test(security): replay Jackson LTS baseline on live develop

[seonghobae]

Purpose

Rebuild stale shared security remediation #160 from exact protected develop@106add38465937f6eb4e4accc185fd30aab4446f without rewriting its history or transferring old evidence. This first commit is deliberately test-only RED: the current protected root POM still imports Spring Boot 3.5.16 dependency management without an explicit Jackson override, while the current 2.21 LTS security baseline remains 2.21.5.

Exact identity

• protected/live base: develop@106add38465937f6eb4e4accc185fd30aab4446f;
• branch: security/jackson-databind-2.21.5-106add;
• test-only head: 056588c98f1858fd2e7815819d66f47846860663;
• changed path: only etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java;
• predecessor fix(security): move Jackson to fixed 2.21.5 baseline #160 remains preserved and open until unique-work preservation plus current-base GREEN are proven.

RED contract

The focused test requires the root build to:

• declare exact Jackson BOM version 2.21.5;
• explicitly import jackson-bom;
• place that override before spring-boot-dependencies, matching the repository's imported-BOM topology rather than a Spring Boot parent-POM property override.

Protected develop satisfies none of those Jackson override assertions, so hosted execution should fail at the intended dependency-management contract boundary. Do not add the production BOM until that RED is observed on this exact head/base.

Shared acceptance boundaries

This replacement does not reinterpret incomplete Trivy Maven resolution (#196), synthetic-only execution, repository-wide coverage incompleteness (#205), or absent independent review as passing. Old #160 checks/reviews/approvals do not transfer. Keep Draft until a current-base RED is established, the smallest supported production remedy is applied, deterministic/security evidence is regenerated on the unchanged resulting identity, and every independent repository gate is satisfied.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6f707aaa-c741-4f3c-b9f6-7744388da8dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by protected develop@502d1e2136f18b7dea3baa792559128dc87fec39; no unique work remains on this branch.

Fresh preservation proof before closure:

• PR head is unchanged at 1e6a601e0e32770c629410d8f5b9623e3b6db39; independent live develop tip is 502d1e2136f18b7dea3baa792559128dc87fec39.
• The PR differs from its stale merge base only in root pom.xml and JacksonSecurityBaselineTest.java.
• Protected develop already pins jackson-bom.version to 2.21.5 and imports com.fasterxml.jackson:jackson-bom before spring-boot-dependencies, preserving the full production remediation.
• Protected develop also contains JacksonSecurityBaselineTest; its current structural XML assertions are strictly stronger than this branch's substring-based contract, additionally rejecting decoy Jackson declarations and requiring exactly one correctly scoped BOM import.
• No formal reviews or unresolved review threads exist on this PR, so no independent review artifact is being discarded.

Closing as a proven superseded duplicate rather than retargeting/rebasing stale evidence. No check/review result from this branch is transferred to protected develop.