From 45aecdba07a1ec79531e1a8b4fd20b369d23bf97 Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Thu, 23 Jul 2026 22:15:00 +0200 Subject: [PATCH] fix(deps): bump jackson-bom 2.21.4 -> 2.21.5 for @JsonView bypass CVEs Dependabot's security update for jackson-databind was failing with `security_update_dependency_not_found`: jackson-databind is a transitive-only dependency (via jackson-module-kotlin / the Spring Boot 3.5.16 BOM), so the direct-only security update could not patch it. 2.21.5 has now shipped to Maven Central and is the first patched version for both open alerts: - GHSA-mhm7-754m-9p8w (@JsonView bypass, EXTERNAL_PROPERTY creators) - GHSA-5gvw-p9qm-jgwh / CVE-2026-59889 (@JsonView bypass, @JsonUnwrapped) Override the BOM-managed `jackson-bom.version` so the whole Jackson family moves to 2.21.5 together, and regenerate the dependency lockfile. This remediates both CVEs and clears the recurring Dependabot failure. Co-Authored-By: Claude Opus 4.8 --- backend/build.gradle.kts | 9 +++++++-- backend/gradle.lockfile | 18 +++++++++--------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/backend/build.gradle.kts b/backend/build.gradle.kts index d4e7a9b..ddcf102 100644 --- a/backend/build.gradle.kts +++ b/backend/build.gradle.kts @@ -60,9 +60,14 @@ dependencies { // Security override of a Spring Boot 3.5.16 BOM-managed transitive version. // commons-lang3 3.17.0 -> 3.18.0 fixes CVE-2025-48924 (BOM pins 3.17.0 even though swagger-core wants 3.20.0). -// NOTE: jackson-databind CVE-2026-54515 (2.21.4) has no installable fix yet — 2.21.5/2.22.1 are unreleased, -// 2.18.9 is a downgrade, 3.1.4 is a major jump. Let the Spring Boot BOM carry 2.21.5 once it ships. extra["commons-lang3.version"] = "3.18.0" +// jackson-bom 2.21.4 -> 2.21.5 fixes @JsonView bypass CVEs on jackson-databind +// (GHSA-mhm7-754m-9p8w and GHSA-5gvw-p9qm-jgwh / CVE-2026-59889, both medium; Dependabot #80/#81). +// 2.21.5 shipped to Maven Central; Spring Boot 3.5.16 BOM still pins 2.21.4. Override the shared +// jackson-bom property so the whole Jackson family (databind, core, module-kotlin, ...) moves together. +// jackson-databind is transitive-only here, so Dependabot's direct-only security update could not patch +// it (security_update_dependency_not_found) — this BOM override is the fix. +extra["jackson-bom.version"] = "2.21.5" // logback-core 1.5.34 -> 1.5.35 fixes CVE (object injection via HardenedObjectInputStream, Dependabot #79). // Spring Boot 3.5.16 BOM pins 1.5.34; override the shared property so logback-core AND logback-classic move together. extra["logback.version"] = "1.5.35" diff --git a/backend/gradle.lockfile b/backend/gradle.lockfile index aa7f49e..92ea768 100644 --- a/backend/gradle.lockfile +++ b/backend/gradle.lockfile @@ -5,15 +5,15 @@ ch.qos.logback:logback-classic:1.5.35=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath ch.qos.logback:logback-core:1.5.35=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.core:jackson-core:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.core:jackson-databind:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.module:jackson-module-kotlin:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.module:jackson-module-parameter-names:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson:jackson-bom:2.21.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-core:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.module:jackson-module-parameter-names:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson:jackson-bom:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.fasterxml:classmate:1.7.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.github.docker-java:docker-java-api:3.4.2=testCompileClasspath,testRuntimeClasspath com.github.docker-java:docker-java-transport-zerodep:3.4.2=testCompileClasspath,testRuntimeClasspath