From 183d99395fee8f8b36baa2aa7c32af9512933160 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 12:02:20 +0530 Subject: [PATCH 1/4] Upgrade jackson-databind and jackson-core to 2.22.2 (BlackDuck security fix) jackson-databind 2.18.9: BDSA-2026-30990 (HIGH 7.3), BDSA-2026-30983 (MED 6.7), BDSA-2026-30981 (MED 5.1) jackson-core 2.18.6: BDSA-2026-29973 (MED 4.8), BDSA-2026-26434 (MED 6.5), BDSA-2026-24099 (MED 6.7) --- sdm/pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdm/pom.xml b/sdm/pom.xml index fb5a2d34..0eab74dc 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -39,10 +39,10 @@ 0.8.7 3.10.8 3.5.7 - 2.18.9 + 2.22.2 20250107 1.18.0 - 2.18.6 + 2.22.2 5.15.2 5.4.4 5.4.3 From c28a4295a7cb900df033be246d50e7e529c3c4ce Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 12:31:44 +0530 Subject: [PATCH 2/4] Revert "Upgrade jackson-databind and jackson-core to 2.22.2 (BlackDuck security fix)" This reverts commit 183d99395fee8f8b36baa2aa7c32af9512933160. --- sdm/pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdm/pom.xml b/sdm/pom.xml index 0eab74dc..fb5a2d34 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -39,10 +39,10 @@ 0.8.7 3.10.8 3.5.7 - 2.22.2 + 2.18.9 20250107 1.18.0 - 2.22.2 + 2.18.6 5.15.2 5.4.4 5.4.3 From 4e004faf291a7e4e363fe8b79053769fa6f0a401 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 13:05:52 +0530 Subject: [PATCH 3/4] Upgrade jackson to 2.22.2 with aligned jackson-annotations 2.22 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrades jackson-databind 2.18.9→2.22.2 and jackson-core 2.18.6→2.22.2 to address BlackDuck security findings (BDSA-2026-30990 HIGH, BDSA-2026-30983, BDSA-2026-30981, BDSA-2026-29973, BDSA-2026-26434, BDSA-2026-24099). Also explicitly pins jackson-annotations to 2.22 to override sdk-bom:5.21.0 which manages jackson-annotations at 2.19.1 — without this, jackson-databind 2.22.2 compiled against annotations:2.22 APIs runs against 2.19.1 at runtime, causing build failures in CI. --- sdm/pom.xml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/sdm/pom.xml b/sdm/pom.xml index fb5a2d34..8c9b1901 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -39,10 +39,11 @@ 0.8.7 3.10.8 3.5.7 - 2.18.9 + 2.22.2 20250107 1.18.0 - 2.18.6 + 2.22.2 + 2.22 5.15.2 5.4.4 5.4.3 @@ -196,6 +197,11 @@ jackson-databind ${jackson-databind-version} + + com.fasterxml.jackson.core + jackson-annotations + ${jackson-annotations-version} + org.json json From c30ce98f4f444da5a6eed3b9f873e2ec5facd0ed Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 13:46:56 +0530 Subject: [PATCH 4/4] =?UTF-8?q?Upgrade=20httpclient5=205.4.4=E2=86=925.6.4?= =?UTF-8?q?=20to=20fix=20CVE-2026-71290=20(CRITICAL=209.1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BlackDuck finding CVE-2026-71290 (CRITICAL 9.1) on Apache HttpClient 5.4.4. Upgraded httpclient5-version to 5.6.4 which is compatible with existing httpcore5:5.4.3 (httpclient5-parent 5.6.4 declares httpcore.version=5.4.3). --- sdm/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdm/pom.xml b/sdm/pom.xml index 8c9b1901..42d4fc8c 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -45,7 +45,7 @@ 2.22.2 2.22 5.15.2 - 5.4.4 + 5.6.4 5.4.3 4.1.5 4.4.16