Your message dated Thu, 11 Jun 2026 21:02:48 +0000
with message-id <[email protected]>
and subject line Bug#1135410: fixed in jackson-databind 2.14.0+ds-1+deb13u1
has caused the Debian Bug report #1135410,
regarding jackson-databind: FTBFS: unreported exception java.io.IOException;
must be caught or declared to be thrown
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1135410: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135410
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: src:jackson-databind
Version: 2.14.0+ds-1
Severity: serious
Tags: ftbfs forky sid
Dear maintainer:
During a rebuild of all packages in unstable, this package failed to build.
Below you will find the last part of the build log (probably the most
relevant part, but not necessarily). If required, the full build log
is available here:
https://people.debian.org/~sanvila/build-logs/202605/
About the archive rebuild: The build was made on virtual machines from AWS,
using sbuild and a reduced chroot with only build-essential packages.
If you cannot reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.
If this is really a bug in one of the build-depends, please use
reassign and add an affects on src:jackson-databind, so that this is still
visible in the BTS web page for this package.
Thanks.
--------------------------------------------------------------------------------
[...]
debian/rules clean
dh clean --with javahelper
dh_auto_clean
bash -c "for dir in \$(find . -name target -type d); do if [ -f \$(echo
\$dir | sed -e s/target\$/pom.xml/) ]; then rm -Rf \$dir; fi done"
mh_unpatchpoms -plibjackson2-databind-java
jh_clean
Duplicate specification "unlink|u" for option "u"
dh_clean
debian/rules binary
dh binary --with javahelper
dh_update_autotools_config
dh_autoreconf
dh_auto_configure
mh_patchpoms -plibjackson2-databind-java --debian-build
--keep-pom-version
--maven-repo=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian/maven-repo
jh_linkjars
dh_auto_build
/usr/lib/jvm/default-java/bin/java -noverify -cp
/usr/share/maven/boot/plexus-classworlds-2.x.jar -Dmaven.home=/usr/share/maven
-Dmaven.multiModuleProjectDirectory=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds
-Dclassworlds.conf=/etc/maven/m2-debian.conf
-Dproperties.file.manual=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian/maven.properties
org.codehaus.plexus.classworlds.launcher.Launcher
-s/etc/maven/settings-debian.xml
-Ddebian.dir=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian
-Dmaven.repo.local=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian/maven-repo
--batch-mode package -DskipTests -Dnotimestamp=true -Dlocale=en_US
OpenJDK 64-Bit Server VM warning: Options -Xverify:none and -noverify were
deprecated in JDK 13 and will likely be removed in a future release.
WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
WARNING: sun.misc.Unsafe::objectFieldOffset has been called by
com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
(file:/usr/share/maven/lib/guava.jar)
WARNING: Please consider reporting this to the maintainers of class
com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
[INFO] Scanning for projects...
[INFO] Looking for compatible RELEASE version of plugin
org.apache.felix:maven-bundle-plugin
[WARNING]
[WARNING] Some problems were encountered while building the effective model for
com.fasterxml.jackson.core:jackson-databind:bundle:2.14.0
[WARNING] 'build.plugins.plugin.version' for
org.apache.maven.plugins:maven-compiler-plugin is missing. @
com.fasterxml:oss-parent:debian,
/<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom,
line 173, column 12
[WARNING] 'build.plugins.plugin.version' for
org.apache.maven.plugins:maven-jar-plugin is missing. @
com.fasterxml:oss-parent:debian,
/<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom,
line 226, column 12
[WARNING] 'build.plugins.plugin.version' for
org.apache.felix:maven-bundle-plugin is missing. @
com.fasterxml:oss-parent:debian,
/<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom,
line 221, column 12
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten
the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support
building such malformed projects.
