From 91b20e384486b50d82d3232c117b7374925391b1 Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 12:46:01 +1000
Subject: [PATCH 1/3] [Security] Upgrade jackson to 2.21.4

Resolves HIGH-severity jackson-databind vulnerabilities flagged by the Trivy scan:
CVE-2026-54512 (arbitrary code execution), CVE-2026-54513 (security bypass).
Bumps the direct jackson-databind dependency 2.14.2 -> 2.21.4 and imports
jackson-bom 2.21.4 in dependencyManagement so all jackson modules align.

UID2-7569 UID2-7570

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 pom.xml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f9cdd9b2..1afc4b26 100644
--- a/pom.xml
+++ b/pom.xml
@@ -64,10 +64,19 @@
         <!-- check micrometer.version vertx-micrometer-metrics consumes before bumping up -->
         <micrometer.version>1.12.2</micrometer.version>
         <netty.version>4.1.135.Final</netty.version>
+        <jackson.version>2.21.4</jackson.version>
         <image.version>${project.version}</image.version>
     </properties>
     <dependencyManagement>
         <dependencies>
+            <!-- Force jackson to a fixed version to resolve CVE-2026-54512, CVE-2026-54513 (UID2-7569, UID2-7570). -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>
@@ -209,7 +218,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.14.2</version>
+            <version>${jackson.version}</version>
         </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>

From 91083a9782010c1eca7ff396ac7a80e4be2fda9f Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 15:55:48 +1000
Subject: [PATCH 2/3] [Security] Also bump Netty to 4.1.136.Final

The PR vulnerability-scan CI step flags Netty (CVE-2026-55831/55833/56745/59901)
at 4.1.135.Final bundled via netty-bom. Bump netty.version to 4.1.136.Final.

UID2-7571 UID2-7572 UID2-7573 UID2-7574

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 1afc4b26..74ef962a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -63,7 +63,7 @@
         <vertx.version>4.5.21</vertx.version>
         <!-- check micrometer.version vertx-micrometer-metrics consumes before bumping up -->
         <micrometer.version>1.12.2</micrometer.version>
-        <netty.version>4.1.135.Final</netty.version>
+        <netty.version>4.1.136.Final</netty.version>
         <jackson.version>2.21.4</jackson.version>
         <image.version>${project.version}</image.version>
     </properties>

From c7066cd4ebba0e4d5d65f0bc61a8ffccb6d678b6 Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 16:25:15 +1000
Subject: [PATCH 3/3] [Security] Remove obsolete jackson CVE-2026-54512/54513
 .trivyignore suppression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These entries (exp:2026-07-25) were the interim suppression from UID2-7364 while
awaiting a jackson fix, and they had already expired. This PR applies the real
fix (jackson 2.21.4), so the suppression is now dead cruft — removing it.

UID2-7569 UID2-7570

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .trivyignore | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index c8f56aed..95aa9b7d 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -5,10 +5,3 @@
 # jackson-core async parser DoS - not exploitable, services only use synchronous ObjectMapper API
 # See: UID2-6670
 GHSA-72hv-8253-57qq exp:2026-09-01
-
-# jackson-databind polymorphic deserialization bypass - not exploitable, uid2-shared does not enable polymorphic
-# typing (no @JsonTypeInfo, enableDefaultTyping, or PolymorphicTypeValidator usage). No upstream fix released yet
-# (fix targets: 2.18.8, 2.21.4, 3.1.4; latest available: 2.18.4).
-# See: UID2-7364
-CVE-2026-54512 exp:2026-07-25
-CVE-2026-54513 exp:2026-07-25