Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package jackson-modules-java8 for
openSUSE:Factory checked in at 2026-09-24 22:56:27
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/jackson-modules-java8 (Old)
and /work/SRC/openSUSE:Factory/.jackson-modules-java8.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "jackson-modules-java8"
Thu Sep 24 22:56:27 2026 rev:9 rq:1380011 version:2.18.11
Changes:
--------
---
/work/SRC/openSUSE:Factory/jackson-modules-java8/jackson-modules-java8.changes
2026-07-15 17:12:45.629915691 +0200
+++
/work/SRC/openSUSE:Factory/.jackson-modules-java8.new.383539/jackson-modules-java8.changes
2026-09-24 22:58:37.979172544 +0200
@@ -1,0 +2,13 @@
+Wed Sep 23 08:24:53 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Update to 2.18.11
+ * No changes, only syncing the whole stack for databind security
+ issues
+
+-------------------------------------------------------------------
+Thu Sep 17 08:20:01 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Update to 2.18.10
+ * #387: Validate length of input in InstantDeserializer
+
+-------------------------------------------------------------------
Old:
----
jackson-modules-java8-2.18.9.tar.gz
New:
----
jackson-modules-java8-2.18.11.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ jackson-modules-java8.spec ++++++
--- /var/tmp/diff_new_pack.Z99UV5/_old 2026-09-24 22:58:38.582197761 +0200
+++ /var/tmp/diff_new_pack.Z99UV5/_new 2026-09-24 22:58:38.584197844 +0200
@@ -17,7 +17,7 @@
Name: jackson-modules-java8
-Version: 2.18.9
+Version: 2.18.11
Release: 0
Summary: Set of support modules for Java 8 datatypes
License: Apache-2.0
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.Z99UV5/_old 2026-09-24 22:58:38.614199099 +0200
+++ /var/tmp/diff_new_pack.Z99UV5/_new 2026-09-24 22:58:38.617199224 +0200
@@ -1,6 +1,6 @@
-mtime: 1784117065
-commit: 532d56513660a4eec9903fd979b6126f8a7835dc9f4a58495cf660e00f508812
+mtime: 1790151946
+commit: 6b66cdae72da81fa98c1805a4dd5a4e7972168454f7bf044f141c738b2fccc2a
url: https://src.opensuse.org/java-packages/jackson-modules-java8
-revision: 532d56513660a4eec9903fd979b6126f8a7835dc9f4a58495cf660e00f508812
+revision: 6b66cdae72da81fa98c1805a4dd5a4e7972168454f7bf044f141c738b2fccc2a
projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-09-23 10:25:46.000000000 +0200
@@ -0,0 +1 @@
+.osc
++++++ jackson-modules-java8-2.18.9.tar.gz ->
jackson-modules-java8-2.18.11.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datatypes/pom.xml
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datatypes/pom.xml
--- old/jackson-modules-java8-jackson-modules-java8-2.18.9/datatypes/pom.xml
2026-07-08 02:38:36.000000000 +0200
+++ new/jackson-modules-java8-jackson-modules-java8-2.18.11/datatypes/pom.xml
2026-09-21 02:50:22.000000000 +0200
@@ -9,7 +9,7 @@
<parent>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-modules-java8</artifactId>
- <version>2.18.9</version>
+ <version>2.18.11</version>
</parent>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jdk8</artifactId>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/pom.xml
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/pom.xml
--- old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/pom.xml
2026-07-08 02:38:36.000000000 +0200
+++ new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/pom.xml
2026-09-21 02:50:22.000000000 +0200
@@ -9,7 +9,7 @@
<parent>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-modules-java8</artifactId>
- <version>2.18.9</version>
+ <version>2.18.11</version>
</parent>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jsr310</artifactId>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserializer.java
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserializer.java
---
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserializer.java
2026-07-08 02:38:36.000000000 +0200
+++
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserializer.java
2026-09-21 02:50:22.000000000 +0200
@@ -424,9 +424,11 @@
if (dots >= 0) { // negative if not simple number
try {
if (dots == 0) {
+ _validateTimestampLength(p, string, false);
return _fromLong(ctxt, NumberInput.parseLong(string));
}
if (dots == 1) {
+ _validateTimestampLength(p, string, true);
return _fromDecimal(ctxt,
NumberInput.parseBigDecimal(string, false));
}
} catch (NumberFormatException e) {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/JSR310DeserializerBase.java
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/JSR310DeserializerBase.java
---
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/JSR310DeserializerBase.java
2026-07-08 02:38:36.000000000 +0200
+++
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/deser/JSR310DeserializerBase.java
2026-09-21 02:50:22.000000000 +0200
@@ -22,6 +22,8 @@
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.core.StreamReadConstraints;
+import com.fasterxml.jackson.core.exc.StreamConstraintsException;
import com.fasterxml.jackson.core.io.NumberInput;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.JsonDeserializer;
@@ -238,4 +240,27 @@
}
return e;
}
+
+ /**
+ * Helper method to validate length of a stringified numeric Date/Time
value
+ * against {@link StreamReadConstraints} limits.
