You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by ch...@apache.org on 2026/04/21 13:05:56 UTC
(spark) branch branch-4.1 updated: [SPARK-56318][BUILD][4.1] Upgrade jackson to 2.21.2
This is an automated email from the ASF dual-hosted git repository.
pan3793 pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new b0bd64e5a940 [SPARK-56318][BUILD][4.1] Upgrade jackson to 2.21.2
b0bd64e5a940 is described below
commit b0bd64e5a94070936706d3990edeef07105d042b
Author: Manu Zhang <Ow...@gmail.com>
AuthorDate: Tue Apr 21 21:05:43 2026 +0800
[SPARK-56318][BUILD][4.1] Upgrade jackson to 2.21.2
### What changes were proposed in this pull request?
Fixes vulnerability GHSA-72hv-8253-57qq
### Why are the changes needed?
jackson-core 2.20.0 is affected.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Existing tests.
### Was this patch authored or co-authored using generative AI tooling?
No.
Closes #55135 from manuzhang/upgrade-jackson-spark4.1.
Authored-by: Manu Zhang <Ow...@gmail.com>
Signed-off-by: Cheng Pan <ch...@apache.org>
---
common/utils/pom.xml | 6 ++++++
core/pom.xml | 6 ++++++
dev/deps/spark-deps-hadoop-3-hive-2.3 | 16 ++++++++--------
pom.xml | 2 +-
project/SparkBuild.scala | 2 +-
5 files changed, 22 insertions(+), 10 deletions(-)
diff --git a/common/utils/pom.xml b/common/utils/pom.xml
index 45f640a40678..8ee7f454ba27 100644
--- a/common/utils/pom.xml
+++ b/common/utils/pom.xml
@@ -62,6 +62,12 @@
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-scala_${scala.binary.version}</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>org.scala-lang</groupId>
+ <artifactId>scala-library</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.ivy</groupId>
diff --git a/core/pom.xml b/core/pom.xml
index 55cd208f7077..6401476f7f26 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -351,6 +351,12 @@
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-scala_${scala.binary.version}</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>org.scala-lang</groupId>
+ <artifactId>scala-library</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.derby</groupId>
diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
index bc5b93ea6faa..57032c2428e6 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -100,13 +100,13 @@ icu4j/77.1//icu4j-77.1.jar
ini4j/0.5.4//ini4j-0.5.4.jar
istack-commons-runtime/4.1.2//istack-commons-runtime-4.1.2.jar
ivy/2.5.3//ivy-2.5.3.jar
-jackson-annotations/2.20//jackson-annotations-2.20.jar
-jackson-core/2.20.0//jackson-core-2.20.0.jar
-jackson-databind/2.20.0//jackson-databind-2.20.0.jar
-jackson-dataformat-cbor/2.20.0//jackson-dataformat-cbor-2.20.0.jar
-jackson-dataformat-yaml/2.20.0//jackson-dataformat-yaml-2.20.0.jar
-jackson-datatype-jsr310/2.20.0//jackson-datatype-jsr310-2.20.0.jar
-jackson-module-scala_2.13/2.20.0//jackson-module-scala_2.13-2.20.0.jar
+jackson-annotations/2.21//jackson-annotations-2.21.jar
+jackson-core/2.21.2//jackson-core-2.21.2.jar
+jackson-databind/2.21.2//jackson-databind-2.21.2.jar
+jackson-dataformat-cbor/2.21.2//jackson-dataformat-cbor-2.21.2.jar
+jackson-dataformat-yaml/2.21.2//jackson-dataformat-yaml-2.21.2.jar
+jackson-datatype-jsr310/2.21.2//jackson-datatype-jsr310-2.21.2.jar
+jackson-module-scala_2.13/2.21.2//jackson-module-scala_2.13-2.21.2.jar
jakarta.activation-api/2.1.3//jakarta.activation-api-2.1.3.jar
jakarta.annotation-api/2.1.1//jakarta.annotation-api-2.1.1.jar
jakarta.inject-api/2.0.1//jakarta.inject-api-2.0.1.jar
@@ -268,7 +268,7 @@ scala-reflect/2.13.17//scala-reflect-2.13.17.jar
scala-xml_2.13/2.4.0//scala-xml_2.13-2.4.0.jar
slf4j-api/2.0.17//slf4j-api-2.0.17.jar
snakeyaml-engine/2.10//snakeyaml-engine-2.10.jar
-snakeyaml/2.4//snakeyaml-2.4.jar
+snakeyaml/2.5//snakeyaml-2.5.jar
snappy-java/1.1.10.8//snappy-java-1.1.10.8.jar
spire-macros_2.13/0.18.0//spire-macros_2.13-0.18.0.jar
spire-platform_2.13/0.18.0//spire-platform_2.13-0.18.0.jar
diff --git a/pom.xml b/pom.xml
index 6263100d56b7..21933508422b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -184,7 +184,7 @@
<scalafmt.validateOnly>true</scalafmt.validateOnly>
<scalafmt.changedOnly>true</scalafmt.changedOnly>
<!-- Should be consistent with SparkBuild.scala and docs -->
- <fasterxml.jackson.version>2.20.0</fasterxml.jackson.version>
+ <fasterxml.jackson.version>2.21.2</fasterxml.jackson.version>
<ws.xmlschema.version>2.3.1</ws.xmlschema.version>
<snappy.version>1.1.10.8</snappy.version>
<netlib.ludovic.dev.version>3.0.4</netlib.ludovic.dev.version>
diff --git a/project/SparkBuild.scala b/project/SparkBuild.scala
index bb505d390e5e..01aa71047feb 100644
--- a/project/SparkBuild.scala
+++ b/project/SparkBuild.scala
@@ -1185,7 +1185,7 @@ object KubernetesIntegrationTests {
* Overrides to work around sbt's dependency resolution being different from Maven's.
*/
object DependencyOverrides {
- lazy val jacksonVersion = sys.props.get("fasterxml.jackson.version").getOrElse("2.20.0")
+ lazy val jacksonVersion = sys.props.get("fasterxml.jackson.version").getOrElse("2.21.2")
lazy val jacksonDeps = Bom.dependencies("com.fasterxml.jackson" % "jackson-bom" % jacksonVersion)
lazy val settings = jacksonDeps ++ Seq(
dependencyOverrides ++= {
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org