fix(security): align Jackson with patched 2.21 LTS BOM

[seonghobae]

Rebuilds the shared Jackson security baseline from exact protected develop@609b2901d9b6b7a32c38cbbce4d27ace30dbe042 rather than rewriting stale-base #160/#291.

TDD evidence is preserved: test-only RED was exact source 8c393ca38241b00dc851177734530633fcfc8130. JacksonSecurityBaselineTest required the root dependency-management contract to import jackson-bom:2.21.5 before spring-boot-dependencies. The implementation head 7e86513a7f04adef85aad109fac251e020b0251e adds only that supported root BOM override plus the regression test.

The trigger was inherited Trivy findings for Jackson Databind (CVE-2026-54515, CVE-2026-59889, GHSA-mhm7-754m-9p8w). Exact-head CI, Security Scan, SBOM, Dependency Review, and SAST all completed successfully on 7e86513a7f04adef85aad109fac251e020b0251e. The PR is ready for independent review; no security finding is suppressed and scanner severity is unchanged.

Do not close stale #160/#291 until their unique documentation/change-history work is proven preserved. Old checks/reviews do not transfer to this current-base replacement.

Summary by CodeRabbit

• 보안

  • Jackson 라이브러리 버전을 2.21.5로 표준화해 보안 기준을 강화했습니다.
  • 의존성 관리 순서를 명확히 해 일관된 라이브러리 버전이 적용되도록 했습니다.

• 테스트

  • Jackson 보안 기준과 의존성 설정을 자동으로 검증하는 테스트를 추가했습니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 9 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5662e972-85ca-4c05-bd4a-7309eab0de36

📥 Commits

Reviewing files that changed from the base of the PR and between 7e86513 and a222c29.

📒 Files selected for processing (1)

• etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java

📝 Walkthrough

Walkthrough

루트 Maven 설정에 Jackson BOM 2.21.5를 추가하고 Spring Boot BOM보다 먼저 적용했습니다. 프로젝트 루트를 탐색해 버전과 선언 순서를 검증하는 JUnit 테스트도 추가했습니다.

Changes

Jackson 보안 기준선

Layer / File(s)	Summary
Jackson BOM 오버라이드 설정 pom.xml	jackson-bom.version을 2.21.5로 설정하고 Jackson BOM import를 Spring Boot 의존성 관리보다 앞에 추가했습니다.
보안 기준선 자동 검증 etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java	프로젝트 루트를 탐색하고 루트 pom.xml에서 Jackson BOM 버전과 Spring Boot BOM 대비 선언 순서를 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• #196: Jackson 2.21.5 BOM 기준선 설정과 검증을 다루므로 직접 관련됩니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	[ #160 ] 루트 POM에 Jackson BOM 2.21.5를 Spring Boot BOM보다 먼저 추가하고 이를 검증하는 테스트를 포함했습니다.
Out of Scope Changes check	✅ Passed	변경 사항은 Jackson BOM 보안 기준선과 버전 및 import 순서 검증에 한정되어 범위를 벗어나지 않습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보안 수정과 Jackson 2.21 LTS BOM 정렬이라는 변경의 핵심을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/jackson-databind-2.21.5-609b290

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java`:
- Around line 13-16: Update the Javadoc for JacksonSecurityBaselineTest to
describe only Jackson Databind versions below the selected 2.21.5 patch baseline
as vulnerable, without implying that 2.21.5 itself remains vulnerable.
- Around line 21-41: Update
jacksonSecurityBomPrecedesImportedSpringBootDependencyManagement to parse the
root dependencyManagement.dependencies section of pom.xml instead of relying on
whole-file string searches. Structurally validate the Jackson BOM’s
com.fasterxml.jackson groupId, jackson-bom artifactId, ${jackson-bom.version}
version, pom type, and import scope, then verify that this dependency entry
precedes the Spring Boot BOM entry within the same dependency list.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e89d34e8-b7d1-413b-8919-3e8679bffaf5

📥 Commits

Reviewing files that changed from the base of the PR and between 609b290 and 7e86513.

📒 Files selected for processing (2)

• etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java
• pom.xml