utafrali commented on code in PR #8056:
URL: https://github.com/apache/geode/pull/8056#discussion_r3934606060
##########
geode-assembly/src/integrationTest/resources/assembly_content.txt:
##########
@@ -1005,10 +1005,10 @@ lib/httpclient-4.5.13.jar
lib/httpcore-4.4.15.jar
lib/istack-commons-runtime-4.0.1.jar
lib/jackson-annotations-2.21.jar
-lib/jackson-core-2.21.5.jar
-lib/jackson-databind-2.21.5.jar
-lib/jackson-datatype-joda-2.21.5.jar
-lib/jackson-datatype-jsr310-2.21.5.jar
+lib/jackson-core-2.21.6.jar
Review Comment:
The assembled distribution still ships `jackson-annotations-2.21.jar` while
every sibling Jackson jar is now at 2.21.6. This is a direct consequence of the
version constraint above. If this is intentional, no change is needed here, but
the reason should be documented in the PR description or as a comment in
`DependencyConstraints.groovy` so future maintainers understand the version
skew.
##########
boms/geode-all-bom/src/test/resources/expected-pom.xml:
##########
@@ -475,22 +475,22 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
- <version>2.21.5</version>
+ <version>2.21.6</version>
Review Comment:
The PR description contains no information about what CVE-2026-19032
actually affects (e.g., deserialization in `jackson-databind`, parsing in
`jackson-core`, etc.). Without that context, reviewers cannot confirm whether
this four-artifact version bump is complete or whether additional Jackson
modules (e.g., `jackson-dataformat-yaml`, which is also pinned via
`jackson.version`) are also in scope. Please add a brief description of the
vulnerability surface so the fix can be evaluated on its merits.
##########
build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy:
##########
@@ -44,9 +44,9 @@ class DependencyConstraints {
deps.put("shiro.version", "1.13.0")
deps.put("slf4j-api.version", "1.7.36")
deps.put("jboss-modules.version", "1.11.0.Final")
- deps.put("jackson.version", "2.21.5")
+ deps.put("jackson.version", "2.21.6")
deps.put("jackson.annotations.version", "2.21")
Review Comment:
`jackson.annotations.version` stays at `"2.21"` while `jackson.version` and
`jackson.databind.version` both move to `2.21.6`. The annotations module lives
in the same `com.fasterxml.jackson.core` group as the two modules being
patched. For a CVE remediation, it needs to be explicit whether CVE-2026-19032
does not affect `jackson-annotations` (in which case a comment here explains
why this key is intentionally left behind), or whether
`jackson-annotations-2.21.6` has not been released (in which case a follow-up
ticket should be created). As written, a reviewer cannot distinguish
intentional scoping from an oversight.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
