dongjoon-hyun opened a new pull request, #990: URL: https://github.com/apache/spark-kubernetes-operator/pull/990
### What changes were proposed in this pull request? This PR aims to upgrade `Jackson` to 2.22.4. `jackson-annotations` stays at 2.22 because it has no 2.22.4 release (2.22 is the version paired with 2.22.4 by `jackson-bom`). `gradle/verification-metadata.xml` was regenerated from scratch. ### Why are the changes needed? To bring the latest bug fixes and security fixes. - [Jackson 2.22.4](https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.22.4) (2026-10-17, [jackson-databind-2.22.4](https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.4)) - [CVE-2026-110879](https://github.com/FasterXML/jackson-databind/pull/6287): Validate type parameters and array element types of type ids - A cycle through a `@JsonValue` accessor is reported as `DatabindException` ([#6206](https://github.com/FasterXML/jackson-databind/pull/6206)) - `BeanDescription.findProperties()` is not thread-safe when called concurrently on a shared, cached instance ([#6227](https://github.com/FasterXML/jackson-databind/issues/6227)) - Avoid an NPE when the parser reports `VALUE_STRING` with null text ([#6249](https://github.com/FasterXML/jackson-databind/pull/6249)) - The `\uXXXX` escape accepts lone surrogates in field names for `ReaderBasedJsonParser` ([#1683](https://github.com/FasterXML/jackson-core/issues/1683)) - `UTF8DataInputJsonParser` fails on JSON-escaped surrogate pairs in property names ([#1744](https://github.com/FasterXML/jackson-core/issues/1744)) - `ALLOW_UNESCAPED_CONTROL_CHARS` is ignored for single-quoted string values in UTF-8 byte parsers ([#1750](https://github.com/FasterXML/jackson-core/issues/1750)) - `FilteringGeneratorDelegate` handles embedded objects, typed arrays, and raw/binary values consistently ([#1730](https://github.com/FasterXML/jackson-core/pull/1730)) - Several non-blocking parser fixes ([#1742](https://github.com/FasterXML/jackson-core/issues/1742), [#1746](https://github.com/FasterXML/jackson-core/issues/1746), [#1756](https://github.com/FasterXML/jackson-core/issues/1756)) - The release also fixes six CVEs in the Avro, CBOR, Protobuf, and Smile data formats of `jackson-dataformats-binary` ([CVE-2026-104015](https://github.com/FasterXML/jackson-dataformats-binary/issues/819), [CVE-2026-106554](https://github.com/FasterXML/jackson-dataformats-binary/issues/821), [CVE-2026-104016, CVE-2026-104017, CVE-2026-110747](https://github.com/FasterXML/jackson-dataformats-binary/pull/817), [CVE-2026-104895](https://github.com/FasterXML/jackson-dataformats-binary/issues/825)). Those modules are not bundled by this project. ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. In addition, `gradle build` (Checkstyle, PMD, SpotBugs, JaCoCo, and all unit tests) and `gradle spotlessCheck` passed locally. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Sonnet 5.5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