+ *
+ * @param p Parser to get constraints from
+ * @param value Stringified numeric value to validate
+ * @param isFP Whether {@code value} is a floating-point (has decimal
point)
+ * or integer number; caller knows this already so we avoid re-scanning
+ *
+ * @since 2.18.10
+ */
+ protected void _validateTimestampLength(JsonParser p, String value,
boolean isFP)
+ throws StreamConstraintsException
+ {
+ final int len = value.length();
+ StreamReadConstraints constraints = p.streamReadConstraints();
+ if (isFP) {
+ constraints.validateFPLength(len);
+ } else {
+ constraints.validateIntegerLength(len);
+ }
+ }
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/ModuleTestBase.java
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/ModuleTestBase.java
---
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/ModuleTestBase.java
2026-07-08 02:38:36.000000000 +0200
+++
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/ModuleTestBase.java
2026-09-21 02:50:22.000000000 +0200
@@ -66,6 +66,14 @@
throw new Error("Expected an exception with one of substrings
("+Arrays.asList(matches)+"): got one with message \""+msg+"\"");
}
+ protected static String repeat(String s, int count) {
+ StringBuilder sb = new StringBuilder(s.length() * count);
+ for (int i = 0; i < count; i++) {
+ sb.append(s);
+ }
+ return sb.toString();
+ }
+
protected static <T> Map<T, String> asMap(T key, String value) {
return Collections.singletonMap(key, value);
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserTest.java
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserTest.java
---
old/jackson-modules-java8-jackson-modules-java8-2.18.9/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserTest.java
2026-07-08 02:38:36.000000000 +0200
+++
new/jackson-modules-java8-jackson-modules-java8-2.18.11/datetime/src/test/java/com/fasterxml/jackson/datatype/jsr310/deser/InstantDeserTest.java
2026-09-21 02:50:22.000000000 +0200
@@ -9,6 +9,8 @@
import org.junit.Test;
+import com.fasterxml.jackson.core.StreamReadConstraints;
+import com.fasterxml.jackson.core.exc.StreamConstraintsException;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.exc.MismatchedInputException;
@@ -640,4 +642,40 @@
assertTrue("Matcher finds +0100 as an colonless offset",
matcher.find());
assertEquals("Matcher groups +0100 as an colonless offset",
matcher.group(), "+0100");
}
+
+ // [modules-java8#387]: StreamReadConstraints should limit numeric string
lengths
+ // parsed via _fromString to prevent excessive BigDecimal construction.
+ // NOTE: values MUST be quoted -- unquoted ones are Number tokens, limits
for
+ // which are enforced by the streaming parser and not by this deserializer.