[WARNING]
[INFO]
[INFO] ------------< com.fasterxml.jackson.core:jackson-databind >-------------
[INFO] Building jackson-databind 2.14.0
[INFO] from pom.xml
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO] Looking for compatible RELEASE version of plugin
org.apache.maven.plugins:maven-compiler-plugin
[INFO] Looking for compatible RELEASE version of plugin
org.apache.maven.plugins:maven-jar-plugin
[INFO] Looking for compatible RELEASE version of plugin
org.apache.maven.plugins:maven-resources-plugin
[INFO] Looking for compatible RELEASE version of plugin
org.apache.maven.plugins:maven-install-plugin
[INFO] Looking for compatible RELEASE version of plugin
org.apache.maven.plugins:maven-deploy-plugin
[INFO] Looking for compatible RELEASE version of plugin
org.apache.maven.plugins:maven-shade-plugin
[INFO]
[INFO] --- replacer:1.5.3:replace (process-packageVersion) @ jackson-databind
---
[INFO] Replacement run on 1 file.
[INFO]
[INFO] --- build-helper:3.3.0:add-source (add-generated-sources) @
jackson-databind ---
[INFO] Source directory: /<<PKGBUILDDIR>>/target/generated-sources added.
[INFO]
[INFO] --- build-helper:3.3.0:add-resource (add-resource) @ jackson-databind ---
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ jackson-databind ---
[INFO] Copying 2 resources from src/main/resources to target/classes
[INFO] Copying 1 resource from . to target/classes/META-INF
[INFO]
[INFO] --- compiler:3.13.0:compile (default-compile) @ jackson-databind ---
[WARNING] Parameter 'optimize' (user property 'maven.compiler.optimize') is
deprecated: This property is a no-op in javac.
[INFO] Recompiling the module because of changed source code.
[INFO] Compiling 465 source files with javac [debug:lines,source,vars optimize
deprecation target 1.8] to target/classes
[INFO]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/node/ObjectNode.java:
Some input files use unchecked or unsafe operations.
[INFO]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/node/ObjectNode.java:
Recompile with -Xlint:unchecked for details.
[INFO] -------------------------------------------------------------
[WARNING] COMPILATION WARNING :
[INFO] -------------------------------------------------------------
[WARNING] bootstrap class path is not set in conjunction with -source 8
not setting the bootstrap class path may lead to class files that cannot run
on JDK 8
--release 8 is recommended instead of -source 8 -target 1.8 because it sets
the bootstrap class path automatically
[WARNING] source value 8 is obsolete and will be removed in a future release
[WARNING] target value 8 is obsolete and will be removed in a future release
[WARNING] To suppress warnings about obsolete options, use -Xlint:-options.
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java:[6,21]
java.security.AccessController in java.security has been deprecated and marked
for removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/cfg/MapperBuilder.java:[3,21]
java.security.AccessController in java.security has been deprecated and marked
for removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/introspect/AnnotatedMethod.java:[284,19]
isAccessible() in java.lang.reflect.AccessibleObject has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/introspect/AnnotatedField.java:[170,19]
isAccessible() in java.lang.reflect.AccessibleObject has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/introspect/AnnotatedConstructor.java:[213,22]
isAccessible() in java.lang.reflect.AccessibleObject has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/util/internal/PrivateMaxEntriesMap.java:[343,45]
getId() in java.lang.Thread has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/util/internal/PrivateMaxEntriesMap.java:[421,55]
getId() in java.lang.Thread has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java:[1138,15]
java.lang.SecurityManager in java.lang has been deprecated and marked for
removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java:[1138,42]
getSecurityManager() in java.lang.System has been deprecated and marked for
removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java:[1143,16]
java.security.AccessController in java.security has been deprecated and marked
for removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/cfg/MapperBuilder.java:[395,15]
java.lang.SecurityManager in java.lang has been deprecated and marked for
removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/cfg/MapperBuilder.java:[395,42]
getSecurityManager() in java.lang.System has been deprecated and marked for
removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/cfg/MapperBuilder.java:[400,16]
