From de08e398d6015c4d3e4e8cfd06cb59236a978bd3 Mon Sep 17 00:00:00 2001 From: andy317 <129303424+andy317fe301f8c7@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:08:25 -0400 Subject: [PATCH] Bump java-jwt to 4.6.0 and pin Jackson 2.22.1 to fix CVEs The transitive Jackson pulled in via com.auth0:java-jwt was flagged with multiple advisories (HIGH severity in jackson-databind and jackson-core). java-jwt 4.5.1 pulls Jackson 2.21.0 (still vulnerable); 4.6.0 pulls 2.22.0 (still 3 open advisories). Pinning jackson-bom to 2.22.1 resolves all known CVEs. Verified: jackson-core and jackson-databind both resolve to 2.22.1; guardian unit tests pass. Co-Authored-By: Claude Opus 4.8 --- guardian/build.gradle | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/guardian/build.gradle b/guardian/build.gradle index fd718a1..72f5af2 100644 --- a/guardian/build.gradle +++ b/guardian/build.gradle @@ -88,7 +88,9 @@ dependencies { implementation 'com.squareup.okhttp3:okhttp' implementation 'com.squareup.okhttp3:logging-interceptor' // JWT signing/verification - implementation 'com.auth0:java-jwt:4.5.1' + implementation 'com.auth0:java-jwt:4.6.0' + // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt) + implementation platform('com.fasterxml.jackson:jackson-bom:2.22.1') testImplementation 'com.squareup.okhttp3:mockwebserver' // Mockito