This is an automated email from the ASF dual-hosted git repository.
rmetzger pushed a commit to branch release-20.0
in repository https://gitbox.apache.org/repos/asf/flink-shaded.git
The following commit(s) were added to refs/heads/release-20.0 by this push:
new 73a7ba0 [FLINK-39570] Bump Jackson to 2.18.10 (release-20.0) (#166)
73a7ba0 is described below
commit 73a7ba08f9aaebb6b86526a46da1371cc8075bf0
Author: Purushottam Sinha <[email protected]>
AuthorDate: Thu Aug 20 01:12:46 2026 +0530
[FLINK-39570] Bump Jackson to 2.18.10 (release-20.0) (#166)
* [FLINK-39570] Bump Jackson to 2.18.10 (release-20.0)
Bump jackson.version from 2.18.2 to 2.18.10 to pick up fixes for a
series of jackson-databind/jackson-core CVEs and GHSA advisories
(Confluent CF-4067, CF-4063, CF-4060, CF-4057, CF-3897, CF-3892,
CF-3887, CF-3882), and update every bundled-dependency NOTICE and
module version coordinate to match the newly bundled Jackson version.
Jackson is bundled (relocated) by flink-shaded-jackson-2 and
flink-shaded-jackson-module-jsonSchema-2, and partially bundled by
flink-shaded-swagger (jackson-dataformat-yaml, jackson-datatype-jsr310)
via the shared com.fasterxml.jackson:jackson-bom import in
dependencyManagement. Because flink-shaded bundles (relocates)
Jackson, consumers of these shaded artifacts can only pick up the
fixes via a rebuild from a bumped source branch.
All three NOTICE files are updated so the upstream license check
(NoticeFileChecker) stays green. flink-shaded-jackson-parent's own
<version> coordinate (and the matching <parent><version> in its
flink-shaded-jackson-2, flink-shaded-jackson-module-jsonSchema-2, and
flink-shaded-jsonpath children) is hardcoded as
<jackson.version>-<flink-shaded-revision> by convention, so it is
bumped from 2.18.2-20.0 to 2.18.10-20.0 alongside the property.
* Bump actions/setup-java from v2 to v5 in CI workflow
actions/setup-java@v2 bundles an old @actions/cache client that
fails against GitHub's cache-service backend with
"Cache service responded with 400", breaking CI on release-20.0
before any build step runs. master already moved past this on its
own workflow; this brings release-20.0's Java 8 build workflow in
line, keeping java-version: 8 unchanged.
Generated-by: Claude Code (claude-sonnet-5)
---
.github/workflows/ci.yml | 2 +-
.../flink-shaded-jackson-2/pom.xml | 2 +-
.../src/main/resources/META-INF/NOTICE | 16 ++++++++--------
.../flink-shaded-jackson-module-jsonSchema-2/pom.xml | 2 +-
.../src/main/resources/META-INF/NOTICE | 8 ++++----
.../flink-shaded-jsonpath/pom.xml | 2 +-
flink-shaded-jackson-parent/pom.xml | 2 +-
flink-shaded-swagger/src/main/resources/META-INF/NOTICE | 4 ++--
pom.xml | 2 +-
9 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 53c71a2..7677606 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
- uses: actions/checkout@v2
- name: Set JDK
- uses: actions/setup-java@v2
+ uses: actions/setup-java@v5
with:
java-version: 8
distribution: 'temurin'
diff --git a/flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml
b/flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml
index a54b6b6..651410d 100644
--- a/flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml
+++ b/flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml
@@ -25,7 +25,7 @@ under the License.
<parent>
<groupId>org.apache.flink</groupId>
<artifactId>flink-shaded-jackson-parent</artifactId>
- <version>2.18.2-20.0</version>
+ <version>2.18.10-20.0</version>
</parent>
<artifactId>flink-shaded-jackson${flink.ci.license.suffix}</artifactId>
diff --git
a/flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE
b/flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE
index 68ed0a4..e91d2ed 100644
---
a/flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE
+++
b/flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE
@@ -6,12 +6,12 @@ The Apache Software Foundation (http://www.apache.org/).