java.security.AccessController in java.security has been deprecated and marked
for removal
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java:[318,24]
URL(java.lang.String) in java.net.URL has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java:[418,24]
Locale(java.lang.String) in java.util.Locale has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java:[424,24]
Locale(java.lang.String,java.lang.String) in java.util.Locale has been
deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java:[430,24]
Locale(java.lang.String,java.lang.String,java.lang.String) in java.util.Locale
has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java:[475,24]
Locale(java.lang.String,java.lang.String,java.lang.String) in java.util.Locale
has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/util/ClassUtil.java:[1000,20]
isAccessible() in java.lang.reflect.AccessibleObject has been deprecated
[WARNING]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/deser/std/StdKeyDeserializer.java:[226,24]
URL(java.lang.String) in java.net.URL has been deprecated
[INFO] 24 warnings
[INFO] -------------------------------------------------------------
[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR :
[INFO] -------------------------------------------------------------
[ERROR]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java:[3875,30]
unreported exception java.io.IOException; must be caught or declared to be
thrown
[INFO] 1 error
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 4.346 s
[INFO] Finished at: 2026-05-01T21:11:35Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal
org.apache.maven.plugins:maven-compiler-plugin:3.13.0:compile (default-compile)
on project jackson-databind: Compilation failure
[ERROR]
/<<PKGBUILDDIR>>/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java:[3875,30]
unreported exception java.io.IOException; must be caught or declared to be
thrown
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e
switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please
read the following articles:
[ERROR] [Help 1]
http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
dh_auto_build: error: /usr/lib/jvm/default-java/bin/java -noverify -cp
/usr/share/maven/boot/plexus-classworlds-2.x.jar -Dmaven.home=/usr/share/maven
-Dmaven.multiModuleProjectDirectory=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds
-Dclassworlds.conf=/etc/maven/m2-debian.conf
-Dproperties.file.manual=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian/maven.properties
org.codehaus.plexus.classworlds.launcher.Launcher
-s/etc/maven/settings-debian.xml
-Ddebian.dir=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian
-Dmaven.repo.local=/<<BUILDDIR>>/jackson-databind-2.14.0\+ds/debian/maven-repo
--batch-mode package -DskipTests -Dnotimestamp=true -Dlocale=en_US returned
exit code 1
make: *** [debian/rules:8: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess failed with exit
status 2
--------------------------------------------------------------------------------
--- End Message ---
--- Begin Message ---
Source: jackson-databind
Source-Version: 2.14.0+ds-1+deb13u1
Done: Markus Koschany <[email protected]>
We believe that the bug you reported is fixed in the latest version of
jackson-databind, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Markus Koschany <[email protected]> (supplier of updated jackson-databind package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 10 Jun 2026 21:40:22 CEST
Source: jackson-databind
Architecture: source
Version: 2.14.0+ds-1+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Markus Koschany <[email protected]>
Checksums-Sha1:
de517f0f74a9aba96a78c615d1a0d588a9edb593 2601
jackson-databind_2.14.0+ds-1+deb13u1.dsc
f433c59dd815901b22a004d474f92ff5157d66cc 1058028
jackson-databind_2.14.0+ds.orig.tar.xz
583f3760d8c17c3fd7eabf254996c71a64b4473b 8628
jackson-databind_2.14.0+ds-1+deb13u1.debian.tar.xz
4029b6c72a3f6f6ebc9fc1f3c3b7f9f491510ab5 18427
jackson-databind_2.14.0+ds-1+deb13u1_amd64.buildinfo
Checksums-Sha256:
a65b28dda5366052ec210588d992d816333b4e2eadfeffa906044d0c96217df8 2601
jackson-databind_2.14.0+ds-1+deb13u1.dsc
311a2bcc6cca5ac74b7f27b5209d41cc023ab6e0d214dc0818ea5fad490ebf8c 1058028
jackson-databind_2.14.0+ds.orig.tar.xz
4d9deb97dbb0cbd1e14cf2afb04c9d97acad9c42d9b7d8285cc3e0d2b597d706 8628
jackson-databind_2.14.0+ds-1+deb13u1.debian.tar.xz
4f4289887898e94d2fd49f57be2521f9e4c732ed99d0b1d4a592a914b07a20bf 18427
jackson-databind_2.14.0+ds-1+deb13u1_amd64.buildinfo
Closes: 1135410
Changes:
jackson-databind (2.14.0+ds-1+deb13u1) trixie-security; urgency=medium
.
