You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "Yicong-Huang (via GitHub)" <gi...@apache.org> on 2026/07/05 09:31:28 UTC
[PR] chore(deps): upgrade to jackson 2.18.8 (#6152) [release/v1.2 backport] [texera]
Yicong-Huang opened a new pull request, #6160:
URL: https://github.com/apache/texera/pull/6160
### What changes were proposed in this PR?
Backport of #6152 to `release/v1.2`: bump Jackson 2.18.6 → 2.18.8 (`jacksonVersion` in the root `build.sbt`), update the jar entries in each service's `LICENSE-binary`, and regenerate the `NOTICE-binary` files for the updated `META-INF` NOTICE content shipped in the 2.18.8 jars.
Motivation is security: seven jackson-databind CVEs disclosed on 2026-06-22 (CVE-2026-54512 … 54518) are all fixed in 2.18.8, including two PolymorphicTypeValidator allowlist bypasses that allow arbitrary class instantiation when polymorphic deserialization is enabled ([CVE-2026-54512](https://github.com/advisories/GHSA-j3rv-43j4-c7qm), [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513)). See #6152 for details.
Differences from the mainline PR: the `notebook-migration-service/` changes are dropped — that module does not exist on `release/v1.2` (this is why the label-driven backport check on #6152 could not pass).
### Any related issues, documentation, discussions?
Backport of #6152.
### How was this PR tested?
Existing test cases via the label-gated CI stacks; dependency bump only, no code change. The binary licensing check verifies LICENSE-binary/NOTICE-binary against the built distributables.
### Was this PR authored or co-authored using generative AI tooling?
The original dependency bump was authored by @pjfanning (no AI declaration). The cherry-pick, NOTICE-binary regeneration, and this description were prepared with generative AI tooling: Generated-by: Claude Code (Claude Fable 5).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps, 1.2): upgrade to jackson 2.18.8 [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #6160:
URL: https://github.com/apache/texera/pull/6160#issuecomment-4885552969
## [Codecov](https://app.codecov.io/gh/apache/texera/pull/6160?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 53.60%. Comparing base ([`a4dc934`](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`bef6d1c`](https://app.codecov.io/gh/apache/texera/commit/bef6d1ca506bac77003b9f074a8fc8987ea64ef7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## release/v1.2 #6160 +/- ##
===============================================
Coverage 53.60% 53.60%
Complexity 1440 1440
===============================================
Files 797 797
Lines 33193 33193
Branches 3324 3324
===============================================
Hits 17794 17794
Misses 14534 14534
Partials 865 865
```
| [Flag](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | | *Carryforward flag |
|---|---|---|---|
| [access-control-service](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `64.61% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [agent-service](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `34.36% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [amber](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `59.50% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [computing-unit-managing-service](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `1.65% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [config-service](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.06% <ø> (ø)` | | |
| [file-service](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `58.59% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [frontend](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `46.31% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [pyamber](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.72% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [python](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.75% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [workflow-compiling-service](https://app.codecov.io/gh/apache/texera/pull/6160/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `58.69% <ø> (ø)` | | Carriedforward from [a4dc934](https://app.codecov.io/gh/apache/texera/commit/a4dc934186a950f5ceb61ca9946741e83db771e9?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
*This pull request uses carry forward flags. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/texera/pull/6160?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): upgrade to jackson 2.18.8 (#6152) [release/v1.2 backport] [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #6160:
URL: https://github.com/apache/texera/pull/6160#issuecomment-4885547323
<!-- texera-reviewer-suggestion -->
### Automated Reviewer Suggestions
Based on the `git blame` history of the changed files, we recommend the following reviewers:
- **Committers with relevant context:** `@pjfanning`
You can request their reviews formally with `/request-review @pjfanning`.
- **Contributors with relevant context:** `@bobbai00`, `@Ma77Ball`, `@xuang7`
You can notify them by mentioning `@bobbai00`, `@Ma77Ball`, `@xuang7` in a comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps, 1.2): upgrade to jackson 2.18.8 [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang merged PR #6160:
URL: https://github.com/apache/texera/pull/6160
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org