This project bundles the following dependencies under the Apache Software
License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
-- com.fasterxml.jackson.core:jackson-annotations:2.18.2
-- com.fasterxml.jackson.core:jackson-core:2.18.2
-- com.fasterxml.jackson.core:jackson-databind:2.18.2
-- com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.18.2
-- com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.18.2
-- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2
-- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.2
-- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2
+- com.fasterxml.jackson.core:jackson-annotations:2.18.10
+- com.fasterxml.jackson.core:jackson-core:2.18.10
+- com.fasterxml.jackson.core:jackson-databind:2.18.10
+- com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.18.10
+- com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.18.10
+- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.10
+- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.10
+- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.10
- org.yaml:snakeyaml:2.3
diff --git
a/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml
b/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml
index 6d5499c..25f6cdb 100644
---
a/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml
+++
b/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml
@@ -25,7 +25,7 @@ under the License.
<parent>
<groupId>org.apache.flink</groupId>
<artifactId>flink-shaded-jackson-parent</artifactId>
- <version>2.18.2-20.0</version>
+ <version>2.18.10-20.0</version>
</parent>
<artifactId>flink-shaded-jackson-module-jsonSchema${flink.ci.license.suffix}</artifactId>
diff --git
a/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE
b/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE
index a17b786..1c388ac 100644
---
a/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE
+++
b/flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE
@@ -6,8 +6,8 @@ The Apache Software Foundation (http://www.apache.org/).
This project bundles the following dependencies under the Apache Software
License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
-- com.fasterxml.jackson.core:jackson-annotations:2.18.2
-- com.fasterxml.jackson.core:jackson-core:2.18.2
-- com.fasterxml.jackson.core:jackson-databind:2.18.2
-- com.fasterxml.jackson.module:jackson-module-jsonSchema:2.18.2
+- com.fasterxml.jackson.core:jackson-annotations:2.18.10
+- com.fasterxml.jackson.core:jackson-core:2.18.10
+- com.fasterxml.jackson.core:jackson-databind:2.18.10
+- com.fasterxml.jackson.module:jackson-module-jsonSchema:2.18.10
- javax.validation:validation-api:1.1.0.Final
\ No newline at end of file
diff --git a/flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml
b/flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml
index 749cb4c..9b84ba8 100644
--- a/flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml
+++ b/flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml
@@ -25,7 +25,7 @@ under the License.
<parent>
<groupId>org.apache.flink</groupId>
<artifactId>flink-shaded-jackson-parent</artifactId>
- <version>2.18.2-20.0</version>
+ <version>2.18.10-20.0</version>
</parent>
<artifactId>flink-shaded-jsonpath</artifactId>
diff --git a/flink-shaded-jackson-parent/pom.xml
b/flink-shaded-jackson-parent/pom.xml
index cdcd131..a920bf6 100644
--- a/flink-shaded-jackson-parent/pom.xml
+++ b/flink-shaded-jackson-parent/pom.xml
@@ -31,7 +31,7 @@ under the License.
<artifactId>flink-shaded-jackson-parent</artifactId>
<name>flink-shaded-jackson-parent</name>
<packaging>pom</packaging>
- <version>2.18.2-20.0</version>
+ <version>2.18.10-20.0</version>
<modules>
<module>flink-shaded-jackson-2</module>
diff --git a/flink-shaded-swagger/src/main/resources/META-INF/NOTICE
b/flink-shaded-swagger/src/main/resources/META-INF/NOTICE
index 09fa396..2cc0f8e 100644
--- a/flink-shaded-swagger/src/main/resources/META-INF/NOTICE
+++ b/flink-shaded-swagger/src/main/resources/META-INF/NOTICE
@@ -6,8 +6,8 @@ The Apache Software Foundation (http://www.apache.org/).
This project bundles the following dependencies under the Apache Software
License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
-- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2
-- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2
+- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.10
+- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.10
- io.swagger.core.v3:swagger-annotations:2.2.19
- io.swagger.core.v3:swagger-core:2.2.19
- io.swagger.core.v3:swagger-models:2.2.19
diff --git a/pom.xml b/pom.xml
index 3a9e296..fbfbbe0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -63,7 +63,7 @@ under the License.
<properties>
<shading.prefix>org.apache.flink.shaded</shading.prefix>
<netty.version>4.1.100.Final</netty.version>
- <jackson.version>2.18.2</jackson.version>
+ <jackson.version>2.18.10</jackson.version>
<jsonpath.version>2.9.0</jsonpath.version>
<guava.version>33.4.0-jre</guava.version>
<!-- The license check requires the artifactId to match the directory
that the module resides in.
