From 0c836d8d456ce5c39400a7d3a2933fec06eebeff Mon Sep 17 00:00:00 2001 From: Akshay Rai Date: Thu, 25 Jun 2026 13:03:54 +0530 Subject: [PATCH] Bump jacksonVersion 2.10.0 -> 2.18.8 to close two BasicPolymorphicTypeValidator CVEs The fasterxml/jackson-databind project published patches for two High-severity polymorphic-type-validation bypasses: CVE-2026-54513 (GHSA-rmj7-2vxq-3g9f) allowIfSubTypeIsArray array-subtype allowlist bypass. CVE-2026-54512 (GHSA-j3rv-43j4-c7qm) Generic-type-parameter bypass that allows arbitrary class instantiation. Both CVEs cover every release before the per-line patched versions: 2.10.x..2.18.7 -> patched in 2.18.8 2.19.x..2.21.3 -> patched in 2.21.4 3.0.0..3.1.3 -> patched in 3.1.4 OSS Brooklin's gradle/dependency-versions.gradle has been pinned at 2.10.0 since the original log4j2 migration (f2bd8edd); under the CVE ranges, every downstream consumer is vulnerable. Bump the floor to 2.18.8 -- the smallest jump that lands in a patched release line. Picked over 2.21.4 (the next-line patched release) to minimize compatibility risk: 2.10 -> 2.18 stays within Jackson's backward-compatible-by-default API contract; 2.10 -> 2.21 has been known to surface deserialization-edge-case breakages in BigDecimal / duration / nullability defaults. All three jackson-{annotations,core,databind} declarations in build.gradle already share this single $jacksonVersion property, so the bump propagates uniformly. No source changes needed: the offending Jackson APIs used by datastream-common's JsonUtils, AvroEncodingException, etc. are API-compatible between 2.10 and 2.18. Tested locally: ./gradlew build BUILD SUCCESSFUL. Co-Authored-By: Claude Opus 4.8 (1M context) --- gradle/dependency-versions.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/dependency-versions.gradle b/gradle/dependency-versions.gradle index 1094615d9..fc575a21c 100644 --- a/gradle/dependency-versions.gradle +++ b/gradle/dependency-versions.gradle @@ -9,7 +9,7 @@ ext { checkstyleVersion = "10.12.7" guavaVersion = "25.0-jre" intellijAnnotationsVersion = "12.0" - jacksonVersion = "2.10.0" + jacksonVersion = "2.18.8" jsr305Version = "3.0.2" kafkaVersion = "2.4.1.66" log4j2Version = "2.20.0"