Skip to content

[1.10.x] Bump jackson from 2.19.2 to 2.21.2 to fix GHSA-72hv-8253-57qq #15847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amogh-jahagirdar merged 2 commits into from
Apr 2, 2026
Merged

[1.10.x] Bump jackson from 2.19.2 to 2.21.2 to fix GHSA-72hv-8253-57qq #15847

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c87aaa6
[1.10.x] Bump jackson from 2.19.2 to 2.21.2 to fix GHSA-72hv-8253-57qq
manuzhang Apr 1, 2026
a4c2ed1
Update kafka-connect LICENSE and NOTICE files
manuzhang Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions gradle/libs.versions.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,8 @@ hadoop3 = "3.4.1"
httpcomponents-httpclient5 = "5.5"
hive2 = { strictly = "2.3.10"} # see rich version usage explanation above
immutables-value = "2.11.3"
jackson-bom = "2.19.2"
jackson-annotations = "2.21"
jackson-bom = "2.21.2"
jackson211 = { strictly = "2.11.4"} # see rich version usage explanation above
jackson212 = { strictly = "2.12.3"}
jackson213 = { strictly = "2.13.4"}
Expand Down Expand Up @@ -146,7 +147,7 @@ immutables-value = { module = "org.immutables:value", version.ref = "immutables-
jackson-bom = { module = "com.fasterxml.jackson:jackson-bom", version.ref = "jackson-bom" }
jackson-core = { module = "com.fasterxml.jackson.core:jackson-core", version.ref = "jackson-bom" }
jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "jackson-bom" }
jackson-annotations = { module = "com.fasterxml.jackson.core:jackson-annotations", version.ref = "jackson-bom" }
jackson-annotations = { module = "com.fasterxml.jackson.core:jackson-annotations", version.ref = "jackson-annotations" }
jackson211-bom = { module = "com.fasterxml.jackson:jackson-bom", version.ref = "jackson211" }
jackson212-bom = { module = "com.fasterxml.jackson:jackson-bom", version.ref = "jackson212" }
jackson213-bom = { module = "com.fasterxml.jackson:jackson-bom", version.ref = "jackson213" }
Expand Down
29 changes: 12 additions & 17 deletions kafka-connect/kafka-connect-runtime/hive/LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,54 +273,49 @@ License (from POM): The MIT License (MIT) - http://opensource.org/licenses/MIT

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.19.2
Project URL (from manifest): https://github.com/FasterXML/jackson
Project URL (from POM): https://github.com/FasterXML/jackson
Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.21
Project URL (from manifest): https://github.com/FasterXML/jackson-annotations
Project URL (from POM): https://github.com/FasterXML/jackson-annotations
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-core
Project URL (from POM): https://github.com/FasterXML/jackson-core
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.19.2
Project URL (from manifest): https://github.com/FasterXML/jackson
Project URL (from POM): https://github.com/FasterXML/jackson
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-databind
Project URL (from POM): https://github.com/FasterXML/jackson-databind
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.19.2
Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jsr310
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.jaxrs Name: jackson-jaxrs-base Version: 2.19.2
Group: com.fasterxml.jackson.jaxrs Name: jackson-jaxrs-base Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-jaxrs-providers/jackson-jaxrs-base
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.jaxrs Name: jackson-jaxrs-json-provider Version: 2.19.2
Group: com.fasterxml.jackson.jaxrs Name: jackson-jaxrs-json-provider Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-jaxrs-providers/jackson-jaxrs-json-provider
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.module Name: jackson-module-jaxb-annotations Version: 2.19.2
Group: com.fasterxml.jackson.module Name: jackson-module-jaxb-annotations Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-modules-base
Project URL (from POM): https://github.com/FasterXML/jackson-modules-base
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------
Expand Down Expand Up @@ -2141,4 +2136,4 @@ Group: com.google.flatbuffers Name: flatbuffers-java Version: 24.3.25
Project URL: https://github.com/google/flatbuffers
License (from POM): The Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------
Copy link
Copy Markdown
Contributor

@amogh-jahagirdar amogh-jahagirdar Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did this change?

