Conversation
jackson-databind reached this build transitively on the 2.14 line, inside the affected range of GHSA-j3rv-43j4-c7qm. play-json has no release above 3.0.6, so there is no upstream version that carries a fixed databind and the coordinates are named here. Declared rather than dependencyOverrides: an override is resolution-local and writes nothing into the published POM, so consumers would keep resolving 2.14.3 through the transitive edge. The whole family is declared, not databind alone -- the datatype/dataformat/module artifacts are not dragged forward by a databind bump and would be left on 2.14.3. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mbryzek
marked this pull request as ready for review
August 26, 2026 03:33
…ert it The Jackson family pin that remediates this advisory is already on main: 2.22.2 is above every range GHSA-j3rv-43j4-c7qm names, so the resolved classpath here is not vulnerable and no version changes in this commit. What the pin does not carry is the reason it may not move down. The floor comment states 2.15.0, the jackson-core nesting-depth floor, which leaves 2.15.0-2.18.7 reading as available -- and that whole span is inside this advisory's range, so a later sweep trimming the pin to the documented floor reintroduces it. The comment now states both floors and which one binds. JacksonPinSpec asserts the other two halves of the pin because they fail silently. This one fails more quietly still: a type id carrying generics is validated by the substring before the `<`, and the type arguments parsed out of the rest are resolved and instantiated without being offered to the PolymorphicTypeValidator at all -- so an allow-list reports that it is in force while admitting anything smuggled into an allowed container's parameter position. The third assertion allows exactly one container and offers a denied type as its generic argument. It was checked against the floor rather than assumed: at 2.18.7 the denied type is instantiated and nothing is thrown, and at 2.22.2 the deserialization is refused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mbryzek
changed the title
Owner
Author
|
Autonomously merging. Details: https://admin.plybk.us/admin/autonomy/decisions/adc-1041c683301d49dfa04412eda4313f29 |
mbryzek
added a commit
that referenced
this pull request
Aug 26, 2026
…er guard ISS-6229 reached lib-cipher's main (#31) and edits the same two places this branch does: build.sbt's floor paragraph and JacksonPinSpec. Both assertions are kept -- main's PolymorphicTypeValidator case stays third as merged, this branch's chunked-number case becomes fourth. The scaladoc and the build.sbt paragraph are rewritten rather than concatenated: the two advisories share one affected range (<2.18.8 || 2.19.0-2.21.3), and main's text calls its own "the quietest of the three", a count that a fourth case falsifies. No pinned version changes -- build.sbt's diff against main is comment-only. Byte-identical to the resolution already on lib-util's and lib-ai's i6233, modulo the package name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediates GHSA-j3rv-43j4-c7qm (CVE-2026-54512) for this repository.
What this is
This branch was opened before ISS-6227 landed, and ISS-6227 pinned the same Jackson family
to the same 2.22.2 in all four libraries for a sibling advisory. The two branches collided;
this PR was returned to the queue as
conflicts.Resolved in favour of
main. The version this issue asks for is already there — 2.22.2is above every range GHSA-j3rv-43j4-c7qm names (
<2.18.8,2.19.0–2.21.3), so theresolved classpath is not vulnerable and no version changes here. What is left is the
part of the remediation ISS-6227 had no reason to carry.
What the diff does
1. States the floor this advisory sets. The pin's comment recorded one floor — 2.15.0,
where jackson-core gained its nesting-depth limit (GHSA-h46c-h94j-95f3). This advisory rules
out the whole
2.15.0–2.18.7span that leaves reading as available. A later sweep trimmingthe pin to the documented floor would land inside this advisory and read as correct while
doing it. The comment now states both floors and which one binds.
2. Asserts it.
JacksonPinSpecexists because the other two halves of this pin failsilently; this one fails more quietly still. A type id carrying generics is validated by the
substring before the
<, and the type arguments parsed out of the rest are resolved andinstantiated without ever being offered to the
PolymorphicTypeValidator— so an allow-listreports that it is in force while admitting anything smuggled into an allowed container's
parameter position. Nothing throws and nothing is logged. The new assertion allows exactly
one container and offers a denied type as its generic argument.
Verification
The assertion was checked against the floor rather than assumed — a test that passes on both
sides of a fix is not a regression test:
2.18.7HashMapinstantiated, nothing thrown2.22.2A first attempt at this assertion passed at
2.18.7too; it was modelling the bypass wronglyand was rewritten against the advisory's own proof-of-concept rather than kept.
Full suite green.
ci/build.shclean at push.Decisions & assumptions
dependencyOverrides; did not re-litigate it. This branch originally declared thecoordinates compile-scope, arguing an override writes no floor into the published POM.
maintook the opposite view explicitly, in reviewed prose in the same file: it governsthis build only and imposes nothing on consumers, who state their own. That is true —
platform and acumen both pin 2.22.2 — and a library forcing a transitive floor on every
consumer is the heavier contract. A merge-conflict resolution is the wrong place to reverse
a decision that landed three commits earlier.
is guarding against.
2.14.3→2.22.2bump this issue dispositioned is already onmainin every one ofthe four repositories.