You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "spuru9 (via GitHub)" <gi...@apache.org> on 2026/07/04 01:12:36 UTC

[PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

spuru9 opened a new pull request, #28637:
URL: https://github.com/apache/flink/pull/28637

   ## What is the purpose of the change
   
   jackson-databind 2.21.3 is affected by several recently published CVEs (CVE-2026-54512 through 54518). Bumping jackson-bom to 2.21.4 fixes all of them except CVE-2026-54515, which has no released fix in any jackson 2.x line yet (its announced fix versions 2.21.5/2.22.1 are unreleased, and 2.22.0 is also affected) — that one needs a follow-up once upstream ships.
   
   ## Brief change log
   
   - `jackson-bom.version` 2.21.3 → 2.21.4 in the root pom
   - Updated the NOTICE files of the 11 modules bundling non-shaded jackson (jackson-annotations stays at 2.21, matching the bom)
   
   ## Verifying this change
   
   This change is a dependency version bump without code changes. All affected bundling modules build cleanly, and the bundled jackson-databind version inside the shaded jars (flink-sql-avro, flink-kubernetes, flink-python, flink-s3-fs-hadoop) was verified to be 2.21.4.
   
   ## Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): (yes — jackson 2.21.3 → 2.21.4, patch release)
     - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: (no)
     - The serializers: (no)
     - The runtime per-record code paths (performance sensitive): (no)
     - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: (no)
     - The S3 file system connector: (no)
   
   ## Documentation
   
     - Does this pull request introduce a new feature? (no)
     - If yes, how is the feature documented? (not applicable)
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   - [X] Yes: Claude Code
   
   Generated-by: Claude Code (claude-fable-5)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "MartijnVisser (via GitHub)" <gi...@apache.org>.
MartijnVisser commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4904170652

   I think also we should first bump Jackson etc in flink-shaded before doing it inside of Flink itself


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "MartijnVisser (via GitHub)" <gi...@apache.org>.
MartijnVisser commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4904980499

   Ah good, let's then wait for a definitive fix and address everything in one go


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.5 [flink]

Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-5553963023

   flink-shaded released and updated 
   jackson is 2.22.2 there


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4880885659

   >jackson-databind 2.21.3 is affected by several recently published CVEs (54512 through 54518). Bumping jackson-bom to 2.21.4 fixes all of them except 54515, which has no released fix in any jackson 2.x line yet (its announced fix versions 2.21.5/2.22.1 are unreleased, and 2.22.0 is also affected) — that one needs a follow-up once upstream ships.
   
   existence of CVE in 3rd party doesn't necessary mean Flink is impacted
   
   if we bump dependency now it doesn't mean a new Flink release, which means nothing is changed for end user.
   
   So the question: why we should update now rather than wait for full fix from jackson and update?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "spuru9 (via GitHub)" <gi...@apache.org>.
spuru9 commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4880898709

   Ok will move to draft, and add this to the JIRA. Will open with the latest version close to the release.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.22.2 [flink]

Posted by "spuru9 (via GitHub)" <gi...@apache.org>.
spuru9 commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-5554111857

   Updated.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4904282641

   PR in shaded is present https://github.com/apache/flink-shaded/pull/160
   also waiting for fix from Jackson (unless we want to release shaded earlier)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.5 [flink]

Posted by "spuru9 (via GitHub)" <gi...@apache.org>.
spuru9 commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4911180514

   Confirmed: jackson-databind 2.21.5 is CVE-free with respect to the batch disclosed alongside 54512-54518. CVE-2026-54515 (GHSA-5jmj-h7xm-6q6v) lists the fixed range as \`< 2.21.5\` for the 2.x line, so this bump closes it out. Updated the PR to 2.21.5.
   
   Keeping this in draft until flink-shaded#160 (2.21.4 → will need to track 2.21.5 too) is released, per the earlier discussion — will reopen then.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "spuru9 (via GitHub)" <gi...@apache.org>.
spuru9 commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4910992887

   2.21.5 have been released. Will see if its CVE free. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.22.2 [flink]

Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin merged PR #28637:
URL: https://github.com/apache/flink/pull/28637


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4880135284

   <!--
   Meta data
   {
     "version" : 1,
     "metaDataEntries" : [ {
       "hash" : "67faa8c6c6983701dcb8fa10f7eea0975617e276",
       "status" : "UNKNOWN",
       "url" : "TBD",
       "triggerID" : "67faa8c6c6983701dcb8fa10f7eea0975617e276",
       "triggerType" : "PUSH"
     } ]
   }-->
   ## CI report:
   
   * 67faa8c6c6983701dcb8fa10f7eea0975617e276 UNKNOWN
   
   <details>
   <summary>Bot commands</summary>
     The @flinkbot bot supports the following commands:
   
    - `@flinkbot run azure` re-run the last Azure build
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.4 [flink]

Posted by "spuru9 (via GitHub)" <gi...@apache.org>.
spuru9 commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-4904288166

   > I think also we should first bump Jackson etc in flink-shaded before doing it inside of Flink itself
   
   That was also a reason I created the PR, the shaded is already having a PR to move to 2.21.4. https://github.com/apache/flink-shaded/pull/160/changes


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40071][build] Bump jackson-bom to 2.21.5 [flink]

Posted by "spuru9 (via GitHub)" <gi...@apache.org>.
spuru9 commented on PR #28637:
URL: https://github.com/apache/flink/pull/28637#issuecomment-5554008226

   > flink-shaded released and updated jackson is 2.22.2 there
   
   Thanks
   Updating the JIRA and PR


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org