This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/master by this push:
new e86f59f1fd55 [fix][sec] Downgrade Jackson version to 2.21.5 LTS
(#26166)
e86f59f1fd55 is described below
commit e86f59f1fd5585480192c0bc789f8580486b03d8
Author: Lari Hotari <[email protected]>
AuthorDate: Thu Jul 9 16:12:40 2026 +0300
[fix][sec] Downgrade Jackson version to 2.21.5 LTS (#26166)
---
distribution/server/src/assemble/LICENSE.bin.txt | 22 +++++++++++-----------
distribution/shell/src/assemble/LICENSE.bin.txt | 22 +++++++++++-----------
gradle/libs.versions.toml | 4 ++--
3 files changed, 24 insertions(+), 24 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt
b/distribution/server/src/assemble/LICENSE.bin.txt
index 57709db6315e..4c628207ca50 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -249,17 +249,17 @@ The Apache Software License, Version 2.0
- info.picocli-picocli-shell-jline3-4.7.7.jar
* High Performance Primitive Collections for Java --
com.carrotsearch-hppc-0.9.1.jar
* Jackson
- - com.fasterxml.jackson.core-jackson-annotations-2.22.jar
- - com.fasterxml.jackson.core-jackson-core-2.22.0.jar
- - com.fasterxml.jackson.core-jackson-databind-2.22.0.jar
- - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.22.0.jar
- - com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-base-2.22.0.jar
- -
com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-json-provider-2.22.0.jar
- -
com.fasterxml.jackson.module-jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
- - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.22.0.jar
- - com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.22.0.jar
- - com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.22.0.jar
- - com.fasterxml.jackson.module-jackson-module-parameter-names-2.22.0.jar
+ - com.fasterxml.jackson.core-jackson-annotations-2.21.jar
+ - com.fasterxml.jackson.core-jackson-core-2.21.5.jar
+ - com.fasterxml.jackson.core-jackson-databind-2.21.5.jar
+ - com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.21.5.jar
+ - com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-base-2.21.5.jar
+ -
com.fasterxml.jackson.jakarta.rs-jackson-jakarta-rs-json-provider-2.21.5.jar
+ -
com.fasterxml.jackson.module-jackson-module-jakarta-xmlbind-annotations-2.21.5.jar
+ - com.fasterxml.jackson.module-jackson-module-jsonSchema-2.21.5.jar
+ - com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.21.5.jar
+ - com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.21.5.jar
+ - com.fasterxml.jackson.module-jackson-module-parameter-names-2.21.5.jar
* Caffeine -- com.github.ben-manes.caffeine-caffeine-3.2.4.jar
* Conscrypt -- org.conscrypt-conscrypt-openjdk-uber-2.5.2.jar
* Fastutil -- it.unimi.dsi:fastutil (only the classes used by Pulsar, bundled
within pulsar-broker-fastutil-minimized)
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt
b/distribution/shell/src/assemble/LICENSE.bin.txt
index dacc838194d2..11bb23018007 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -313,17 +313,17 @@ The Apache Software License, Version 2.0
- picocli-4.7.7.jar
- picocli-shell-jline3-4.7.7.jar
* Jackson
- - jackson-annotations-2.22.jar
- - jackson-core-2.22.0.jar
- - jackson-databind-2.22.0.jar
- - jackson-dataformat-yaml-2.22.0.jar
- - jackson-jakarta-rs-base-2.22.0.jar
- - jackson-jakarta-rs-json-provider-2.22.0.jar
- - jackson-module-jakarta-xmlbind-annotations-2.22.0.jar
- - jackson-module-jsonSchema-2.22.0.jar
- - jackson-datatype-jdk8-2.22.0.jar
- - jackson-datatype-jsr310-2.22.0.jar
- - jackson-module-parameter-names-2.22.0.jar
+ - jackson-annotations-2.21.jar
+ - jackson-core-2.21.5.jar
+ - jackson-databind-2.21.5.jar
+ - jackson-dataformat-yaml-2.21.5.jar
+ - jackson-jakarta-rs-base-2.21.5.jar
+ - jackson-jakarta-rs-json-provider-2.21.5.jar
+ - jackson-module-jakarta-xmlbind-annotations-2.21.5.jar
+ - jackson-module-jsonSchema-2.21.5.jar
+ - jackson-datatype-jdk8-2.21.5.jar
+ - jackson-datatype-jsr310-2.21.5.jar
+ - jackson-module-parameter-names-2.21.5.jar
* Caffeine -- caffeine-3.2.4.jar
* Conscrypt -- conscrypt-openjdk-uber-2.5.2.jar
* Gson
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 2eef6b317495..e945600ba2d6 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -28,8 +28,8 @@ zookeeper = "3.9.5"
netty = "4.2.15.Final"
jetty = "12.1.10"
jersey = "3.1.10"
-jackson = "2.22.0"
-jackson-annotations = "2.22"
+jackson = "2.21.5"
+jackson-annotations = "2.21"
protobuf = "4.35.0"
grpc = "1.79.0"
slf4j = "2.0.18"
