Skip to content

Bump jackson_version - Fix GHSA-72hv-8253-57qq #37969

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stankiewicz merged 2 commits into from
May 15, 2026
Merged

Bump jackson_version - Fix GHSA-72hv-8253-57qq #37969

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8486da5
Bump jackson_version - Fix GHSA-72hv-8253-57qq
stankiewicz Mar 26, 2026
d8658e8
Update dep_urls_java.yaml
stankiewicz Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -623,7 +623,7 @@ class BeamModulePlugin implements Plugin<Project> {
def httpclient_version = "4.5.13"
def httpcore_version = "4.4.14"
def iceberg_bqms_catalog_version = "1.6.1-1.0.1"
def jackson_version = "2.15.4"
def jackson_version = "2.18.6"

@gemini-code-assist gemini-code-assist Bot May 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The version 2.18.6 for Jackson does not appear to exist in Maven Central. The latest stable release in the 2.18.x series is 2.18.2. Using a non-existent version will cause the build to fail. Additionally, the CHANGES.md file should be updated to reflect this dependency change as noted in the pull request checklist.

    def jackson_version = "2.18.2"

def jaxb_api_version = "2.3.3"
def jsr305_version = "3.0.2"
def everit_json_version = "1.14.2"
Expand Down
2 changes: 1 addition & 1 deletion sdks/java/container/license_scripts/dep_urls_java.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ xz:
'1.5': # The original repo is down. This license is taken from https://tukaani.org/xz/java.html.
license: "file://{}/xz/COPYING"
jackson-bom:
'2.15.4':
'2.18.6':

@gemini-code-assist gemini-code-assist Bot May 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The version 2.18.6 does not exist. This should be updated to match the version used in the build configuration (e.g., 2.18.2).

  '2.18.2':

license: "https://raw.githubusercontent.com/FasterXML/jackson-bom/master/LICENSE"
type: "Apache License 2.0"
org.eclipse.jgit:
Expand Down
Loading