You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by pv...@apache.org on 2026/10/01 02:41:21 UTC

(iceberg) branch main updated: Build: Bump jackson versions (#18333)

This is an automated email from the ASF dual-hosted git repository.

pvary pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg.git


The following commit(s) were added to refs/heads/main by this push:
     new f12ec1b5c6 Build: Bump jackson versions (#18333)
f12ec1b5c6 is described below

commit f12ec1b5c6f1c88a941b0ebd3a9064fb45264efa
Author: Yuya Ebihara <eb...@gmail.com>
AuthorDate: Thu Oct 1 11:41:14 2026 +0900

    Build: Bump jackson versions (#18333)
---
 .github/trivyignore/kafka-connect-runtime.trivyignore | 5 +++++
 gradle/libs.versions.toml                             | 6 +++---
 kafka-connect/build.gradle                            | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/trivyignore/kafka-connect-runtime.trivyignore b/.github/trivyignore/kafka-connect-runtime.trivyignore
index d828216790..994f3c31e2 100644
--- a/.github/trivyignore/kafka-connect-runtime.trivyignore
+++ b/.github/trivyignore/kafka-connect-runtime.trivyignore
@@ -35,3 +35,8 @@ GHSA-r7wm-3cxj-wff9
 # jackson >= 2.18.10 / 2.21.6 / 2.22.2. Resolved once Apache Parquet is
 # bumped to 1.18.1 (apache/iceberg#17321).
 CVE-2026-68497
+# jackson-databind CVEs shaded into parquet-jackson 1.17.1, only fixed in
+# jackson >= 2.18.11 / 2.21.7 / 2.22.3. Resolved once Apache Parquet is
+# bumped to 1.18.1 (apache/iceberg#17321).
+CVE-2026-91776
+CVE-2026-91777
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 9bc52aea15..c3a2b59d74 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -59,9 +59,9 @@ httpcomponents-httpclient5 = "5.6.4"
 hive2 = { strictly = "2.3.10"} # see rich version usage explanation above
 immutables-value = "2.12.2"
 jackson-annotations = "2.22"
-jackson-bom = "2.22.2"
-jackson218 = { strictly = "2.18.10"}
-jackson221 = { strictly = "2.21.6"}
+jackson-bom = "2.22.3"
+jackson218 = { strictly = "2.18.11"}
+jackson221 = { strictly = "2.21.7"}
 jakarta-el-api = "3.0.3"
 jakarta-servlet-api = "6.1.0"
 jaxb-api = "2.3.1"
diff --git a/kafka-connect/build.gradle b/kafka-connect/build.gradle
index 4f2205c8ce..d61b32f6c0 100644
--- a/kafka-connect/build.gradle
+++ b/kafka-connect/build.gradle
@@ -82,7 +82,7 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
         force 'com.fasterxml.woodstox:woodstox-core:6.7.0'
         force 'commons-beanutils:commons-beanutils:1.11.0'
         force 'io.grpc:grpc-netty-shaded:1.84.0'
-        force 'com.fasterxml.jackson.core:jackson-databind:2.22.2'
+        force 'com.fasterxml.jackson.core:jackson-databind:2.22.3'
       }
     }
   }