manuzhang opened a new pull request, #3846: URL: https://github.com/apache/parquet-java/pull/3846
### Rationale for this change Backport #3834 to `parquet-1.18.x` to address the shaded jackson-core CVEs described in the original PR (CVE-2026-89407 and CVE-2026-89425). ### What changes are included in this PR? Clean cherry-pick of 63983b857e44cfe183947d9093e8dad32771fb9c. Bump `jackson.version` and `jackson-databind.version` from 2.22.2 to 2.22.3. The release branch already includes the required multi-release shading relocations. ### Are these changes tested? - `./mvnw -B -pl parquet-jackson -am verify` passed on Java 21, including RAT and Spotless checks. This module has no unit tests. - Inspected the built shaded jar: embedded jackson-core and jackson-databind are both 2.22.3, and all Jackson multi-release classes are relocated. - A smoke check using the shaded `JsonFactory` and `ObjectMapper` confirmed both runtime versions and successful JSON parsing. - `git diff --check` passed. ### Are there any user-facing changes? The shaded Jackson dependencies are upgraded to 2.22.3; no Parquet API changes. Backport prepared with Codex. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
