[FLINK-39570] Bump Jackson to 2.18.10 (release-20.0) - #166
Merged
Conversation
Bump jackson.version from 2.18.2 to 2.18.10 to pick up fixes for a series of jackson-databind/jackson-core CVEs and GHSA advisories (Confluent CF-4067, CF-4063, CF-4060, CF-4057, CF-3897, CF-3892, CF-3887, CF-3882), and update every bundled-dependency NOTICE and module version coordinate to match the newly bundled Jackson version. Jackson is bundled (relocated) by flink-shaded-jackson-2 and flink-shaded-jackson-module-jsonSchema-2, and partially bundled by flink-shaded-swagger (jackson-dataformat-yaml, jackson-datatype-jsr310) via the shared com.fasterxml.jackson:jackson-bom import in dependencyManagement. Because flink-shaded bundles (relocates) Jackson, consumers of these shaded artifacts can only pick up the fixes via a rebuild from a bumped source branch. All three NOTICE files are updated so the upstream license check (NoticeFileChecker) stays green. flink-shaded-jackson-parent's own <version> coordinate (and the matching <parent><version> in its flink-shaded-jackson-2, flink-shaded-jackson-module-jsonSchema-2, and flink-shaded-jsonpath children) is hardcoded as <jackson.version>-<flink-shaded-revision> by convention, so it is bumped from 2.18.2-20.0 to 2.18.10-20.0 alongside the property.
Contributor
|
Please see #165 (comment) |
Contributor
|
ok if you want to maintain/release it |
snuyanzin
approved these changes
Aug 19, 2026
actions/setup-java@v2 bundles an old @actions/cache client that fails against GitHub's cache-service backend with "Cache service responded with 400", breaking CI on release-20.0 before any build step runs. master already moved past this on its own workflow; this brings release-20.0's Java 8 build workflow in line, keeping java-version: 8 unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump the bundled Jackson on the
release-20.0line from2.18.2to2.18.10, and update the affectedNOTICEfiles and hardcoded module version coordinates to match.Why
2.18.10is the current2.18.xmaintenance release and carries fixes for a series ofjackson-databind/jackson-coreCVEs and GHSA advisories reported against2.18.2:2.18.10clears every one of these2.18.xfix thresholds. Becauseflink-shadedbundles (relocates) Jackson, consumers offlink-shaded-jackson/flink-shaded-jackson-module-jsonSchema/flink-shaded-swaggercan only pick up these fixes via a rebuild of the shaded artifacts from a bumped source branch — the bundled copy is invisible to downstreamdependencyManagement.Changes
pom.xml—jackson.version2.18.2→2.18.10.flink-shaded-jackson-parent/pom.xml— hardcoded<version>2.18.2-20.0</version>→2.18.10-20.0(this module's version coordinate is<jackson.version>-<flink-shaded-revision>by convention, not a resolvable property).flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml,flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml,flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml— matching<parent><version>bump to2.18.10-20.0.flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE— 8 bundledcom.fasterxml.jackson.*version lines →2.18.10.flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE— 4 bundledcom.fasterxml.jackson.*version lines →2.18.10.flink-shaded-swagger/src/main/resources/META-INF/NOTICE— the 2 bundledcom.fasterxml.jackson.*lines →2.18.10. This module importscom.fasterxml.jackson:jackson-bom:${jackson.version}independencyManagement, so the bump changes the Jackson it bundles too..github/workflows/ci.yml—actions/setup-javav2→v5(java-version: 8unchanged).v2's bundled Maven-cache client fails against GitHub's current cache-service backend withCache service responded with 400, breaking CI onrelease-20.0before any build step runs;master's workflow already moved pastv2independently of this change.Verification
Built with Java 21 / Maven 3.9.4 (
mvn clean install -DskipTests -Plicense-checkequivalent reactor, against Maven Central):BUILD SUCCESSacross all 16 modules.flink-shaded-jackson-2-2.18.10-20.0.jarbundles Jackson2.18.10, keeps theorg.apache.flink.shaded.jackson2.com.fasterxml.jacksonrelocation, and shows no un-relocatedcom/fasterxml/jacksonleakage.license-checkprofile (NoticeFileChecker) passes with the updated NOTICE files.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (claude-sonnet-5)