--
.../impl/conf/ConfigurationDataUtilsTest.java | 10 +++++++++-
4 files changed, 33 insertions(+), 25 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt
b/distribution/server/src/assemble/LICENSE.bin.txt
index 72418c8beafe..57709db6315e 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -249,17 +249,17 @@ The Apache Software License, Version 2.0
- info.picocli-picocli-shell-jline3-4.7.7.jar
* High Performance Primitive Collections for Java --
com.carrotsearch-hppc-0.9.1.jar
* Jackson
- - com.fasterxml.jackson.core-jackson-annotations-2.21.jar
- - com.fasterxml.jackson.core-jackson-core-2.21.3.jar
- - com.fasterxml.jackson.core-jackson-databind-2.21.3.jar
- - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.21.3.jar
- - com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-base-2.21.3.jar
- -
com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-json-provider-2.21.3.jar
- -
com.fasterxml.jackson.module-jackson-module-jakarta-xmlbind-annotations-2.21.3.jar
- - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.21.3.jar
- - com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.21.3.jar
- - com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.21.3.jar
- - com.fasterxml.jackson.module-jackson-module-parameter-names-2.21.3.jar
+ - com.fasterxml.jackson.core-jackson-annotations-2.22.jar
+ - com.fasterxml.jackson.core-jackson-core-2.22.0.jar
+ - com.fasterxml.jackson.core-jackson-databind-2.22.0.jar
+ - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.22.0.jar
+ - com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-base-2.22.0.jar
+ -
com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-json-provider-2.22.0.jar
+ -
com.fasterxml.jackson.module-jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
+ - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.22.0.jar
+ - com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.22.0.jar
+ - com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.22.0.jar
+ - com.fasterxml.jackson.module-jackson-module-parameter-names-2.22.0.jar
* Caffeine -- com.github.ben-manes.caffeine-caffeine-3.2.4.jar
* Conscrypt -- org.conscrypt-conscrypt-openjdk-uber-2.5.2.jar
* Fastutil -- it.unimi.dsi:fastutil (only the classes used by Pulsar, bundled
within pulsar-broker-fastutil-minimized)
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt
b/distribution/shell/src/assemble/LICENSE.bin.txt
index 383d8d152b17..dacc838194d2 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -313,17 +313,17 @@ The Apache Software License, Version 2.0
- picocli-4.7.7.jar
- picocli-shell-jline3-4.7.7.jar
* Jackson
- - jackson-annotations-2.21.jar
- - jackson-core-2.21.3.jar
- - jackson-databind-2.21.3.jar
- - jackson-dataformat-yaml-2.21.3.jar
- - jackson-jakarta-rs-base-2.21.3.jar
- - jackson-jakarta-rs-json-provider-2.21.3.jar
- - jackson-module-jakarta-xmlbind-annotations-2.21.3.jar
- - jackson-module-jsonSchema-2.21.3.jar
- - jackson-datatype-jdk8-2.21.3.jar
- - jackson-datatype-jsr310-2.21.3.jar
- - jackson-module-parameter-names-2.21.3.jar
+ - jackson-annotations-2.22.jar
+ - jackson-core-2.22.0.jar
+ - jackson-databind-2.22.0.jar
+ - jackson-dataformat-yaml-2.22.0.jar
+ - jackson-jakarta-rs-base-2.22.0.jar
+ - jackson-jakarta-rs-json-provider-2.22.0.jar
+ - jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
+ - jackson-module-jsonSchema-2.22.0.jar
+ - jackson-datatype-jdk8-2.22.0.jar
+ - jackson-datatype-jsr310-2.22.0.jar
+ - jackson-module-parameter-names-2.22.0.jar
* Caffeine -- caffeine-3.2.4.jar
* Conscrypt -- conscrypt-openjdk-uber-2.5.2.jar
* Gson
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 0635d1c2c249..26c634ba6385 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -28,8 +28,8 @@ zookeeper = "3.9.5"
netty = "4.2.15.Final"
jetty = "12.1.10"
jersey = "3.1.10"
-jackson = "2.21.3"
-jackson-annotations = "2.21"
+jackson = "2.22.0"
+jackson-annotations = "2.22"
protobuf = "4.35.0"
grpc = "1.79.0"
slf4j = "2.0.18"
diff --git
a/pulsar-client/src/test/java/org/apache/pulsar/client/impl/conf/ConfigurationDataUtilsTest.java
b/pulsar-client/src/test/java/org/apache/pulsar/client/impl/conf/ConfigurationDataUtilsTest.java
index 6861ab1314f9..1b598fcc95da 100644
---
a/pulsar-client/src/test/java/org/apache/pulsar/client/impl/conf/ConfigurationDataUtilsTest.java
+++
b/pulsar-client/src/test/java/org/apache/pulsar/client/impl/conf/ConfigurationDataUtilsTest.java
@@ -77,7 +77,15 @@ public class ConfigurationDataUtilsTest {
assertEquals("v2", confData.getAuthParamMap().get("k2"));
assertEquals("0.0.0.0", confData.getDnsLookupBindAddress());
assertEquals(0, confData.getDnsLookupBindPort());
- assertEquals(dnsServerAddresses, confData.getDnsServerAddresses());
+ // jackson-databind 2.22+ defers DNS resolution when deserializing
InetSocketAddress
+ // (CVE-2026-54514 fix), which changes the resolved/unresolved
representation. Compare host
+ // and port — the values that must survive the config round-trip —
instead of object equality.
+ List<InetSocketAddress> loadedDnsServerAddresses =
confData.getDnsServerAddresses();
+ assertEquals(loadedDnsServerAddresses.size(),
dnsServerAddresses.size());
+ for (int i = 0; i < dnsServerAddresses.size(); i++) {
+ assertEquals(loadedDnsServerAddresses.get(i).getHostString(),
dnsServerAddresses.get(i).getHostString());
+ assertEquals(loadedDnsServerAddresses.get(i).getPort(),
dnsServerAddresses.get(i).getPort());
+ }
}
@Test