Copy link
Copy Markdown
Member Author

@manuzhang manuzhang Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No new line at the end of the file.

Copy link
Copy Markdown
Contributor

@amogh-jahagirdar amogh-jahagirdar Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer to try to avoid these kinds of changes when they're not needed but It's fine.

--------------------------------------------------------------------------------
12 changes: 6 additions & 6 deletions kafka-connect/kafka-connect-runtime/hive/NOTICE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ Notice: # Notices for Jakarta Activation

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.module Name: jackson-module-jaxb-annotations Version: 2.19.2
Group: com.fasterxml.jackson.module Name: jackson-module-jaxb-annotations Version: 2.21.2

Notice: # Jackson JSON processor

Expand Down Expand Up @@ -336,7 +336,7 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.21.2
Group: software.amazon.awssdk Name: third-party-jackson-core Version: 2.33.0

Notice:
Expand Down Expand Up @@ -375,7 +375,7 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.19.2
Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.21.2

Notice:
| # Jackson JSON processor
Expand Down Expand Up @@ -477,8 +477,8 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.21
Copy link
Copy Markdown
Contributor

@amogh-jahagirdar amogh-jahagirdar Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this also 2.21.2?

Copy link
Copy Markdown
Member Author

@manuzhang manuzhang Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, jackson-annotations got its own version since 2.20.
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations

Copy link
Copy Markdown
Contributor

@amogh-jahagirdar amogh-jahagirdar Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the pointer!

Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.21.2

Notice:
| # Jackson JSON processor
Expand All @@ -505,7 +505,7 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.jaxrs Name: jackson-jaxrs-json-provider Version: 2.19.2
Group: com.fasterxml.jackson.jaxrs Name: jackson-jaxrs-json-provider Version: 2.21.2

Notice:
| # Jackson JSON processor
Expand Down
19 changes: 8 additions & 11 deletions kafka-connect/kafka-connect-runtime/main/LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,32 +261,29 @@ License (from POM): The MIT License (MIT) - http://opensource.org/licenses/MIT

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.19.2
Project URL (from manifest): https://github.com/FasterXML/jackson
Project URL (from POM): https://github.com/FasterXML/jackson
Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.21
Project URL (from manifest): https://github.com/FasterXML/jackson-annotations
Project URL (from POM): https://github.com/FasterXML/jackson-annotations
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-core
Project URL (from POM): https://github.com/FasterXML/jackson-core
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.19.2
Project URL (from manifest): https://github.com/FasterXML/jackson
Project URL (from POM): https://github.com/FasterXML/jackson
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-databind
Project URL (from POM): https://github.com/FasterXML/jackson-databind
License (from POM): The Apache Software License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.19.2
Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.21.2
Project URL (from manifest): https://github.com/FasterXML/jackson-modules-java8/jackson-datatype-jsr310
License (from POM): Apache License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt
License (from POM): The Apache Software License, Version 2.0 - http://www.apache.org/licenses/LICENSE-2.0.txt

--------------------------------------------------------------------------------
Expand Down
8 changes: 4 additions & 4 deletions kafka-connect/kafka-connect-runtime/main/NOTICE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-core Version: 2.21.2
Group: software.amazon.awssdk Name: third-party-jackson-core Version: 2.33.0

Notice:
Expand Down Expand Up @@ -271,7 +271,7 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.19.2
Group: com.fasterxml.jackson.datatype Name: jackson-datatype-jsr310 Version: 2.21.2

Notice:
| # Jackson JSON processor
Expand All @@ -294,8 +294,8 @@ Notice:

--------------------------------------------------------------------------------

Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.19.2
Group: com.fasterxml.jackson.core Name: jackson-annotations Version: 2.21
Group: com.fasterxml.jackson.core Name: jackson-databind Version: 2.21.2

Notice:
| # Jackson JSON processor
Expand Down
Loading