Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package jackson-databind for
openSUSE:Factory checked in at 2026-09-24 22:56:22
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/jackson-databind (Old)
and /work/SRC/openSUSE:Factory/.jackson-databind.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "jackson-databind"
Thu Sep 24 22:56:22 2026 rev:23 rq:1380003 version:2.18.11
Changes:
--------
--- /work/SRC/openSUSE:Factory/jackson-databind/jackson-databind.changes
2026-07-15 22:20:24.053019978 +0200
+++
/work/SRC/openSUSE:Factory/.jackson-databind.new.383539/jackson-databind.changes
2026-09-24 22:58:22.088508049 +0200
@@ -1,0 +2,28 @@
+Wed Sep 23 07:46:37 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Update to 2.18.11
+ * #6185: Bracket unresolved IPv6 host name in InetSocketAddress
+ serialization
+ * #6203: Prevent unbounded growth of type id cache in
+ TypeDeserializer (bsc#1282491, CVE-2026-91776)
+ * #6204: Avoid quadratic forward-reference resolution in
+ Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
+
+-------------------------------------------------------------------
+Thu Sep 17 08:19:45 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Update to 2.18.10
+ * #6099: Resolve classes without initialization in
+ TypeFactory.findClass()
+ * #6116: Reject non-ASCII digits in InetAddress literal validation
+ * #6127: Add StreamReadConstraints number len constraint to
+ javax.xml.datatype.XMLGregorianCalendar and
+ javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
+ * #6129: Limit the supported URL schemes for java.nio.file.Path
+ deserialization (bsc#1277883, CVE-2026-19032)
+ * #6156: Add java.lang.Comparable in set of unsafe polymorphic
+ base types (bsc#1278008, CVE-2026-83557)
+ * #6165: Apply number length limits to BigDecimal/BigInteger/
+ /Double/Float Map keys
+
+-------------------------------------------------------------------
Old:
----
jackson-databind-2.18.9.tar.gz
New:
----
jackson-databind-2.18.11.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ jackson-databind.spec ++++++
--- /var/tmp/diff_new_pack.lrcliZ/_old 2026-09-24 22:58:22.716534311 +0200
+++ /var/tmp/diff_new_pack.lrcliZ/_new 2026-09-24 22:58:22.718534394 +0200
@@ -20,7 +20,7 @@
# binaries are java 8 compatible
%define __requires_exclude java-headless
Name: jackson-databind
-Version: 2.18.9
+Version: 2.18.11
Release: 0
Summary: General data-binding package for Jackson (2.x)
License: Apache-2.0
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.lrcliZ/_old 2026-09-24 22:58:22.751535774 +0200
+++ /var/tmp/diff_new_pack.lrcliZ/_new 2026-09-24 22:58:22.753535858 +0200
@@ -1,6 +1,6 @@
-mtime: 1784127773
-commit: e931f4c785c63fac51df502217800a68feb732cf13b7fd6c35573fd55feb287a
+mtime: 1790181515
+commit: c8fbd862f9fc02b43a95e4e2b1af65c2c6051b3eed5aaceb4f74631ca01b6ac7
url: https://src.opensuse.org/java-packages/jackson-databind
-revision: e931f4c785c63fac51df502217800a68feb732cf13b7fd6c35573fd55feb287a
+revision: c8fbd862f9fc02b43a95e4e2b1af65c2c6051b3eed5aaceb4f74631ca01b6ac7
projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-09-23 18:38:35.000000000 +0200
@@ -0,0 +1 @@
+.osc
++++++ jackson-databind-2.18.9.tar.gz -> jackson-databind-2.18.11.tar.gz ++++++
++++ 2304 lines of diff (skipped)
++++++ jackson-databind-build.xml ++++++
--- /var/tmp/diff_new_pack.lrcliZ/_old 2026-09-24 22:58:23.384562246 +0200
+++ /var/tmp/diff_new_pack.lrcliZ/_new 2026-09-24 22:58:23.393562622 +0200
@@ -11,7 +11,7 @@
<property name="project.groupId" value="com.fasterxml.jackson.core"/>
<property name="project.artifactId" value="jackson-databind"/>
<property name="project.name" value="jackson-databind"/>
- <property name="project.version" value="2.18.9"/>
+ <property name="project.version" value="2.18.11"/>
<property name="project.vendor" value="FasterXML"/>
<property name="project.description" value="General data-binding
functionality for Jackson: works on core streaming API"/>
<property name="bundle.version" value="${project.version}"/>
