From 84e81492c6a1c1d0a20bf1c28d2f0b3f631ea3c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9Clrathod=E2=80=9D?= Date: Fri, 4 Sep 2026 15:21:00 +0530 Subject: [PATCH 1/2] Bump jackson-databind 2.18.8 -> 2.18.9 (CVE-2026-54515) Fixes GHSA-5jmj-h7xm-6q6v: per-property @JsonIgnoreProperties exclusions were silently discarded when combined with per-property @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), making ignored properties writable again (mass-assignment risk, CWE-915). jackson-core and jackson-annotations align to 2.18.9 via the BOM. Co-authored-by: Cursor --- gradle/libs.versions.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index b05b32a0..42501caa 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -5,7 +5,7 @@ org-mockito = "5.8.0" org-testcontainers = "1.17.6" [libraries] -com-fasterxml-jackson-core-jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version = "2.18.8" } +com-fasterxml-jackson-core-jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version = "2.18.9" } com-github-java-json-tools-json-patch = { module = "com.github.java-json-tools:json-patch", version = "1.13" } com-google-guava = { module = "com.google.guava:guava", version = "32.0.1-jre" } com-typesafe-config = { module = "com.typesafe:config", version = "1.4.2" } From 360c7f2ce9eb7d8954d4bed331f63a45ba7eccd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9Clrathod=E2=80=9D?= Date: Fri, 4 Sep 2026 16:33:38 +0530 Subject: [PATCH 2/2] Trigger CI re-run (previous dependency-check failed on NVD API 524 flake) Co-authored-by: Cursor