+ @Test
+ public void testNumericStringRespectsStreamReadConstraints() throws
Exception
+ {
+ final int MAX_ALLOWED_LEN = StreamReadConstraints.DEFAULT_MAX_NUM_LEN;
+
+ // Normal epoch seconds as integer should work
+ assertNotNull(MAPPER.readValue(q("1234567890"), Instant.class));
+
+ // Normal epoch seconds with decimal should work
+ assertNotNull(MAPPER.readValue(q("1234567890.123456789"),
Instant.class));
+
+ // A very long integer string (exceeding default 1000-digit limit)
should fail
+ String longInt = repeat("1", MAX_ALLOWED_LEN + 1);
+ try {
+ MAPPER.readValue(q(longInt), Instant.class);
+ fail("Should not pass with excessively long integer string");
+ } catch (StreamConstraintsException e) {
+ verifyException(e, "Number value length");
+ verifyException(e, "exceeds the maximum allowed");
+ }
+
+ // A very long decimal string (exceeding default 1000-char limit)
should fail
+ String longDecimal = "1234." + repeat("9", MAX_ALLOWED_LEN);
+ try {
+ MAPPER.readValue(q(longDecimal), Instant.class);
+ fail("Should not pass with excessively long decimal string");
+ } catch (StreamConstraintsException e) {
+ verifyException(e, "Number value length");
+ verifyException(e, "exceeds the maximum allowed");
+ }
+ }
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/parameter-names/pom.xml
new/jackson-modules-java8-jackson-modules-java8-2.18.11/parameter-names/pom.xml
---
old/jackson-modules-java8-jackson-modules-java8-2.18.9/parameter-names/pom.xml
2026-07-08 02:38:36.000000000 +0200
+++
new/jackson-modules-java8-jackson-modules-java8-2.18.11/parameter-names/pom.xml
2026-09-21 02:50:22.000000000 +0200
@@ -9,7 +9,7 @@
<parent>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-modules-java8</artifactId>
- <version>2.18.9</version>
+ <version>2.18.11</version>
</parent>
<artifactId>jackson-module-parameter-names</artifactId>
<name>Jackson-module-parameter-names</name>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/pom.xml
new/jackson-modules-java8-jackson-modules-java8-2.18.11/pom.xml
--- old/jackson-modules-java8-jackson-modules-java8-2.18.9/pom.xml
2026-07-08 02:38:36.000000000 +0200
+++ new/jackson-modules-java8-jackson-modules-java8-2.18.11/pom.xml
2026-09-21 02:50:22.000000000 +0200
@@ -3,12 +3,12 @@
<parent>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-base</artifactId>
- <version>2.18.9</version>
+ <version>2.18.11</version>
</parent>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-modules-java8</artifactId>
<name>Jackson modules: Java 8</name>
- <version>2.18.9</version>
+ <version>2.18.11</version>
<packaging>pom</packaging>
<description>Parent pom for Jackson modules needed to support Java 8
features and types
</description>
@@ -24,7 +24,7 @@
<connection>scm:git:[email protected]:FasterXML/jackson-modules-java8.git</connection>
<developerConnection>scm:git:[email protected]:FasterXML/jackson-modules-java8.git</developerConnection>
<url>http://github.com/FasterXML/jackson-modules-java8</url>
- <tag>jackson-modules-java8-2.18.9</tag>
+ <tag>jackson-modules-java8-2.18.11</tag>
</scm>
<issueManagement>
<url>https://github.com/FasterXML/jackson-modules-java8/issues</url>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/jackson-modules-java8-jackson-modules-java8-2.18.9/release-notes/VERSION-2.x
new/jackson-modules-java8-jackson-modules-java8-2.18.11/release-notes/VERSION-2.x
---
old/jackson-modules-java8-jackson-modules-java8-2.18.9/release-notes/VERSION-2.x
2026-07-08 02:38:36.000000000 +0200
+++
new/jackson-modules-java8-jackson-modules-java8-2.18.11/release-notes/VERSION-2.x
2026-09-21 02:50:22.000000000 +0200
@@ -8,6 +8,15 @@
=== Releases ===
------------------------------------------------------------------------
+2.18.11 (20-Sep-2026)
+
+No changes since 2.18.10
+
+2.18.10 (15-Aug-2026)
+
+#387: Validate length of input in `InstantDeserializer`
+ (fix by @pjfanning)
+
2.18.9 (07-Jul-2026)
2.18.8 (28-May-2026)
2.18.7 (24-Apr-2026)
