You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kafka.apache.org by ch...@apache.org on 2026/10/09 04:57:53 UTC
(kafka) branch 4.3 updated: KAFKA-21157 Bump Jackson version to 2.22.3 (#23748)
This is an automated email from the ASF dual-hosted git repository.
chia7712 pushed a commit to branch 4.3
in repository https://gitbox.apache.org/repos/asf/kafka.git
The following commit(s) were added to refs/heads/4.3 by this push:
new fa713a98450 KAFKA-21157 Bump Jackson version to 2.22.3 (#23748)
fa713a98450 is described below
commit fa713a984509ebc7cc120832e7f776088fc8a5f1
Author: Ken Huang <s7...@gmail.com>
AuthorDate: Fri Oct 9 12:57:45 2026 +0800
KAFKA-21157 Bump Jackson version to 2.22.3 (#23748)
Bump Jackson version to 2.22.3 for 4.3
Fix CVE:
- [CVE-2026-89407 — OpenCVE](https://app.opencve.io/cve/CVE-2026-89407)
- [CVE-2026-89425 — OpenCVE](https://app.opencve.io/cve/CVE-2026-89425)
- [CVE-2026-91776 — Strix](https://www.strix.ai/cve/CVE-2026-91776)
- [CVE-2026-91777 — Strix](https://www.strix.ai/cve/CVE-2026-91777)
Reviewers: Chia-Ping Tsai <ch...@gmail.com>
---
LICENSE-binary | 20 ++++++++++----------
gradle/dependencies.gradle | 4 ++--
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/LICENSE-binary b/LICENSE-binary
index 152adba158b..a54e6974794 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -212,16 +212,16 @@ License Version 2.0:
- commons-logging-1.3.5
- commons-validator-1.10.1
- hash4j-0.22.0
-- jackson-annotations-2.21
-- jackson-core-2.21.6
-- jackson-databind-2.21.6
-- jackson-dataformat-csv-2.21.6
-- jackson-dataformat-yaml-2.21.6
-- jackson-datatype-jdk8-2.21.6
-- jackson-jakarta-rs-base-2.21.6
-- jackson-jakarta-rs-json-provider-2.21.6
-- jackson-module-blackbird-2.21.6
-- jackson-module-jakarta-xmlbind-annotations-2.21.6
+- jackson-annotations-2.22
+- jackson-core-2.22.3
+- jackson-databind-2.22.3
+- jackson-dataformat-csv-2.22.3
+- jackson-dataformat-yaml-2.22.3
+- jackson-datatype-jdk8-2.22.3
+- jackson-jakarta-rs-base-2.22.3
+- jackson-jakarta-rs-json-provider-2.22.3
+- jackson-module-blackbird-2.22.3
+- jackson-module-jakarta-xmlbind-annotations-2.22.3
- jakarta.inject-api-2.0.1
- jakarta.validation-api-3.0.2
- javassist-3.30.2-GA
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index 16170dc6dd9..e6199245e15 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -62,8 +62,8 @@ versions += [
gradle: "9.2.1",
grgit: "5.3.3",
httpclient: "4.5.14",
- jackson: "2.21.6",
- jacksonAnnotations: "2.21",
+ jackson: "2.22.3",
+ jacksonAnnotations: "2.22",
jacoco: "0.8.14",
javassist: "3.30.2-GA",
// When upgrading Jetty, verify that it does not use the SLF4J 2.x fluent API