[ Otto Kekäläinen ]
* Enable Salsa CI to help avoid testable regressions before upload to Debian
* Fix broken Homepage link and add current upstream metadata. The site
wiki.fasterxml.com no longer exists. Replace it with link to the current
wiki location. Also add a metadata file following DEP-12, so it is easier
for both maintainers to find the correct upstream websites, as well as for
`git-buildpackage --add-upstreamvcs` feature to work.
* Define Debian packaging repository conventions in gbp.conf.
Add a git-buildpackage config file to show explicitly what conventions this
Debian source package repository uses. This way it is easier for current
maintainer to do e.g. new upstream version imports, as there are less
arguments that need to be passed to `gbp` commands, and also for any future
maintainer/contributor there is less guesswork.
.
[ Markus Koschany ]
* Add CVE-2025-52999.patch and fix a FBTFS due to changes in jackson-core.
(Closes: #1135410)
Files:
333e39c6575251821b0cea94e214a7a3 2601 java optional
jackson-databind_2.14.0+ds-1+deb13u1.dsc
23f198b8a35f2bbff250f5eca4b03e15 1058028 java optional
jackson-databind_2.14.0+ds.orig.tar.xz
ca8aa18a2087b3f456b7347ab3696866 8628 java optional
jackson-databind_2.14.0+ds-1+deb13u1.debian.tar.xz
83c8f8f2ed57cc7af1c5e19353cf81c3 18427 java optional
jackson-databind_2.14.0+ds-1+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmopvatfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkdrcQALH4fpRl+7VbTqXtLkguXMIgNkDBHxtklwxO
7gJehEcOo5+wWJM0tdHBquZk2JYpeKA+wO3dlBBXozrbuyeMtSu+dy6khEkcQHPJ
62D5ENApP1+PV2SfDk08nZdx56+ruSsdU6n89nKeeDPYeJipx3Z2Tt0SuV+YERkF
ZmnJtJpQ/PdL69L7iUjG2pn0xjhPSQSFetnFoxct+1qHYV9Dcw3gmFhu/iBGn0Mh
lpf2F598CNiiaqZ+wON0rokFkLZqqzkA2Sa3iEmeoFABamlHk7ql6wMGx9tSypue
+F8Q7g7gnO9XkY5wPG7eAWlFyb+fuwZUWiCXE9C+dvHDNRgWMxi76CSGcCuVtEUa
T6QmvrOtRPKmpHuUVSz+99wI9vAziG6+T3Z38/Ytd/X3xbhZHXFfoUegGAK5NqB/
yWFcDqeGM6kHgGn/dEeHGg/ve0AsatBUis3PGwJ1OJIs2hsAS0DU4mhQWP2pPV7L
BPdJKuECbTFspGhgvf23SXHGST75TpYYHc+d/KJU/JxK0yJKjKZsFgKwfNfz2kkw
PO6wLwGcYVFeOl/w0aM+gAqRNgv7GTv6OjmYXg+0ZgTqVdcdNkKhXA+1KaiRtRdk
5dU2CV3f2mxMjjJJHfBU7VagMEIICLqUoDObMi2QXzPSAvCmLhvjyp2S12WoRjp8
DlvWUnMA
=7X0O
-----END PGP SIGNATURE-----
pgpIuPHNd00B9.pgp
Description: PGP signature
--- End Message ---
__
This is the maintainer address of Debian's Java team
<https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
[email protected] for discussions and questions.
