Skip to content

MINOR: Update jackson due to CVE - #21614

Merged
chia7712 merged 2 commits into
apache:4.0from
viktorsomogyi:4.0
Mar 2, 2026
Merged

MINOR: Update jackson due to CVE#21614
chia7712 merged 2 commits into
apache:4.0from
viktorsomogyi:4.0

Conversation

@viktorsomogyi

@viktorsomogyi viktorsomogyi commented Mar 2, 2026 •
edited by chia7712
Loading

Copy link
Copy Markdown
Contributor

A jackson-core vulnerability was discovered while making the second RC for 4.0.2:
https: //www.miggo.io/vulnerability-database/cve/GHSA-72hv-8253-57qq

Reviewers: Josep Prat josep.prat@aiven.io, Chia-Ping Tsai chia7712@gmail.com

@viktorsomogyi viktorsomogyi added dependencies Pull requests that update a dependency file ci-approved labels Mar 2, 2026
@jlprat

jlprat commented Mar 2, 2026

Copy link
Copy Markdown
Contributor

My only concern for this bump is that we do 2 minor jumps (2.17 and 2.18).
As I can see there are some default changes happening in these jumps: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.17#changes-behavior, https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.18#changes-behavior

I just want to make sure we are not being affected by any of these changes in behavior.

@viktorsomogyi

viktorsomogyi commented Mar 2, 2026

Copy link
Copy Markdown
Contributor Author

@jlprat on trunk the first upgrade after 2.16 was to 2.19 (I was hoping for 2.18 :) ), and there are some code changes as well but due to deprecations in 2.19. I see no other changes that we would need. Went through the release notes you linked and couldn't find any uses of deprecated methods or defaults that have been changed.
One extra thing I'll do is update the LICENSE-binary to match the actual versions. Will be back shortly with that commit.

jlprat
jlprat approved these changes Mar 2, 2026
View reviewed changes

@jlprat jlprat left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Assuming CI is green

@chia7712
chia7712 merged commit d139c56 into apache:4.0 Mar 2, 2026
13 checks passed
Ko-dany pushed a commit to acceldata-io/kafka3 that referenced this pull request Sep 10, 2026
@viktorsomogyi @Ko-dany
MINOR: Update jackson due to CVE (#21614)
1914ee0 
A jackson-core vulnerability was discovered while making the second RC
for 4.0.2:
[https:
//www.miggo.io/vulnerability-database/cve/GHSA-72hv-8253-57qq](https://www.miggo.io/vulnerability-database/cve/GHSA-72hv-8253-57qq)

Reviewers: Josep Prat <josep.prat@aiven.io>, Chia-Ping Tsai
<chia7712@gmail.com>

Author: Viktor Somogyi-Vass <viktorsomogyi@github.com>
Closes apache/kafka#21614
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jlprat jlprat jlprat approved these changes
@chia7712 chia7712 chia7712 approved these changes

Assignees

No one assigned

Labels

ci-approved dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@viktorsomogyi @jlprat @chia7712