test(security): replay Jackson LTS baseline on live develop

etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java

@@ -0,0 +1,61 @@
+package com.xtrmetl.etl.documentation;
+
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Guards the shared Maven dependency-management boundary against Jackson Databind versions that
+ * remain inside the currently known vulnerable 2.21.x range.
+ */
+class JacksonSecurityBaselineTest {
+
+    private static final Path PROJECT_ROOT = projectRoot();
+
+    @Test
+    void jacksonSecurityBomPrecedesImportedSpringBootDependencyManagement() throws IOException {
+        String pom = Files.readString(PROJECT_ROOT.resolve("pom.xml"), StandardCharsets.UTF_8);
+
+        assertTrue(
+                pom.contains("<jackson-bom.version>2.21.5</jackson-bom.version>"),
+                "Root dependency management must pin Jackson 2.21.5, the current patched 2.21 LTS baseline"
+        );
+
+        String jacksonBom = "<artifactId>jackson-bom</artifactId>";
+        String springBootBom = "<artifactId>spring-boot-dependencies</artifactId>";
+        int jacksonIndex = pom.indexOf(jacksonBom);
+        int springBootIndex = pom.indexOf(springBootBom);
+
+        assertTrue(jacksonIndex >= 0, "Root dependencyManagement must import the Jackson BOM explicitly");
+        assertTrue(springBootIndex >= 0, "Root dependencyManagement must continue importing Spring Boot dependencies");
+        assertTrue(
+                jacksonIndex < springBootIndex,
+                "Without the Spring Boot parent POM, the explicit Jackson override BOM must precede spring-boot-dependencies"
+        );
+    }
+
+    /** Finds the repository root from root- or module-scoped Maven execution. */
+    private static Path projectRoot() {
+        Path current = Paths.get(System.getProperty("user.dir")).toAbsolutePath();
+        Path lastPomParent = null;
+        while (current != null) {
+            if (Files.exists(current.resolve(".git"))) {
+                return current;
+            }
+            if (Files.exists(current.resolve("pom.xml"))) {
+                lastPomParent = current;
+            }
+            current = current.getParent();
+        }
+        if (lastPomParent != null) {
+            return lastPomParent;
+        }
+        throw new IllegalStateException("Could not find project root");
+    }
+}

pom.xml

@@ -23,6 +23,7 @@
         <java.version>25</java.version>
         <spring-boot.version>3.5.16</spring-boot.version>
         <spring-cloud.version>2025.0.3</spring-cloud.version>
+        <jackson-bom.version>2.21.5</jackson-bom.version>
         <postgresql.version>42.7.12</postgresql.version>
         <spring-kafka.version>3.3.16</spring-kafka.version>
         <spring-retry.version>2.0.13</spring-retry.version>
@@ -33,6 +34,18 @@
 
     <dependencyManagement>
         <dependencies>
+            <!--
+                Security override for the Jackson 2.21 LTS line. This project imports the Spring
+                Boot BOM rather than inheriting spring-boot-starter-parent, so Spring Boot's Maven
+                guidance requires an overriding dependency/BOM to appear before the Boot import.
+            -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson-bom.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>