Hi everyone, I'm working on security focused dependency bumps for the 3.7.7 and 3.8.2 releases. One of the main offenders in this regard is jackson-databind. We are currently on 2.15.2, which has 8 CVEs which would be resolved by upgrading to 2.18.9. There is one complication though, in that jackson-databind:2.18.9 has restricted InetAddress deserialization to throw on any hostnames other than pure Ipv4/IPv6 addresses. This appears to have been done pro-actively by the jackson maintainers to block the DNS-resolution threat-vector which was described for InetSocketAddress in https://nvd.nist.gov/vuln/detail/CVE-2026-54514.
We have 2 options for how to proceed with this upgrade, we can accept the new restriction from jackson as a minor breaking change, or we can register our own custom InetAddress deserializer with a DNS resolution layer which would re-introduce the vulnerability, but maintain backwards compatibility. I've opted to go with the former, as I believe it has a very minor impact and is justified by patching the known vulnerability. I have opened a PR which includes these changes: https://github.com/apache/tinkerpop/pull/3583. Please let me know if you have any concerns with this approach. Thanks, Cole
