Hi, Both come from jackson-databind, so I reassigned them.
CVE-2025-52999.patch (https://security-tracker.debian.org/tracker/CVE-2025-52999) adds "throws IOException" to ObjectMapper.writeValueAsString() and ObjectWriter.writeValueAsString(). Code that only catches JsonProcessingException no longer compiles. Upstream fixed the CVE without changing the signature: https://github.com/FasterXML/jackson-databind/commit/71003893a583da54e9a2b0fe619da64449bca673 Fix doing the same: https://salsa.debian.org/java-team/jackson-databind/-/merge_requests/11 With it libwikidata-toolkit-java builds again. jackson-modules-java8 also needs the jackson-core fix for #1135411. trixie and bookworm have the same patch, so these stay open there. Thanks, Juan
