You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by pv...@apache.org on 2026/09/30 08:51:28 UTC

(iceberg) branch main updated: Build: Bump jackson versions (#18318)

This is an automated email from the ASF dual-hosted git repository.

pvary pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg.git


The following commit(s) were added to refs/heads/main by this push:
     new 505c34e54d Build: Bump jackson versions (#18318)
505c34e54d is described below

commit 505c34e54d71f113027127b69a9c530537052d4b
Author: Yuya Ebihara <eb...@gmail.com>
AuthorDate: Wed Sep 30 17:51:20 2026 +0900

    Build: Bump jackson versions (#18318)
---
 .github/trivyignore/kafka-connect-runtime.trivyignore | 4 ++++
 gradle/libs.versions.toml                             | 4 ++--
 kafka-connect/build.gradle                            | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/trivyignore/kafka-connect-runtime.trivyignore b/.github/trivyignore/kafka-connect-runtime.trivyignore
index 84bfcc2ffb..d828216790 100644
--- a/.github/trivyignore/kafka-connect-runtime.trivyignore
+++ b/.github/trivyignore/kafka-connect-runtime.trivyignore
@@ -31,3 +31,7 @@ CVE-2026-54513
 # jackson-core CVE shaded into parquet-jackson, only fixed in jackson
 # >= 2.18.8 / 2.21.4 / 2.22.1.
 GHSA-r7wm-3cxj-wff9
+# jackson-databind CVE shaded into parquet-jackson 1.17.1, only fixed in
+# jackson >= 2.18.10 / 2.21.6 / 2.22.2. Resolved once Apache Parquet is
+# bumped to 1.18.1 (apache/iceberg#17321).
+CVE-2026-68497
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 4fa6fbf991..e4c6c22f03 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -61,8 +61,8 @@ hive2 = { strictly = "2.3.10"} # see rich version usage explanation above
 immutables-value = "2.12.2"
 jackson-annotations = "2.22"
 jackson-bom = "2.22.2"
-jackson218 = { strictly = "2.18.8"}
-jackson221 = { strictly = "2.21.4"}
+jackson218 = { strictly = "2.18.10"}
+jackson221 = { strictly = "2.21.6"}
 jakarta-el-api = "3.0.3"
 jakarta-servlet-api = "6.1.0"
 jaxb-api = "2.3.1"
diff --git a/kafka-connect/build.gradle b/kafka-connect/build.gradle
index 090ddb549e..4f2205c8ce 100644
--- a/kafka-connect/build.gradle
+++ b/kafka-connect/build.gradle
@@ -82,6 +82,7 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
         force 'com.fasterxml.woodstox:woodstox-core:6.7.0'
         force 'commons-beanutils:commons-beanutils:1.11.0'
         force 'io.grpc:grpc-netty-shaded:1.84.0'
+        force 'com.fasterxml.jackson.core:jackson-databind:2.22.2'
       }
     }
   }