You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@casbin.apache.org by "EmryZhang (via GitHub)" <gi...@apache.org> on 2026/09/13 05:50:23 UTC
[PR] chore(deps): update Jackson databind to 2.18.9 [casbin-jcasbin]
EmryZhang opened a new pull request, #531:
URL: https://github.com/apache/casbin-jcasbin/pull/531
The merged 1.100.0 preparation still declares `jackson-databind` 2.18.1, which is in the affected ranges of public FasterXML advisories. This changes only that dependency to the same-series patched version 2.18.9.
References: [FasterXML 2.18.9 release notes](https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.18.9), [GHSA-5jmj-h7xm-6q6v](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v), and [GHSA-vvgp-rfg2-7rr6](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6). This dependency update does not establish that those advisory-specific conditions are reachable through JCasbin.
Validation on top of `8424ca10b2a549ccefeb9d426b2f57f093e89bb6`: Temurin 8u504 and Maven 3.9.16 `clean verify -Dgpg.skip=true` passed all 266 tests, with zero failures, errors or skipped tests. The test JVM classpath contains Jackson Databind 2.18.9. Library, source and Javadoc JARs retain matching LICENSE, NOTICE and DISCLAIMER files. The build retains the existing Javadoc warning about an unknown author tag.
Draft for release-scope review: the earlier equivalent Dependabot PR #527 was closed without merging. Please decide whether to include this update before selecting the 1.100.0 RC commit. If merged, the final merged commit and source archives need fresh release verification.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org
Re: [PR] build: complete JCasbin 1.100.0 release preparation [casbin-jcasbin]
Posted by "hsluoyz (via GitHub)" <gi...@apache.org>.
hsluoyz merged PR #531:
URL: https://github.com/apache/casbin-jcasbin/pull/531
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org