spuru9 opened a new pull request, #1171:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1171
## What is the purpose of the change
`jackson-bom` is pinned at 2.21.3, which is affected by 11 advisories — 10
against `jackson-databind`, one against `jackson-core`. Three are HIGH:
GHSA-j3rv-43j4-c7qm and GHSA-rmj7-2vxq-3g9f (`PolymorphicTypeValidator`
bypasses) and GHSA-r7wm-3cxj-wff9 (`maxNumberLength` bypass in the async
parser). 2.21.5 is the lowest version clearing all of them.
Two notes:
`jackson-annotations` resolves to 2.21, not 2.21.5 — `jackson-bom` pins it
through a separate property that stays at the minor. The NOTICE listed 2.21.3
for it, which was never a resolved version; corrected here.
This covers only the directly managed jackson. The relocated copies bundled
via Flink (`flink-shaded-jackson` 2.14.2, and `flink-kubernetes`'s 2.15.3 under
`org/apache/flink/kubernetes/shaded/`) are unaffected and come from separate
release trains.
## Brief change log
- `jackson-bom` 2.21.3 -> 2.21.5 in `pom.xml`
- Refreshed the five jackson entries in
`flink-kubernetes-operator/src/main/resources/META-INF/NOTICE`
## Verifying this change
Covered by existing tests; the full suite passes unchanged (2216 in
`flink-kubernetes-operator`, 105 in `flink-kubernetes-webhook`, plus the
remaining modules). OSV reports 0 advisories for all five artifacts at the
resolved versions.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): **yes** -
`jackson-bom`
- The public API, i.e., is any changes to the `CustomResourceDescriptors`:
no
- Core observer or reconciler logic that is regularly executed: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
