You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "dongjoon-hyun (via GitHub)" <gi...@apache.org> on 2026/09/28 17:40:57 UTC
[PR] [SPARK-59833] Upgrade Jackson to 2.22.3 [spark-kubernetes-operator]
dongjoon-hyun opened a new pull request, #900:
URL: https://github.com/apache/spark-kubernetes-operator/pull/900
### What changes were proposed in this pull request?
This PR aims to upgrade `Jackson` to 2.22.3.
`jackson-annotations` stays at 2.22 because it has no 2.22.3 release (2.22 is the version paired with 2.22.3 by `jackson-bom`).
`jackson-module-scala_2.13` is upgraded to 2.22.3, the version paired by `jackson-bom` 2.22.3, instead of 2.22.3.1. The only change of 2.22.3.1 ([#899](https://github.com/FasterXML/jackson-module-scala/issues/899)) fixes a 2.22.3 regression in the deserialization of a Scala `object` with a `JsonTypeInfo.As.PROPERTY` type id, which is irrelevant to this project.
`gradle/verification-metadata.xml` was regenerated from scratch.
### Why are the changes needed?
To bring the latest bug fixes and security fixes.
- [Jackson 2.22.3](https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.22.3) (2026-09-21, [jackson-databind-2.22.3](https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3))
- [CVE-2026-89407](https://github.com/FasterXML/jackson-core/issues/1649): Optimize `NumberInput.looksLikeValidNumber`
- [CVE-2026-89425](https://github.com/FasterXML/jackson-core/pull/1698): Honor `maxErrorTokenLength` in `UTF8DataInputJsonParser`
- [CVE-2026-91776](https://github.com/FasterXML/jackson-databind/pull/6203): Prevent unbounded growth of type id cache in `TypeDeserializer`
- [CVE-2026-91777](https://github.com/FasterXML/jackson-databind/pull/6204): Avoid quadratic forward-reference resolution in Collection/Map deserializers
- `WriterBasedJsonGenerator` throws `ArrayIndexOutOfBoundsException` when a zero-length custom escape ends exactly at the output buffer boundary ([#1668](https://github.com/FasterXML/jackson-core/issues/1668))
- `UTF32Reader` corrupts or drops the low surrogate when a supplementary character splits across a `read()` boundary ([#1713](https://github.com/FasterXML/jackson-core/issues/1713))
- Unresolved IPv6 `InetSocketAddress` serialized without brackets, losing port on round-trip ([#6185](https://github.com/FasterXML/jackson-databind/issues/6185))
- Avoid quadratic forward-reference resolution in `ObjectArrayDeserializer` ([#6205](https://github.com/FasterXML/jackson-databind/pull/6205))
- Support `StreamReadConstraints.maxDocumentLength()` in YAML parser ([#737](https://github.com/FasterXML/jackson-dataformats-text/pull/737))
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 5.5
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-59833] Upgrade Jackson to 2.22.3 [spark-kubernetes-operator]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #900:
URL: https://github.com/apache/spark-kubernetes-operator/pull/900#issuecomment-5875490863
Thank you, @peter-toth !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-59833] Upgrade Jackson to 2.22.3 [spark-kubernetes-operator]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #900:
URL: https://github.com/apache/spark-kubernetes-operator/pull/900#issuecomment-5875719073
Merged to main
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-59833] Upgrade Jackson to 2.22.3 [spark-kubernetes-operator]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun closed pull request #900: [SPARK-59833] Upgrade Jackson to 2.22.3
URL: https://github.com/apache/spark-kubernetes-operator/pull/900
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org