(parquet-java) branch master updated: Bump jackson.version from 2.22.2 to 2.22.3 (#3834)

[ga...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wgtmac pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/parquet-java.git


The following commit(s) were added to refs/heads/master by this push:
     new 63983b857 Bump jackson.version from 2.22.2 to 2.22.3 (#3834)
63983b857 is described below

commit 63983b857e44cfe183947d9093e8dad32771fb9c
Author: Manu Zhang <Ow...@gmail.com>
AuthorDate: Sun Oct 4 23:35:03 2026 +0800

    Bump jackson.version from 2.22.2 to 2.22.3 (#3834)
    
    Jackson 2.22.2, which parquet-jackson shades, is affected by
    CVE-2026-89407 and CVE-2026-89425 in jackson-core. Both are fixed in
    2.22.3.
    
    Generated-by: Claude Code
    
    Co-authored-by: Claude Opus 5.5 <no...@anthropic.com>
---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index ebb7fbd84..fd56279cb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -75,8 +75,8 @@
     <jackson.datatype.groupId>com.fasterxml.jackson.datatype</jackson.datatype.groupId>
     <jackson.package>com.fasterxml.jackson</jackson.package>
     <!-- To upgrade jackson, check the jdk versions inside the jar and include any new versions in the shading in parquet-jackson. -->
-    <jackson.version>2.22.2</jackson.version>
-    <jackson-databind.version>2.22.2</jackson-databind.version>
+    <jackson.version>2.22.3</jackson.version>
+    <jackson-databind.version>2.22.3</jackson-databind.version>
     <jackson-annotations.version>2.22</jackson-annotations.version>
     <japicmp.version>0.26.2</japicmp.version>
     <javax.annotation.version>1.3.2</javax.annotation.version>