[jira] [Created] (FLINK-40341) flink-kubernetes-operator: Bump jackson-bom to 2.21.5 to retire 11 advisories

["Purushottam Sinha (Jira)" <ji...@apache.org>]

Purushottam Sinha created FLINK-40341:
-----------------------------------------

             Summary: flink-kubernetes-operator: Bump jackson-bom to 2.21.5 to retire 11 advisories
                 Key: FLINK-40341
                 URL: https://issues.apache.org/jira/browse/FLINK-40341
             Project: Flink
          Issue Type: Bug
          Components: Kubernetes Operator
            Reporter: Purushottam Sinha


Problem
jackson-bom is pinned at 2.21.3, which is affected by 11 published advisories — 10 against jackson-databind and 1 against jackson-core. Three are rated HIGH. Both artifacts are bundled in the operator's shaded JAR.

Evidence
- pom.xml:126 pins com.fasterxml.jackson:jackson-bom at 2.21.3.
- flink-kubernetes-operator/src/main/resources/META-INF/NOTICE lists jackson-databind, jackson-core and jackson-annotations 2.21.3 as bundled.
- HIGH advisories: GHSA-j3rv-43j4-c7qm (PolymorphicTypeValidator bypass via generic type parameters), GHSA-rmj7-2vxq-3g9f (array subtype allowlist bypass in BasicPolymorphicTypeValidator), GHSA-r7wm-3cxj-wff9 (maxNumberLength bypass in the async parser).

Proposed fix
- Bump jackson-bom to 2.21.5, the lowest version clearing all 11 (several require 2.21.5 rather than 2.21.4).
- Refresh the jackson versions in the affected META-INF/NOTICE files.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)