(grails-core) 02/02: Bump jackson3

[jd...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jdaugherty pushed a commit to branch 8.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git

commit b5e583a6bf8fbfed6aa40fc9fc20c922273060d7
Author: James Daugherty <jd...@jdresources.net>
AuthorDate: Thu Jul 9 18:32:21 2026 -0400

    Bump jackson3
---
 dependencies.gradle                                            | 6 ++++++
 grails-test-examples/spring-dependency-management/build.gradle | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/dependencies.gradle b/dependencies.gradle
index 7725dddfc0..72bd87a6b3 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -89,6 +89,8 @@ ext {
             'httpcore5.version'             : '5.4.3',
             // Security: overrides the transitive com.fasterxml Jackson 2.x. 2.21.5 fixes CVE-2026-54515 flagged against 2.21.4.
             'jackson2.version'              : '2.21.5',
+            // Security: overrides spring-boot-dependencies (3.1.4). 3.1.5 fixes CVE-2026-59889 (JsonView bypass) flagged against jackson-databind.
+            'jackson3.version'              : '3.1.5',
             'jquery.version'                : '3.7.1',
             'kotlin.version'                : '2.2.21',
             'liquibase-hibernate5.version'  : '4.27.0',
@@ -176,6 +178,10 @@ ext {
             // jackson-annotations is out of lockstep (no 2.21.5 release) and stays transitively managed.
             'jackson2-core'               : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson2.version']}",
             'jackson2-databind'           : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson2.version']}",
+            // Security override of spring-boot-dependencies - see jackson3.version. databind 3.1.5 pins
+            // jackson-core 3.1.5 via its parent pom, so the BOM must manage core in lockstep (rule 14).
+            'jackson3-core'               : "tools.jackson.core:jackson-core:${bomDependencyVersions['jackson3.version']}",
+            'jackson3-databind'           : "tools.jackson.core:jackson-databind:${bomDependencyVersions['jackson3.version']}",
             'jquery'                   : "org.webjars.npm:jquery:${bomDependencyVersions['jquery.version']}",
             // Security override of spring-boot-dependencies - see logback.version
             'logback-classic'            : "ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}",
diff --git a/grails-test-examples/spring-dependency-management/build.gradle b/grails-test-examples/spring-dependency-management/build.gradle
index 98c3a840d2..be0ec5acbb 100644
--- a/grails-test-examples/spring-dependency-management/build.gradle
+++ b/grails-test-examples/spring-dependency-management/build.gradle
@@ -65,6 +65,8 @@ dependencyManagement {
 // sourcing the number from dependencies.gradle so it stays the single source of truth.
 apply from: rootProject.layout.projectDirectory.file('dependencies.gradle')
 ext['logback.version'] = bomDependencyVersions['logback.version']
+// Same situation for the Jackson 3 security override (CVE-2026-59889) - see jackson3.version in dependencies.gradle.
+ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version']
 
 dependencies {
     implementation 'org.apache.grails:grails-dependencies-starter-web'