From 69efc2099e36d27dac6404f784917046f1c9a179 Mon Sep 17 00:00:00 2001 From: andrew Date: Tue, 17 Mar 2026 13:28:01 -0700 Subject: [PATCH] [Java] Upgrade jackson-databind 2.16.1 -> 2.18.6 to fix GHSA-72hv-8253-57qq Addresses security advisory GHSA-72hv-8253-57qq (HIGH severity), where the async JSON parser in jackson-core bypasses the maxNumberLength constraint, allowing DoS via arbitrarily long numbers. Upgrading jackson-databind to 2.18.6 pulls in the fixed jackson-core 2.18.6 transitively. Closes #61645 Topic: upgrade-jackson Labels: draft Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: andrew --- java/dependencies.bzl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/dependencies.bzl b/java/dependencies.bzl index df7c0814df81..84dd9c8f27e4 100644 --- a/java/dependencies.bzl +++ b/java/dependencies.bzl @@ -4,7 +4,7 @@ load("@rules_jvm_external//:specs.bzl", "maven") def gen_java_deps(): maven_install( artifacts = [ - "com.fasterxml.jackson.core:jackson-databind:2.16.1", + "com.fasterxml.jackson.core:jackson-databind:2.18.6", "com.github.java-json-tools:json-schema-validator:2.2.14", "com.google.code.gson:gson:2.9.1", "com.google.guava:guava:32.0.1-jre",