fix(deps): bump jackson-bom 2.21.4 → 2.21.5 (@JsonView bypass CVEs)#93
Merged
Conversation
Dependabot's security update for jackson-databind was failing with `security_update_dependency_not_found`: jackson-databind is a transitive-only dependency (via jackson-module-kotlin / the Spring Boot 3.5.16 BOM), so the direct-only security update could not patch it. 2.21.5 has now shipped to Maven Central and is the first patched version for both open alerts: - GHSA-mhm7-754m-9p8w (@JSONVIEW bypass, EXTERNAL_PROPERTY creators) - GHSA-5gvw-p9qm-jgwh / CVE-2026-59889 (@JSONVIEW bypass, @JsonUnwrapped) Override the BOM-managed `jackson-bom.version` so the whole Jackson family moves to 2.21.5 together, and regenerate the dependency lockfile. This remediates both CVEs and clears the recurring Dependabot failure. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WolfTasks
pushed a commit
that referenced
this pull request
Jul 23, 2026
Backend internationalization (#16, all three phases) + jackson-databind security patch. - #16 Backend i18n: API errors, emails (subject+body) and in-app notifications are now localized de/en in the recipient's language via Spring MessageSource (English fallback). Phases 1-2 API-error sweep, Phase 3 emails + notifications; guarded by 3 CI gates. - Security: jackson-bom 2.21.4 -> 2.21.5 (#93) fixes @JSONVIEW bypass CVEs GHSA-mhm7-754m-9p8w and GHSA-5gvw-p9qm-jgwh / CVE-2026-59889. - Maintenance: backend-deps #89 (postgresql 42.7.12), actions #88. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WolfTasks
pushed a commit
that referenced
this pull request
Jul 23, 2026
- #16 backend i18n: 🟩 GEMERGT → ✅ AUSGELIEFERT (Release v1.0.15). - New M2 row: jackson-databind 2.21.5 @JsonView-bypass CVE fix (PR #93) + Dependabot batches #88/#89, shipped in v1.0.15. - Resolve the stale "jackson deferred, no patch" note in the #12 section (2.21.5 shipped; BOM override; alerts #80/#81 closed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Dependabot security update for
com.fasterxml.jackson.core:jackson-databindhas been failing repeatedly (run 29959693576) with:Root cause: jackson-databind is a transitive-only dependency here (pulled via
jackson-module-kotlin/ the Spring Boot 3.5.16 BOM). Dependabot's security-update job is scoped todependency-type: direct, so it cannot find jackson-databind as a direct dependency to patch → the job errors out. This will keep recurring while the alerts are open.Two open Dependabot alerts, both
medium, both now patched in 2.21.5:@JsonViewbypass for@JsonTypeInfo(include=EXTERNAL_PROPERTY)creator properties@JsonViewbypass for@JsonUnwrappedcontainer propertiesThe stale in-code note claimed "2.21.5 unreleased" — but 2.21.5 has since shipped to Maven Central (verified HTTP 200).
Fix
Override the BOM-managed
jackson-bom.version(same pattern already used forcommons-lang3,logback,postgresql) so the whole Jackson family moves to 2.21.5 together, and regenerate the dependency lockfile.backend/build.gradle.kts:extra["jackson-bom.version"] = "2.21.5"+ updated commentbackend/gradle.lockfile: jackson-bom, jackson-core, jackson-databind, jackson-module-kotlin, jackson-datatype-, jackson-dataformat- → 2.21.5This remediates both CVEs and clears the recurring Dependabot failure once the default-branch dependency graph is rescanned.
Verification
./gradlew dependencies --write-locks— lockfile regenerated; no jackson entry remains on 2.21.4./gradlew compileKotlin compileTestKotlin— ✅ (patch bump, no source changes)🤖 Generated with Claude Code